unknownpwn.github.io

Tecnovision LED 视频墙漏洞与利用。从 SQLi 到完整 root 访问权限。 简介： Tecnovision 是 LED 视频墙制造商，其产品用于竞技场（例如特威克纳姆体育场）、音乐厅、购物中心、道路标识等等诸多场合。DlxSpot Player 4 是其中一些 LED 墙的软件控制器。以下是我发现的未修补漏洞，它们（哈！）使我从 SQL 注入一路走向完整 root 访问权限。（请注意，硬编码密码是最后一项发现，它们在此列表中只是按分配的 CVE 编号排序） 感谢您抽出时间阅读本文。如有任何疑问，请在 Twitter 上联系我 @unknownpwn...

Tecnovision DlxSpot Web Detection

Detection of Tecnovision DlxSpot. The script sends a connection request to the server and attempts to detect Tecnovision DlxSpot and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Tecnovision DlxSpot Multiple Vulnerabilities

Tecnovison DlxSpot is prone to multiple vulnerabilities: - Hardcoded Root SSH Password CVE-2017-12928 - Arbitrary File Upload to RCE CVE-2017-12929 - Admin Interface SQL Injection CVE-2017-12930 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced...

DlxSpot Shell Upload

Exploit Title: DlxSpot - Player4 LED video wall - Arbitrary File Upload to RCE Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/ Software Link: n/a Version: 1.5.10 Tested on:...

DlxSpot Hardcoded Password

Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password. Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/ Software Link: n/a Version: All known versions...

DlxSpot SQL Injection

Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL Injection Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/ Software Link: n/a Version: 1.5.10 Tested on:...

Tecnovision DLX Spot - SSH Backdoor Vulnerability

Exploit for multiple platform in category remote exploits Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password. Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage:...

Tecnovision DLX Spot - SSH Backdoor Access

Tecnovision DLX Spot - SSH Backdoor Access Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password. Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/...

Tecnovision DLX Spot - Authentication Bypass

Tecnovision DLX Spot - Authentication Bypass Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL Injection Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/...

Tecnovision DLX Spot - Authentication Bypass

Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL Injection Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage: http://www.tecnovision.com/ Software Link: n/a Version: 1.5.10 Tested on:...