Ubiquiti AirOS 6.x - SSH Key Upload

Path traversal file upload via /login.cgi places an attacker SSH public key into /etc/dropbear/authorizedkeys, enabling login as ubnt. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS 6.x arbitrary file upload to authorizedkeys.""" from future import annotations import io import tempfi...

Ubiquiti AirOS - Unauthenticated CLI RCE Detection

Detects AirOS unauth RCE by POSTing multipart exec=cat /etc/passwd&action=cli to /admin.cgi/sd.css with a forged AIROSSESSIONID cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AirOS unauth RCE by POSTing multipart exec=cat /etc/passwd&action=cli to /admin.""" import re from kittysplo...

Ubiquiti AirOS - Unauthenticated CLI RCE

Exploits AirOS unauthenticated CLI execution via multipart POST to admin.cgi/sd.css with a forged AIROSSESSIONID cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS unauthenticated CLI RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Ubiquiti Networks AirOS Operating System Command Injection Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A command injection vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. A remote attacker could exploit the vulnerability...

Ubiquiti Networks AirOS Cross-Site Request Forgery Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A cross-site request forgery vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. An attacker could exploit this...

Ubiquiti Networks AirOS Cross-Site Scripting Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A cross-site scripting vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. An attacker could exploit the vulnerability to...

PT-2018-4575

Name of the Vulnerable Software and Affected Versions Ubiquiti airMAX versions prior to 7.1.3 Ubiquiti airMAX M versions prior to 5.6.2 Ubiquiti airMAX M versions prior to 5.5.11 Ubiquiti airMAX M versions prior to 5.5.10u2 Ubiquiti airGateway versions prior to 1.1.5 Ubiquiti airFiber AF24/AF24HD...

Ubiquiti airOS - Arbitrary File Upload (Metasploit)

Exploit for unix platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth fi...

Ubiquiti airOS Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth file upload to install a new root user to /etc/passwd an...

Ubiquiti airOS Arbitrary File Upload

This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...

Ubiquiti airOS Arbitrary File Upload

This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...

Ubiquiti-AirOS-5.5.2

The http://IP/test.cgi "essid" parameter is not sanitized for input which allows for execution of operating system commands. The parameter input field can be like this to create a file /tmp/test.txt: LINKTEST /bin/touch /tmp/test.txt " import urllib, urllib2, cookielib, sys, random, mimetools,...

Ubiquiti AirOS <= 5.5.2 Remote POST-Auth Root Command Execution

Exploit for hardware platform in category remote exploits !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Ubiquiti AirOS 0x90.nl Software link :...

Ubiquiti AirOS 5.5.2 Command Execution

!/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Ubiquiti AirOS 0x90.nl Software link : http://www.ubnt.com/eula/?BACK=/downloads/XM-v5.5.2.build14175.bin Vendor site :...

Ubiquiti AirOS 5.5.2 - (Authenticated) Remote Command Execution

Ubiquiti AirOS 5.5.2 - Authenticated Remote Command Execution !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Ubiquiti AirOS 0x90.nl Software link :...

Ubiquiti AirOS 5.5.2 - (Authenticated) Remote Command Execution

!/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Ubiquiti AirOS 0x90.nl Software link : http://www.ubnt.com/eula/?BACK=/downloads/XM-v5.5.2.build14175.bin Vendor site :...