exploit the possibilities
Showing 1 - 25 of 1,913 RSS Feed

Operating System: Cisco

Exploiting Persistent XSS And Unsanitized Injection Vectors For Layer 2 Bypass And COOLHANDLUKE Protocol Creation
Posted May 26, 2022
Authored by Ken Pyle | Site cybir.com

This whitepaper demonstrates leveraging cross site scripting and polyglot exploitation in an exploit called COOLHANDLUKE to violate network segmentation / layer 2 VLAN policies while routing and sending a file between isolated, air gapped networks without a router. This issue affects HPE Procurve, Aruba Networks, Cisco, Dell, and Netgear products.

tags | paper, protocol, xss
systems | cisco
SHA-256 | 1ec58f30e8a0a21c51d095c930eb3fc00827e2d07118a62f2dd3d6f7154a73ce
Cisco RV340 SSL VPN Unauthenticated Remote Code Execution
Posted May 11, 2022
Authored by Pedro Ribeiro, Radek Domanski | Site metasploit.com

This Metasploit module exploits a stack buffer overflow in the Cisco RV series router's SSL VPN functionality. The default SSL VPN configuration is exploitable, with no authentication required and works over the Internet! The stack is executable and no ASLR is in place, which makes exploitation easier. Successful execution of this module results in a reverse root shell. A custom payload is used as Metasploit does not have ARMLE null free shellcode. This vulnerability was presented by the Flashback Team in Pwn2Own Austin 2021 and OffensiveCon 2022. For more information check the referenced advisory. This module has been tested in firmware versions 1.0.03.15 and above and works with around 65% reliability. The service restarts automatically so you can keep trying until you pwn it. Only the RV340 router was tested, but other RV series routers should work out of the box.

tags | exploit, overflow, shell, root, shellcode
systems | cisco
advisories | CVE-2022-20699
SHA-256 | 619682621429d96cd23a1e1bcd69a008398c5244223265886c52e2e417242d02
Hydra Network Logon Cracker 9.3
Posted Feb 3, 2022
Authored by van Hauser, thc | Site thc.org

THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.

Changes: Added support for Xcode compilation and new module cobaltstrike. Fixed ssh to support -M or ip/rangeix, rdp to detect empty passwords, http-form to no send empty headers, http on non-default ports when using with a proxy for vnc/cisco/, support IPv6 addresses in -M, and more.
tags | tool, web, imap
systems | cisco, unix
SHA-256 | 3977221a7eb176cd100298c6d47939999a920a628868ae1aceed408a21e04013
Cisco Small Business RV Series Authentication Bypass / Command Injection
Posted Feb 1, 2022
Authored by jbaines-r7, Takeshi Shiomitsu | Site metasploit.com

This Metasploit module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the upload.cgi binary will use the contents of the HTTP Cookie field as part of a curl request aimed at an internal endpoint. The curl request is executed using popen and allows the attacker to inject commands via the Cookie field. A remote and unauthenticated attacker using this module is able to achieve code execution as www-data. This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.

tags | exploit, remote, web, cgi, code execution
systems | cisco
advisories | CVE-2021-1472, CVE-2021-1473
SHA-256 | d5c273af97dd2e97fb770967821e9b90847b04e11e1abb75510669721ee38b45
Cisco IP Phone Cleartext Password Storage
Posted Jan 17, 2022
Authored by Gerhard Hechenberger, Steffen Robertz | Site sec-consult.com

Cisco IP Phone Series 78x1, 88x5, 88x1, 7832, 8832, 8821 and 3905 suffer from an insecure password storage vulnerability.

tags | exploit
systems | cisco
advisories | CVE-2022-20660
SHA-256 | 448c7c5cfcae3fc7bd414ad5be07cfbb1b7d955c723ac1c0f73d5e456f4c69e5
Cisco Small Business RV130W 1.0.3.44 Injection
Posted Sep 27, 2021
Authored by Michael Alamoot

Cisco Small Business RV130W version 1.0.3.44 exploit that injects counterfeit routers.

tags | exploit
systems | cisco
SHA-256 | 9ed47dde50d98da582e5d59d6001b33156cd31eb809f23d7ab77bd1c630c5a6a
Cisco Modeling Labs 2.1.1-b19 Remote Command Execution
Posted Jun 23, 2021
Authored by Jeremy Brown

Cisco Modeling Labs version 2.1.1-b19 remote command execution exploit.

tags | exploit, remote
systems | cisco
advisories | CVE-2021-1531
SHA-256 | 29df00cdf8fbbcafabb5f3a4cccb147529145b52b4f8832dee4e09e3d2d05d94
Cisco HyperFlex HX Data Platform File Upload / Remote Code Execution
Posted Jun 17, 2021
Authored by wvu, Mikhail Klyuchnikov, jheysel-r7, Nikita Abramov | Site metasploit.com

