关联漏洞
标题：
Dasan GPON家庭路由器命令注入漏洞
(CVE-2018-10562)
描述：Dasan GPON是韩国Dasan公司的一款家用路由器产品。 Dasan GPON家庭路由器中存在命令注入漏洞，该漏洞源于用户再次访问/diag.html页面时路由器将因特网包探索器的结果保存在/tmp中并将它传输给用户。攻击者可通过向GponForm/diag_Form URI发送带有‘dest_host’参数的diag_action=ping请求利用该漏洞执行命令并检索输出。
描述
Python exploit for Remote Code Executuion on GPON home routers (CVE-2018-10562). Initially disclosed by VPNMentor (https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/), kudos for their work.
介绍
# RCE on GPON home routers (CVE-2018-10561)
## Vulnerability
Many routers today use GPON internet, and a way to bypass all authentication on the devices (**CVE-2018-10561**) was found by [VPNMentor](https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/). With this authentication bypass, it's also possible to unveil another command injection vulnerability (**CVE-2018-10562**) and execute commands on the device.
At the time it was written almost ONE MILLION of these devices are exposed to the Internet, according to [Shodan](https://www.shodan.io/search?query=title%3A%22GPON+Home+Gateway%22).
## Dependencies required
`requests`
`urllib2`
## Tested on
`Kali Linux`
`Ubuntu 17.10 Server`
## Usage
```
python gpon_rce.py TARGET_URL COMMAND
```
e.g.
```
python gpon_rce.py http://192.168.1.15 'id'
```
## Screenshots
<p align="center">
<img width="460" src="https://cdn1.imggmi.com/uploads/2018/5/7/f1210b72c5a5349f8aa5cbf310c3c7d6-full.png">
</p>
<p align="center">
<img width="460" src="https://cdn1.imggmi.com/uploads/2018/5/7/981fdc2cdce43511a89135f2fca7f474-full.png">
</p>
文件快照
[4.0K] /data/pocs/21bef35f636cc8b5a6b470f46f6a26088885bab8
├── [2.1K] gpon_rce.py.py
└── [1.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。