DefPack Exploitation Pack for CANVAS

DefPack Exploitation Pack for CANVAS, is commercial CANVAS Exploitation Pack (CEP). Due to the product continuous update in nature, so we prepare this post for those who interest to know what is include inside. Latest update will be show on the top, while older update will be auto show below. This post will keep update and the post date will follow the latest date, so it will show one post date, rather than multiple post for hassle free reading in one post. This post is about CANVAS Exploitation Pack (CEP) DefPack, it need to be use with CANVAS Exploitation Testing Framework. Feel free to contact E-SPIN for product inquiry and support.

DefPack Exploitation Pack for CANVAS Product Overview

This is an attempt to provide pentesters with a most comprehensive collection (almost 100 exploits) of Defense software vulnerabilities illustrated in a one DefPack Exploits Package.
Antiviruses, IDS and IPS systems, Firewalls, Account Management systems, End-point protection software and more are targeted.
Defense Software is very special due to its wide usage and critical nature, so we think this pack is a “MUST HAVE” for security experts.
The pack contains mostly exploits for public vulnerabilities along with some 0days discovered GLEG.

The “DefPack” features:

• • Critical value

Ability to test your defense software and to measure real threat

• • Nicest public Defense software vulnerabilities coverage!

Including old and newly discovered bugs

• • 0 Days exploits

We conduct our own in depth research and provide you with tools and sploits, which could be helpfull for Defense software pentesting.

• • Weak points analyses

Some systems suffer from weaknesses like hardcoded passwords and etc. We provide tools to test such cases.

2022-Sep-24 DefPack 1.80
public vulns: – Korenix Technology JetNet Devices Denial of Service
– Telesquare TLR-2855KS6 Arbitrary File Deletion
– Westermo PoE Gigabit Switch PMI-110-F2G Directory Traversal

2022-Aug-18 DefPack 1.79 :
– Kyan Network Monitoring Device Credential Disclosure CNVD-2021-49589
– Q-See Surveillance DVR info Disclosure CVE-2018-9995
– CVE-2022-26259 . pub
-ZyXEL Buffer Overflows in zhttpd and http://libclinkc.so Denial of Service

2022-Jun-30 DefPack 1.78
– Cisco Adaptive Security Appliance Software Path Traversal Vulnerability CVE-2020-3452
– D-Link Router CVE-2019-16920 Remote Code Execution. pub
– ICT Protege GX/WX 2.08 Password Hash Disclosure – Seowon SLR-120 Router RCE (Unauthenticated) CVE-2020-17456

2022-May-19 DefPack 1.77:
– D-LINK Routers Command Injection. public
– FLIR Systems FLIR Brickstream 3D+ Unauthenticated Config Download File Disclosure [1day] – Netgear RAX35, RAX38, RAX40 routers dirtrav CVE-2021-41449
– TPLink AX10 V1 Remote Denial of Service CVE-2021-41450 and more.

2022-Apr-9 DefPack 1.76:
– Novus Managment System DirTrav Vuln [1day] – Samsung SmartViewer 3.0 activex [1day] – ARD-9808 DVR Card Security Camera Password Disclosure. public
– Fujitsu-Siemens ServerView RCE. oldpublic
– Vivotek IP Cameras Information Disclosure. public

2022-Feb-10 1.75 DefPack:
– Blue Iris Video_Management Software ActiveX Control Remote Code Execution Vulnerability [1day] – D-Link DCS-2103 Network Ip Camera Directory Traversal Vulnerability. public
– Orange Livebox devices Wi-Fi infoleak +Tellion and Tiandy devices vulns

2022-Jan-19 Agora 1.74 :
– Bosch Security Systems VideoSDK RCE [1day] – Ricon Industrial Cellular Router S9922XL RCE. pub
– SonicWall SMA 10.2.1.0-17sv Password Reset CVE-2021-20034
– Edimax EW-7438RPn Infoleak. pub
– ESCAM QD-900 WIFI HD Camera Remote Configuration Disclosure. pub more

2021-Dec-10 DefPack 1.73:
– GV-Mobile Server V1510 Remote File Create Vulnerability [1 day] – GeoVision GV-Recording Server Remote File Overwrite weakness [1 day] – Xceed Software Encryption ActiveX weakness [1 day] – ARD-9808 DVR Card Security Camera Remote Denial of Service. pub
and more…

2021-Nov-13 DefPack 1.72:
– D-Link DSL-2875AL Remote Password Disclosure. pub
– IPCop 2.1.9 RCE. pub
– LANCOM R&S Unified Firewalls UF-XXX Path Traversal Vulnerability. pub
– SV3C L-Series HD Camera Remote Configuration Disclosure CVE-2018-12671
– TBK DVR4104 and DVR4216 Credentials Leak

