[meow]

I found an LFI in a CGI file, here are the details

• web instance is running as root (I have the hash for the root password thanks to /3tc/shadow, however this is useless as there are no services running on the device that allow logging in)
  
• web instance is using the developer version of lighthttpd 1.4.35
  
• I can't find any log files for shit
  
• RFI not possible
  
• I have no way of telling what the underlying programming language is unless I do some file searching
  
• /pr0c/self/environ exists but doesn't display anything sent in your request
  
• In order to use any LFI to RCE method regarding wrappers, I would have to either bruteforce or somehow find out what the underlying programming language/source code is so that I know what wrappers I'm able to use
  
• including /3tc/release and /3tc/issue returns nothing
  
• /pr0c/version returns "Kernel 1.04.00.00 (Aug 25 2014 - 16:00:55)"
  
• this is a peripheral device
  

TL;DR I'm having trouble getting RCE. Any suggestions?

[Wildfire]

Are there any file uploads you can control that are available to you? For instance, if an image upload were on the page, you can assume it would be in /tmp/ and get the filename from the URL the uploader gave you itself.

[meow]

Are there any file uploads you can control that are available to you?

Nope.

[Wildfire]

Are there any file uploads you can control that are available to you?

Nope.

Shit.
I had another idea; if you have physical access to the device, perhaps you can use /dev/ttyS0 and pipe a script in through serial? (I know it sounds shitty)
Or is this peripheral device remote?

[meow]

Are there any file uploads you can control that are available to you?

Nope.

Shit.
I had another idea; if you have physical access to the device, perhaps you can use /dev/ttyS0 and pipe a script in through serial? (I know it sounds shitty)
Or is this peripheral device remote?

It's completely remote.

[Wildfire]

Nope.

Shit.
I had another idea; if you have physical access to the device, perhaps you can use /dev/ttyS0 and pipe a script in through serial? (I know it sounds shitty)
Or is this peripheral device remote?

It's completely remote.

Do you have the name of the device so I can binwalk the firmware?

[Wildfire]

asdasdasdtestestestasdasdasdtestestest

Loud and clear.

[meow]

asdasdasdtestestestasdasdasdtestestest

Loud and clear.

Sorry lol, was trying something out.

Anyways, here's an update:

I was able to log into the admin panel of the device. There was an upload form but didn't allow anything except VALID jpeg files (couldn't bypass it, I tried everything I knew). Then after looking around some more I found a page that lets you import/export the system's configuration. I exported it to see if I could put a Perl reverse shell in there and then include it after importing it, however I'm faced with two problems 1. I don't know where the file is located on the fs, so I wouldn't know the path when including the file and 2. I've tried opening the exported configuration file with 2 different programs and its just unreadable shit. I need something that will give it to me in plaintext.

[Wildfire]

asdasdasdtestestestasdasdasdtestestest

Loud and clear.

Sorry lol, was trying something out.

Anyways, here's an update:

I was able to log into the admin panel of the device. There was an upload form but didn't allow anything except VALID jpeg files (couldn't bypass it, I tried everything I knew). Then after looking around some more I found a page that lets you import/export the system's configuration. I exported it to see if I could put a Perl reverse shell in there and then include it after importing it, however I'm faced with two problems 1. I don't know where the file is located on the fs, so I wouldn't know the path when including the file and 2. I've tried opening the exported configuration file with 2 different programs and its just unreadable shit. I need something that will give it to me in plaintext.

I'm pretty familiar with finding vulns directly in firmware tars, so I could take a look if you have a system firmware image, can extract the binaries and throw them in IDA for a quick looksee.

[meow]

Loud and clear.

Sorry lol, was trying something out.

Anyways, here's an update:

I was able to log into the admin panel of the device. There was an upload form but didn't allow anything except VALID jpeg files (couldn't bypass it, I tried everything I knew). Then after looking around some more I found a page that lets you import/export the system's configuration. I exported it to see if I could put a Perl reverse shell in there and then include it after importing it, however I'm faced with two problems 1. I don't know where the file is located on the fs, so I wouldn't know the path when including the file and 2. I've tried opening the exported configuration file with 2 different programs and its just unreadable shit. I need something that will give it to me in plaintext.

I'm pretty familiar with finding vulns directly in firmware tars, so I could take a look if you have a system firmware image, can extract the binaries and throw them in IDA for a quick looksee.

Nevermind, I fucking finally found a way to execute commands. Thanks for trying to help.