# Exploit Title: ASKEY RTF3505VW-N1 - Privilege escalation # Date: 07-12-2022 # Exploit Author: Leonardo Nicolas Servalli # Vendor Homepage: www.askey.com # Platform: ASKEY router devices RTF3505VW-N1 # Tested on: Firmware BR_SV_g000_R3505VMN1001_s32_7 # Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-ASKEY/blob/main/README.md #Description: #---------- # ASKEY RTF3505VW-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases these routers use default credentials). # The command “tcpdump” is present in the restricted shell and do not handle correctly the -z flag, so it can be used to escalate privileges through the creation of a local file in the /tmp directory of the router, and injecting packets through port 80 (used for the router's Web GUI) with the string ";/bin/bash" in order to be executed by "-z sh". By using “;/bin/bash” as injected string we can spawn a busybox/ash console.