2021-Oct-9 DefPack 1.71:
– F5 BIG-IP TMUI Directory Traversal Vulnerability CVE-2020-5902
– Positive Technologies Maxpatrol 8 and Xspider Remote DoS. pub
– Seagate BlackArmor NAS sg2000-2000.1331 Remote Code Execution. pub
– TG8 Firewall Remote Code Execution. pub
and more…

2021-Sep-21 DefPack 1.70:
– COMMAX Smart Home Ruvie CCTV Bridge DVR DoS. CVE-2021-08-16
– Foscam Cameras Dos. pub
– Genie Access WIP3BVAF IP Camera Directory Traversal Vulnerability. pub
– Karel IP Phone IP1211 Web Management Panel DirTrav.

2021-Aug-04 DefPack 1.69:
– SolarLog 500 2.8.2 Unprotected Storage of Credentials Vulnerability. pub
– Ambarella Oryx RTSP Server DoS CVE-2020-24918
– IPFire 2.25 Remote Code Execution CVE-2021-33393
– JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Config Download. pub and more.

2021-Jul-13 DefPack 1.68:
– ZBL EPON ONU Broadband Router Configuration Download. pub
– DD-WRT 45723 UPNP Buffer Overflow. pub
– Beward B4230 IP Camera Info Disclosure. 1 Day
– Beward B4230 IP Camera Privilege Escalation. 1 Day

2021-Jun-10 DefPack 1.67:
– Kamailio SIP Denial Of Service. pub
– QNAP Pre-Auth Root RCE. nice bundle exploit . pub
– VoIPmonitor 27.6 Denial Of Service. pub
– NuCom 11N Wireless Router 5.07.90 Remote Credentials Disclosure. pub

2021- May-11 Def 1.66:
– Dell KACE Systems Management Appliance (K1000) Unauthenticated RCE. pub
– D-LINK DIR-610 Authenticated RCE. CVE-2020-9377
– D-LINK DIR-610 Info Disclosure. CVE-2020-9376
– AndroVideo Advan VD-1 Password Disclosure. PUB

2021-Apr-05 DefPack 1.65:
– ZeroShell Linux Router 3.9.3 OS Command Injection. CVE-2020-29390
– Remote Code Exection. CVE-2020-35578
– Intelbras Router RF 301K 1.1.2 – Authentication Bypass. pub
– HIRSCHMANN GECKO Lite Managed switch Configuration Disclosure. pub
and more

2021-Mar-12 DefPack 1.64:
– IDAutomation unsafe activex file overwrite vulnerability. pub
– Huawei HedEx Lite directory traversal. pub
– Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal. pub
– Geutebruck IP Camera remote_reboot – pub

2021-Jan-30 DefPack 1.63:
– Nagios XI 5.7.3 – Command Injection. CVE-2020-5791
– Cisco Unified Conference Station 7937G Denial of Service. public
– Insteon HD WiFi Camera Denial of Service. CVE-2018-12640
– IpNetCam A107WIRF-HNH-03 IP-Camera auth bypass configuration download. public

2021-Jan-15 DefPack 1.62:
– Grandstream Audio Conferencing Unit Remote Reboot Vulnerability. pub
– Grandstream UCM6204 IP PBX Remote Reboot Vulnerability. pub
– Q-SYS <= 8.2.1 TFTP Directory Traversal. CVE-2020-24990
– Sony IPELA Network Camera Remote Stack Buffer Overflow PoC. public

2020-Dec-04 DefPack 1.61:
– Nagios XI 5.7.3 – Command Injection. CVE-2020-5791
– Cisco Unified Conference Station 7937G Denial of Service. public
– Insteon HD WiFI Camera Denial of Service. CVE-2018-12640
– IpNetCam A107WIRF-HNH-03 IP-Camera auth bypass configuration download. public

2020-Nov-14 DefPack news:
– Kguard SHA104 and SHA108 DVR credential disclosure vulnerability. public
– KONGTOP DVR devices A303, A403, D303, D305, and D403 backdoor check. public
– Lutron Quantum 2.0 data leak. public
– MASTER IPCAMERA01 Remote Configuration Disclosure. public

2020-Oct-05 DefPack 1.59:
– MESSOA NIC990 IP-Camera auth bypass configuration download. public
– MOVISTAR ADSL ROUTER BHS_RTA Password Disclosure. public
– Netwave IP Camera Remote Configuration Disclosure. CVE-2018-11654
– Nucom ADSL ADSLR5000UN ISP Credentials Disclosure. public