This Metasploit module exploits an unauthenticated file upload vulnerability in Cisco HyperFlex HX Data Platform's /upload endpoint to upload and execute a payload as the Tomcat user.

tags | exploit, file upload
systems | cisco
advisories | CVE-2021-1499
SHA-256 | f5c93c1dbb7c46d018f80b02b7e8b65d92e05da4eaa8f1ef27222f385aefb954
Cisco HyperFlex HX Data Platform Command Execution
Posted Jun 4, 2021
Authored by wvu, Mikhail Klyuchnikov, Nikita Abramov | Site metasploit.com

This Metasploit module exploits an unauthenticated command injection in Cisco HyperFlex HX Data Platform's /storfs-asup endpoint to execute shell commands as the Tomcat user.

tags | exploit, shell
systems | cisco
advisories | CVE-2021-1497, CVE-2021-1498
SHA-256 | 0a1aa0b824e15e84195c2385f8bf0e7dc95224435e2865997906be79faf81ba6
Cisco SD-WAN vManage 19.2.2 Remote Root
Posted Jun 3, 2021
Authored by Johnny Yu | Site github.com

Cisco SD-WAN vManage version 19.2.2 remote root shell proof of concept exploit that leverages multiple vulnerabilities.

tags | exploit, remote, shell, root, vulnerability, proof of concept
systems | cisco
advisories | CVE-2020-3387, CVE-2020-3437
SHA-256 | a39fed0dc5f1a0ca97a329bad76e86ccb0fe30addc423eef4129602dce1d82e6
Cisco RV Authentication Bypass / Code Execution
Posted Apr 20, 2021
Authored by T Shiomitsu | Site iot-inspector.com

Cisco RV-series routers suffer from an authentication bypass vulnerability. The RV34X series are also affected by a command injection vulnerability in the sessionid cookie, when requesting the /upload endpoint. A combination of these issues would allow any person who is able to communicate with the web interface to run arbitrary system commands on the router as the www-data user. Vulnerable versions include RV16X/RV26X versions 1.0.01.02 and below and RV34X versions 1.0.03.20 and below.

tags | exploit, web, arbitrary, bypass
systems | cisco
advisories | CVE-2021-1472, CVE-2021-1473
SHA-256 | f3c8685d841186aca43bc22f8ed2b32e8512c7730129f2ed6fe20f360378fa91
Hydra Network Logon Cracker 9.2
Posted Mar 15, 2021
Authored by van Hauser, thc | Site thc.org

THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.

Changes: Fix for http-post-form optional parameters. Enabled gcc 10 support for xhydra. IPv6 support for Host: header for http based modules. Various other updates.
tags | tool, web, imap
systems | cisco, unix
SHA-256 | 1a28f064763f9144f8ec574416a56ef51c0ab1ae2276e35a89ceed4f594ec5d2
Cisco UCS Manager 2.2(1d) Remote Command Execution
Posted Jan 18, 2021
Authored by liquidsky

Cisco UCS Manager version 2.2(1d) remote command execution exploit. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.

tags | exploit, remote, web, arbitrary, shell, cgi
systems | cisco
advisories | CVE-2015-6435
SHA-256 | f3fab9befb8e7cbad15afa31a69504a465f274122e534cebcbde38a7d8f6288e
Cisco RV110W 1.2.1.7 Denial Of Service
Posted Jan 14, 2021
Authored by Shizhi He

Cisco RV110W version 1.2.1.7 vpn_account denial of service proof of concept exploit.

tags | exploit, denial of service, proof of concept
systems | cisco
advisories | CVE-2021-1167
SHA-256 | d17a98598deaf9e49e4b5b6d4987373b9fff15aa4200a8930baafc922e80ba62
Cisco ASA 9.14.1.10 / FTD 6.6.0.1 Path Traversal
Posted Dec 15, 2020
Authored by Freakyclown

Cisco ASA version 9.14.1.10 and FTD version 6.6.0.1 path traversal exploit. Original discovery of this vulnerability is attributed to 3ndG4me in October of 2020.

tags | exploit, file inclusion
systems | cisco
advisories | CVE-2020-3452
SHA-256 | dfe0fcf7f0c733ce87bf53173ca792e20086cc5828ba3e9907aa3993b08bf8fe
Cisco 7937G Denial Of Service / Privilege Escalation
Posted Nov 16, 2020
Authored by Cody Martin

Cisco 7937G suffers from denial of service and privilege escalation vulnerabilities.

tags | exploit, denial of service, vulnerability
systems | cisco
SHA-256 | 1a85b1824e9e138ebbade8a3b9f4aa8efdff5e15d8a48bb3135fca92e2eff047
Cisco ASA / FTD 9.6.4.42 Path Traversal
Posted Oct 11, 2020
Authored by 3ndG4me

Cisco ASA and FTD version 9.6.4.42 suffer from a path traversal vulnerability.

