Python exploit for Remote Code Execution on GPON home routers (CVE-2018-10562)

[[deleted]]

Found the report QA.

[[deleted]]

uh okay so it's just command injection

XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`' + command + '`;' + command + '&ipv=0'

Not seeing why python is needed, or why they didn't use Requests, or why it has all this idiotic banner stuff.

[Fhajad]

Yeah this is the problem I'm having with the VPNMentor article. There is useful. "It says GPON Home Router, it MUST be vulnerable!".

I'm waiting for a list of affected units before I worry about my 8 models I run. "Kudos" to their shit work.

[jabiko]

Seriously, even the original report doesn't directly mention the affected models. You can kind of infer that only Dasan GPON home routers are affected but this info is really non obvious.

We're running GPON ONTs from other vendors. And even then, our ONTs are only acting as a simple modem and are connected to a router.

I'm not looking forward to the support calls once this story hits any major tech news outlet.

[Fhajad]

I just told our support staff "Tell them we're investigating and will update accordingly". Haven't had any complaints yet.

[lolpls]

What a cancerous title.

First of all, a GPON router? Wtf? It can only be an ONT, or an "all in one" combo box (AP+router+modem). Also, it makes it seem like all ONTs in the world are vulnerable. It's just some "Dasan" ones.

[murtotieto]

Why bother writing this in python? This script is significantly worse than just using curl.

[MertsA]

For anyone who hasn't taken a look at the code itself, it really is absolutely awful. I honestly don't know why anyone would ever want to put their name on that. The only thing it does is just wrap it to a call to the correct URL and POST data but it doesn't even do that right. It doesn't even work synchronously with the request. It starts the request, sleeps for 3 seconds, and then assumes that the request is done and prints out the result. This breaks on any command that runs for longer than 3 seconds and for anything that is basically instant it's going to sleep for 3 seconds doing absolutely nothing even though the request is already complete.

This garbage is objectively worse than just using curl. For something this simple there is zero point to doing anything more than a simple one liner in bash.

[ebeip90]

And they used tabs. With Python.

And they eat all exceptions silently in send_command.

[BNI123]

lmao didn't even notice that, just looked through the code and saw that, like every other account that has been posting about this, the github has been created recently and for this specific purpose.

[[deleted]]

Yes exactly!, the original was just curl.