pharoscontrols Information Disclosure

pharoscontrols Unauthorized Information Disclosure zoomeye dork : https://www.zoomeye.org/searchResult?q=%22Location%3A%20%2Fdefault%2Findex.lsp%22 Remote administration interface http://xx.xx.xx.xx/default/index.lsp Unauthorized Logfile Disclosure http://xx.xx.xx.xx/default/log.lsp...

Baseon Lantronix MSS IOT/Cameras Device Servers telnet-Service NO require password authentication

Baseon Lantronix MSS IOT/Cameras Device Servers telnet-Service NO require password authentication had Exposed on the internet in ZoomEye : https://www.zoomeye.org/searchResult?q=%22prompt%20for%20assistance%22%20%2Bport:%2223%22&t=all login telnet with no password...

Nep Inverter Monitor Information Disclosure

Nep Inverter Monitor Information Disclosure zoomeye: https://www.zoomeye.org/searchResult?q=%22nep%2Fstatus%2Findex%2F%22 Energy overvie Disclosure http://xx.xx.xx.xx//nep/status/index/1...

AutoSploit = Shodan/Censys/Zoomeye + Metasploit

PenTestIT RSS Feed I know, I know that you already have read about AutoSploit and used it probably since word got out about this auto exploitation tool some two months ago. However, between then and now, a lot has changed with the tool and this post is about that. What is AutoSploit? AutoSploit i...

AutoSploit v2.0 - Automated Mass Exploiter

As the name might suggest AutoSploit attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been select...

massExpConsole - Collection of Tools and Exploits with a CLI UI

Collection of Tools and Exploits with a CLI UI What does it do? an easy-to-use user interface cli execute any adapted exploit with process-level concurrency crawler for baidu and zoomeye a simple webshell manager some built-in exploits automated more to come... Requirements GNU/Linux or MacOS, WS...

IDS VSE IP Camera - Authenticated Remote Code Execution Vulnerability

The ctrl.cgi script on the device's webserver that runs as root is vulnerable to remote command execution by an authenticated user, with the default password being "admin:admin". The sntpip GET parameter is fed to the command line by the CGI script without sanitization for semicolons, allowing an...

Netgear router password disclosure Vulnerability(CVE-2017-5521)

0x01 vulnerability overview NETGEAR is a United States well-known router manufacturers, its products are used worldwide extensively. Recently, foreign security researcher Simon Kenin find NETGEAR router more series there is a password leak Vulnerability, CVE-2017-5521-in. When the router Password...

HP Printers Wi-Fi - Improper Access Control

0x01 vulnerability overview 1. Vulnerability information 2017 2 2 June, the foreign site seclists. org reported a HP printer WiFi direct connection of the unauthorized access vulnerability, through our follow-up, found that the unauthorized access vulnerability also affects the same type have the...

ZoomEye Search

The module use the ZoomEye API to search ZoomEye. ZoomEye is a search engine for cyberspace that lets the user find specific network componentsip, services, etc.. Setting facets will output a simple report on the overall search. It's values are: Host search: app, device, service, os, port, countr...

Pocsuite - Remote Vulnerability Testing Framework Developed By The Knownsec Security Team

Pocsuite is an open-sourced remote vulnerability testing and PoC development framework developed by the Knownsec Security Team. It serves as the cornerstone of the team. You can use Pocsuite to verify and exploit vulnerabilities or write PoC/Exp based on it. You can also integrate Pocsuite in you...

Remote Vulnerability Testing Framework: Pocsuite

Pocsuite is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec Security Team. It comes with a powerful proof-of-concept engine, many niche features for the ultimate penetration testers and security researchers. Requirements Python 2.6...

Jenkins 低权限用户 API 服务调用 可致远程命令执行

漏洞演示 将 Jenkins 跑起来后，在低权限用户下构造 XML 文档： hashCode open /Applications/Calculator.app false 0 0 0 start 1 发送 Payload 至接口 http://...:8080/jenkins/createItem?name=knownsec： 成功后服务端会运行 计算器 程序。 漏洞影响 影响版本： 1.650 （1.650版本已修复该问题） 从zoomeye.org上搜索设备指纹“Jenkins” 从搜索的结果来看，约存在20000个潜在受到影响的目标。 相关链接...