tags | exploit, file inclusion
systems | cisco
advisories | CVE-2020-3452
SHA-256 | dbeb67abac718b9d4521c2ea7ce46740e7ea1eaa75cf4abed2e9f85cfff2fec7
Cisco AnyConnect Privilege Escalation
Posted Sep 30, 2020
Authored by Yorick Koster, Christophe de la Fuente, Antoine Goichot | Site metasploit.com

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to 4.9.00086 is vulnerable to a DLL hijacking and allows local attackers to execute code on the affected machine with with system level privileges. Both attacks consist in sending a specially crafted IPC request to the TCP port 62522 on the loopback device, which is exposed by the Cisco AnyConnect Secure Mobility Agent service.

tags | exploit, arbitrary, local, tcp
systems | cisco, windows
advisories | CVE-2020-3153, CVE-2020-3433
SHA-256 | 74ae12d312c6c46fa9f122b2a106d803de515d0b707dfe34720c066dd56a2680
Cisco 7937G Denial Of Service
Posted Aug 10, 2020
Authored by Cody Martin

Two denial of service exploits for Cisco 7937G versions SIP-1-4-5-7 and below.

tags | exploit, denial of service
systems | cisco
advisories | CVE-2020-16138, CVE-2020-16139
SHA-256 | 6329ae271427ebdd4aca842b16c5bf3f67949255d490ea35dafca48866d48d98
Cisco 7937G Privilege Escalation
Posted Aug 10, 2020
Authored by Cody Martin

Cisco 7947G versions SIP-1-4-5-7 and below privilege escalation exploit.

tags | exploit
systems | cisco
advisories | CVE-2020-16137
SHA-256 | 34708347a6cf94b31172406fb4db70445cf77dffd562fe392a73bb2f32ce2da0
Cisco 7937G All-In-One Exploiter
Posted Aug 10, 2020
Authored by Cody Martin

This exploit is an all-in-one tool that leverages vulnerabilities described in CVE-2020-16139, CVE-2020-16138, and CVE-2020-16137 against Cisco 7937G devices versions SIP-1-4-5-7 and below.

tags | exploit, vulnerability
systems | cisco
advisories | CVE-2020-16137, CVE-2020-16138, CVE-2020-16139
SHA-256 | 7724dcf86fe3eda058a8dbe264a07cb05296015350554358dc98f2cdd4cc6be1
Hydra Network Logon Cracker 9.1
Posted Jul 29, 2020
Authored by van Hauser, thc | Site thc.org

THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.

Changes: Enabled gcc 10 support for xhydra. Fixed crash in MD5 auth for rtsp. New module for smb2 which also supports smb3. Various other updates.
tags | tool, web, cracker, imap
systems | cisco, unix
SHA-256 | ce08a5148c0ae5ff4b0a4af2f7f15c5946bc939a57eae1bbb6dda19f34410273
Cisco Adaptive Security Appliance Software 9.7 Arbitrary File Deletion
Posted Jul 29, 2020
Authored by 0xmmnbassel

Cisco Adaptive Security Appliance Software version 9.7 unauthenticated arbitrary file deletion exploit.

tags | exploit, arbitrary
systems | cisco
advisories | CVE-2020-3187
SHA-256 | 9bff9df7bc31ade0ee6b87d153b448191f71eeb26ef4d1d4589e805582f16722
Cisco ASA / FTD Remote File Disclosure
Posted Jul 29, 2020
Authored by MrCl0wn Lab | Site github.com

This Python script checks whether the target server is vulnerable to CVE-2020-3452, a vulnerability in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) products that can allow for remote file disclosure.

tags | exploit, remote, python
systems | cisco
advisories | CVE-2020-3452
SHA-256 | f3d076dbbf728c5d5918c4039d0eaa629b5d9f90b1358b60f76542b5b020352c
Cisco AnyConnect Path Traversal / Privilege Escalation
Posted Jun 25, 2020
Authored by Yorick Koster, Christophe de la Fuente, Antoine Goichot | Site metasploit.com

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to version 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The attack consists in sending a specially crafted IPC request to the TCP port 62522 on the loopback device, which is exposed by the Cisco AnyConnect Secure Mobility Agent service. This service will then launch the vulnerable installer component (vpndownloader), which copies itself to an arbitrary location before being executed with system privileges. Since vpndownloader is also vulnerable to DLL hijacking, a specially crafted DLL (dbghelp.dll) is created at the same location vpndownloader will be copied to get code execution with system privileges. This exploit has been successfully tested against Cisco AnyConnect Secure Mobility Client versions 4.5.04029, 4.5.05030 and 4.7.04056 on Windows 10 version 1909 (x64) and Windows 7 SP1 (x86).

tags | exploit, arbitrary, x86, local, tcp, code execution
systems | cisco, windows
advisories | CVE-2020-3153
SHA-256 | b6d44c2b494378ff342fef57be9d4be4564327103eadabb01ff166ae6dae9bff
Page 1 of 77
Back12345Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    12 Files
  • 27
    May 27th
    12 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close