-

Comments

Post a Comment

Popular posts from this blog

Kaon DG2144 Exploit : Root Command Injection( & How To Enable SSH )

-
Image
Command Injection Vulnerability in Kaon DG2448 & DG2144 Modems Command Injection Vulnerability in: Kaon DG2448 & DG2144 Modems Published on 7/30/24 3:17 PM Introduction In this post, I’ll be sharing my findings on a critical command injection vulnerability I discovered in the Kaon DG2448 and Kaon DG2144 modems. The vulnerability is a severe flaw that allows attackers to execute arbitrary commands with root privileges through the modems' web interface. I will explain the details of how the exploit works, the potential impact, and how users and organizations can protect themselves. The Vulnerability Overview Upon analyzing the modems’ web service, I found that several diagnostic functions are vulnerable to command injection. These functions include: Ping (under Diagnostics Tab) Traceroute (under Diagnostics Tab) NsLookup (under Diagn...
Read more

f@st3864 Telnet/Serial

-
f@st3864 Telnet/Serial R.e F@st3864v2 Optus F@st3864 The quickest way to openly access this routers administration tools is to log in via http://192.168.0.1/main.html?loginuser=0 logging in with the default admin/Y3s0ptus loginuser=0 ***support/support ***loginuser=1 ***user/user*****loginuser=2 ***To Activate telnet*** going to management/system settings " download this file " sysinfo.f24 open the file in notepad the file splits into two sections the section we want is headed by backup config: <?xml version="1.0"?> <DslCpeConfig version="3.0"> and closed by </InternetGatewayDevice> </DslCpeConfig> so by copying all the xml information between these two points and pasting into a new notepad you have created our new backup file, before we save it and close find <X_GVT_Telnet_Enable>FALSE</X_GVT_Telnet_Enable> Change FALSE to TRUE then save the file as backupconfig.xml then use this XML file to update the settings, also i...
Read more

Vulnerability in Blackbox VS Code Extension

-
Technical Vulnerability Disclosure: Blackbox VS Code Extension Author: Frank Sx Date: 21/01/2025 Subject: Technical Disclosure of Vulnerability in Blackbox VS Code Extension Overview This post serves as a formal technical disclosure of a critical security vulnerability identified in the Blackbox VS Code extension (Blackboxapp.blackboxagent) up to the latest version. The vulnerability involves self-referral exploits that could enable unauthorized users to generate and redeem referral IDs, leading to potential abuse of the referral system. Vulnerability Details Description The vulnerability is rooted in the implementation of the referral ID generation and redemption processes within the Blackbox API, specifically located at: https://file+.vscode-resource.vscode-cdn.net/home/xxxxx/.vscode-oss/extensions/blackboxapp.blackboxagent-2.8.12/webview-ui/build/static/js/main.js Identified Issues: Self-Referral Exploit: The current implementation allows any user to generate a r...
Read more