Netcore / Netis 路由器后门

漏洞概要 2014 年 8 月末，由中国生产的一系列路由器（国内品牌名称为 Netcore ，国外品牌名称为 Netis ）被爆出含有一个严重的后门漏洞。攻击者可以通过此漏洞获取路由器 root 权限。 2014 年 12 月 28 日，微博上爆料 Netcore 的后门仍然存在（文章地址：http://www.weibo.com/p/1001603792736686871336）。 漏洞描述 Netcore 系列路由器在 /bin 目录下存在一个名为 igdmptd 的程序，此程序会监听 UDP 端口 53413 端口： 之后调用 operateloop...

D-Link revA v1.13 路由器后门

下载了D-link无线路由器型号：DIR-100 revA的固件程序 v1.13。使用工具Binwalk，很快的就从中发现并提取出一个只读SquashFS文件系统，没用多大功夫我就将这个固件程序的web server/bin/webs加载到了IDA中： 基于上面的字符信息可以看出，这个/bin/webs二进制程序是一个修改版的thttpd，提供路由器管理员界面操作功能。看起来是经过了台湾明泰科技D-Link的一个子公司的修改。他们甚至很有心计的将他们很多自定义的函数名都辅以“alpha”前缀： 这个 alphaauthcheck 函数看起来很有意思！...

Jenkins CommonCollections vulnerability perfect to use the tool-vulnerability warning-the black bar safety net

This week is the fire of a vulnerability through this vulnerability can execute arbitrary java code, The impact of Jenkins, WebSphere, WebLogic, etc. a series of popular services. However, foreigners write ysoserial code has bug, can not properly execute the command, readily get rid of. ! Having...

WebLogic “Java 反序列化”过程远程命令执行漏洞

漏洞原理 反序列化是指特定语言中将传递的对象序列化数据重新恢复为实例对象的过程，而在这个过程中会执行一系列的字节流解析和对象实例化操作用于恢复之前序列化时的对象。在原博文所提到的那些 Java 应用里都有特定的接口用于传递序列化对象数据，而在反序列化时并没有限制实例化对象的类型，导致可以任意构造应用中已经包含的对象利用反序列化操作进行实例化。 Java 在进行反序列化操作的时候会使用 ObjectInputStream 类调用 readObject...

WebSphere “Java 反序列化”过程远程命令执行漏洞

满足此漏洞的环境配置 漏洞源头commons-collections.jar 开启的SOAP端口8880. /opt/IBM/WebSphere/AppServer/properties/wsadmin.properties 测试websphere的环境版本号7.0.0.11，目前最新的版本是8.5.5 漏洞影响 ZoomEye 团队针对全球开放8880端口的289.6万服务器进行了漏洞验证，已经确认其中963台服务器存在该风险 关联漏洞链接 1. JBoss “Java 反序列化”过程远程命令执行漏洞 https://www.sebug.net/vuldb/ssvid-89723 2...

Siemens SIMATIC S7-1200固件版本低于4.1.3的设备跨站伪造请求（CSRF）漏洞

漏洞分析 Siemens SIMATIC S7-1200的web端可以与控制PLC的运行以及设备状态数据的获取。而固件版本低于4.1.3的web存在跨站请求伪造（CSRF）漏洞。 由于S7-1200的web端并没有采取针对CSRF攻击的防范措施，如验证HTTP Referer字段，因此攻击者可以实施CSRF攻击，在未授权的情况下进行PLC运行状态改变，更新固件等敏感操作。 漏洞验证 我们通过zoomeye，搜索到一款SIMATIC S7-1200，固件版本号为v3.00.01，经过测试发现存在CSRF漏洞。 验证过程：...

IIS 系列 Http.sys 处理 Range 整数溢出漏洞

一、漏洞概要 2015年04月14日，微软发布严重级别的安全公告 MS15-034，编号为 CVE-2015-1635，据称在 Http.sys 中的漏洞可能允许远程执行代码。 漏洞描述Http.sys 是一个位于 Windows 操作系统核心组件，能够让任何应用程序通过它提供的接口，以 Http 协议进行信息通讯。微软在 Windows 2003 Server 里引进了新的 HTTP API 和内核模式驱动 Http.sys，目的是使基于 Http 服务的程序更有效率。其实在 Windows XP 安装 SP2 后，Http.sys...