module
TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection
| Disclosed | Created |
|---|---|
| 12/26/2016 | 05/30/2018 |
Disclosed
12/26/2016
Created
05/30/2018
Description
TrueOnline is a major ISP in Thailand, and it distributes a customized version of
the Billion 5200W-T router. This customized version has at least two command injection
vulnerabilities, one authenticated and one unauthenticated, on different firmware versions.
This module will attempt to exploit the unauthenticated injection first, and if that fails,
it will attempt to exploit the authenticated injection.
This module was tested in an emulated environment, as the author doesn't have access to the
Thai router any more. Any feedback should be sent directly to the module's author, as well as
to the Metasploit project.
There are other language strings in the firmware, so it is likely that this firmware is not
only distributed in Thailand. Other Billion 5200W-T in other countries might be vulnerable too.
the Billion 5200W-T router. This customized version has at least two command injection
vulnerabilities, one authenticated and one unauthenticated, on different firmware versions.
This module will attempt to exploit the unauthenticated injection first, and if that fails,
it will attempt to exploit the authenticated injection.
This module was tested in an emulated environment, as the author doesn't have access to the
Thai router any more. Any feedback should be sent directly to the module's author, as well as
to the Metasploit project.
There are other language strings in the firmware, so it is likely that this firmware is not
only distributed in Thailand. Other Billion 5200W-T in other countries might be vulnerable too.
Author
Pedro Ribeiro
Platform
Unix
Architectures
cmd
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/linux/http/trueonline_billion_5200w_rce
msf /(e) > show actions
...actions...
msf /(e) > set ACTION < action-name >
msf /(e) > show options
...show and set options...
msf /(e) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.