exploit the possibilities
Showing 1 - 11 of 11 RSS Feed

Files from Andrew Klaus

Email addressandrewklaus at gmail.com
First Active2016-08-16
Last Active2019-06-12
Telus Actiontec T2200H Local Privilege Escalation
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec T2200H with firmware T2200H-31.128L.08 suffers from a local privilege escalation vulnerability.

tags | exploit, local
advisories | CVE-2019-12789
MD5 | e98dd080d3db4e14385e367484d9e1a8
Telus Actiontec WEB6000Q Serial Number Information Disclosure
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec WEB6000Q with firmware 1.1.02.22 suffers from a serial number information disclosure vulnerability. The wireless extenders use DHCP Option 125 to include device details such as model number, manufacturer, and serial number. The WCB6000Q DHCP DISCOVER and REQUEST broadcasts include the device serial number in the DHCP option 125 (subopt 2) field. An attacker on the same Layer 2 network segment as the device, can see all these DHCP requests with a packet capture. Once he or she has this, the device's admin web UI password can be reset using the web UI "forgot password" page to reset to a known value.

tags | exploit, web, info disclosure
MD5 | 98919e01ba7ab243d2822909e16fb308
Telus Actiontec T2200H Serial Number Information Disclosure
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec T2200H with firmware T2200H-31.128L.08 suffers from a serial number information disclosure vulnerability. The wireless extenders use DHCP Option 125 to include device details such as model number, manufacturer, and serial number. By forging a special DHCP packet using Option 125, an attacker can obtain the device serial number. Once he or she has this, the device's admin web UI password can be reset using the web UI "forgot password" page to reset to a known value.

tags | exploit, web, info disclosure
MD5 | 42324fc451c05609b2fbdea3411024b0
Telus Actiontec WEB6000Q Denial Of Service
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec WEB6000Q with firmware 1.1.02.22 suffers from a denial of service vulnerability. By querying CGI endpoints with empty (GET/POST/HEAD) requests causes a Segmentation Fault of the uhttpd webserver. Since there is no watchdog on this daemon, a device reboot is needed to restart the webserver to make any modification to the device.

tags | exploit, denial of service, cgi
MD5 | 61ad8f29ac935743a8389851c8f021d3
Telus Actiontec WEB6000Q Privilege Escalation
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec WEB6000Q with firmware 1.1.02.22 suffers from both local and remote privilege escalation vulnerabilities.

tags | exploit, remote, local, vulnerability
advisories | CVE-2018-15555, CVE-2018-15556, CVE-2018-15557
MD5 | ca74c3825d757d6127b49c81ec399a93
Telus Actiontec T2200H WiFi Credential Disclosure
Posted Jun 12, 2019
Authored by Andrew Klaus

Telus Actiontec T2200H with firmware T2200H-31.128L.08 suffers from a credential disclosure vulnerability. An HTTP interface used by wireless extenders to pull the modem's wifi settings uses DHCP client-provided option values to restrict access to this API. By forging DHCP packets, one can access this interface without any authentication and obtain details such as SSID name, encryption type, and WPA/WEP keys. This can be leveraged if an attacker is on the same Layer 2 network as the modem.

tags | exploit, web, info disclosure
MD5 | 7d7e81d23de02a98e1889f1143a3a092
Subsonic Music Streamer 4.4 For Android Improper Certificate Validation
Posted Sep 7, 2018
Authored by Andrew Klaus

Subsonic Music Streamer version 4.4 suffers from an improper certificate validation vulnerability.

tags | advisory
advisories | CVE-2018-15898
MD5 | 48284144e876af5f1ddbca4b654eca63
DSub For Subsonic 5.4.1 Improper Certificate Validation
Posted Sep 7, 2018
Authored by Andrew Klaus

DSub for Subsonic version 5.4.1 suffers from an improper certificate validation vulnerability.

tags | advisory
advisories | CVE-2018-1000664
MD5 | ec6d3a881f8d6526233fd8a8d63345ac
OpenConext-EngineBlock 5.7.3 Cross Site Scripting
Posted Jul 13, 2018
Authored by Andrew Klaus

OpenConext-EngineBlock versions 5.7.0 through 5.7.3suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-1000611
MD5 | 0f69b9dff062062f1f42999854188322
Actiontec WCB3000N 0.16.2.5 Privilege Escalation
Posted Nov 7, 2016
Authored by Andrew Klaus

Actiontec WCB3000N with firmware version 0.16.2.5 suffers from a privilege escalation vulnerability.

tags | exploit
MD5 | 5e0ed3c59094d18541b0dc20edb37d78
Actiontec T2200H Remote Reverse Root Shell
Posted Aug 16, 2016
Authored by Andrew Klaus

Actiontec T2200H allows for command injection that provides a remote root reverse shell.

tags | exploit, remote, shell, root
MD5 | 9489a774d63572ecee9b06a196dac3fd
Page 1 of 1
Back1Next

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    16 Files
  • 18
    Sep 18th
    8 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close