Hardware Router CTF

Here at Pen Test Partners we love hardware and also love a good CTF. So here's how I figured out my way through the hardware CTF that PTP set as a pre-requisite for some interviews. I'm pretty new to hardware, so learned quite a bit along the way. We have now moved on to a new 'interview' CTF so,...

Exploit for Classic Buffer Overflow in Point-To-Point_Protocol_Project Point-To-Point_Protocol

PoC exploit for CVE-2020-8597, a buffer overflow vulnerability in the eap.c file of the pppd daemon in ppp versions 2.4.2 through 2.4.8. The vulnerability allows for a buffer overflow in the eaprequest and eapresponse functions, which can be exploited by sending a long "EAP: unauthenticated peer...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

Design/Logic Flaw

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

Memory Corruption Vulnerability in TAS MH Ethernet Touch Screen Software (CNVD-2020-23755)

Ltd. is a wholly foreign owned enterprise established in China on July 1, 2000 by Antai International Investment Singapore Pte Ltd, a subsidiary of TECO Group, a renowned Taiwanese multinational corporation. A memory corruption vulnerability exists in the MH Ethernet touch screen software of Taia...

Memory Corruption Vulnerability in MTI MH Ethernet Touch Screen Software

Ltd. is a wholly foreign owned enterprise established in China on July 1, 2000 by Antai International Investment Singapore Pte Ltd, a subsidiary of TECO Group, a renowned Taiwanese multinational corporation. A memory corruption vulnerability exists in the MTI MH Ethernet touch screen software,...

Moxa PT-7528 and PT-7828 Series Hard Credential Vulnerability

Moxa PT-7528 and PT-7828 Series are both Ethernet switches manufactured by Moxa. A hard credential vulnerability exists in the Moxa PT-7528 and PT-7828 Series, which can be exploited by an attacker to obtain sensitive information...

Moxa PT-7528 and PT-7828 Series Information Disclosure Vulnerability

Moxa PT-7528 and PT-7828 Series are both Ethernet switches manufactured by Moxa. An information disclosure vulnerability exists in the Moxa PT-7528 and PT-7828 Series, which can be exploited by attackers to obtain sensitive information...

Multiple Moxa Products Plaintext Transfer Vulnerability

Moxa MB3170/MB3270/MB3180/MB3280/MB3480/MB3660 series is an advanced Ethernet gateway device manufactured by moxa Taiwan. An information disclosure vulnerability exists in multiple Moxa products, which can be exploited by attackers to obtain sensitive information...

Moxa EDS-G516E and EDS-510E series plaintext transfer vulnerability

Moxa EDS-G516E and EDS-510E series are both Ethernet switches manufactured by Moxa. A plaintext transfer vulnerability exists in the Moxa EDS-G516E and EDS-510E series, which can be exploited by attackers to obtain sensitive information...

Weak Password Vulnerability in Multiple Moxa Products

Moxa MB3170/MB3270/MB3180/MB3280/MB3480/MB3660 series is an advanced Ethernet gateway device manufactured by moxa Taiwan. A weak password vulnerability exists in several Moxa products, which can be exploited by attackers to gain access by performing a brute force attack...

Moxa EDS-G516E and EDS-510E series buffer overflow vulnerability (CNVD-2020-13515)

Moxa EDS-G516E and EDS-510E series are both Ethernet switches manufactured by Moxa. A buffer overflow vulnerability exists in the Moxa EDS-G516E and EDS-510E series, which can be exploited by an attacker to execute arbitrary code or cause a denial of service...

Moxa PT-7528 and PT-7828 Series Hardcoding Vulnerabilities

Moxa PT-7528 and PT-7828 Series are both Ethernet switches manufactured by Moxa. A hard-coded vulnerability exists in the Moxa PT-7528 and PT-7828 Series, which can be exploited by an attacker to recover confidential data...

Moxa EDS-G516E and EDS-510E series weak password vulnerability

Moxa EDS-G516E and EDS-510E series are both Ethernet switches manufactured by Moxa. A weak password vulnerability exists in the Moxa EDS-G516E and EDS-510E series, which can be exploited by attackers to obtain sensitive information...

Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure Vulnerability

Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera is an outdoor camera. A security vulnerability exists in the Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera. An attacker can exploit the vulnerability to disclose sensitive information...

Exploit for Improper Input Validation in Intel Ethernet_Diagnostics_Driver_Iqvw32.Sys

Intel-CVE-2015-2291 PoC exploit for CVE-2015-2291 Data-only a...

Unauthorized Access Vulnerability in IEXplorer at Delta Electronics Enterprise Management (Shanghai) Co.

IEXplorer is an industrial Ethernet utility software that provides automatic searching of Delta's industrial Ethernet products, instant monitoring of device connection status, fast IP address setting and software upgrades for products such as DVS series, DVW series, IFD9506, IFD9507, RTU-EN01,...