2020-Sep-04 DefPack 1.58:
– Kamailio SIP Server Denial of service. CVE-2018-8828
– PLANET ADSL ROUTER AND-4101 Password Disclosure
– SIEMENS IP-Camera CCID1410 and CCPW5025 Credentials Disclosure Vulnerability. CVE-2018-9995
– CC8800-CMTS monitoring system credential disclosure

2020-Jul-30 DefPack 1.57:
– CVE-2020-3161 Cisco IP Phones remote DoS, possible exec PoC. pub
– Netgear DGN2000v1 Setup.cgi Unauthenticated Remote Code Execution. pub
– Netgear DGN2200 DGND3700 Admin Password Disclosure. pub

2020-Jul-01DefPack 1.56:
– WatchGuard Fireware AD Helper Component Credential Disclosure. pub
– TP-LINK router TL-WR940N – Buffer Overflow. CVE-2019-6989
– Master IP CAM 01 3.3.4.2103 Remote Command Execution. CVE-2019-8387

2020-Jun-02 DefPack 1.55:
– HiSilicon hi3520d and similar system Directory Traversal.public
– Netlink GPON Router 1.0.11 Remote Code Execution. public
– Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure. public
– Zivif Web Cameras RCE

2020-Apr-30 DefPack 1.54:
– SecuSTATION SC-831 HD Camera – Remote Configuration Disclosure
– D-Link DIR-859 Unauthenticated Information Disclosure – CVE-2019-20213
– DBPower C300 HD Camera Remote Configuration Disclosure
– Belkin N600DB Wireless Router wifi password disclosure

2020-Mar-30 DefPack 1.52:
– Microtik SSH Daemon 6.44.3 Denial of Service. public
– F-Secure Internet Gatekeeper 5.40 Heap Overflow. public
– Enigma NMS 65.0.0 Remote OS Command Injection. CVE-2019-16072
– ClamAV 0.102.0 Code Execution Vulnerability. public

2020-Feb-29 Def 1.52 news:
– TP-Link TP-SG105E 1.0.0 – Unauthenticated Remote Reboot. public
– Huawei HG255 Directory Traversal. public
– Citrix Gateway Directory Traversal Vulnerability. public
– Aptina AR0130 960P 1.3MP Camera – Remote Configuration Disclosure. CVE-2019-20213

2020-Jan-28 1.51 Defpack updates:
– Bullwark Momentum Series JAWS 1.0 Directory Traversal. public
– NVMS 1000 network video monitoring Directory Traversal. public

2019-Dec-31 DefPack 1.50 network devices vulns:
– Moxa EDR-810 Information Disclosure. CVE-2019-10963
– Yealink VoIP Phone SIP-T38G Local File Inclusion. public
– V-SOL GPON/EPON OLT Platform 2.03 Configuration Download. public

2019-Dec-5 1.49 DefPack:
– ZTE ZXHN H108N info disclose. public
– XiongMai ip cameras Path Traversal. public
– Vivotek IP Cameras Credentials Leakage via Path Traversal

2019-Nov-1 1.48 Defpack:
– Jovision IP camera Credential Disclosure. public
– Hisilicon HiIpcam V100R003 Remote ADSL Credentials Disclosure. public
– Fibrehome HG110 Compromise of all configuration details Vulnerability. public
– Belkin Router N150 Path Traversal Vulnerability. public

2019-Sep-29 1.47 Defpack:
– Cisco RV300 RV320 Information Disclosure. CVE-2019-1653
– Cisco Video Surveillance Operations Manager DirTraversal. public
– Path Traversal in Gateway in Mirasys DVMS Workstation. CVE-2018-8727
– 3Com Intelligent Management Center vuln

2019-Sep-1 1.46 ver. of DefPack contains 3 modules:

– FortiOS 5.6.3 – 5.6.7 / FortiOS 6.0.0 – 6.0.4 – Credentials Disclosure. [CVE-2018-13379] – SecuCON NVR Directory Traversal. [public] – Trend Micro Deep Discovery Inspector Commandline Injection. [public]

2019-Jul-29 1.45 DefPack:
ag_InstarVision_DoS_PoC – InstarVision Surveillance Center Denial of Service. [1Day] ag_InstarVision_v2x_DoS – InstarVision Deutschland GmbH Surveillance Center Denial of Service. [1Day] ag_yawcam_fd – Yawcam 0.6.0 – Directory Traversal Vulnerability. CVE listed

2019-Jul-24 1.44 ver. of DefPack contains 3 modules. List:

2019-Jun-3 1.43 ver. of DefPack contains 2 modules. List: