CVE-2022-31749

This exploit leverages a parameter injection vulnerability in WatchGuard's SSH interface to exfiltrate the `configd-hash.xml` file, which contains unsalted MD4 password hashes, to an attacker-controlled FTP server. It uses the built-in low-privileged `status` user for authentication.

This PoC exploits a parameter injection vulnerability in WatchGuard's SSH interface (CVE-2022-31749) to exfiltrate the `configd-hash.xml` file, which contains unsalted MD4 password hashes. It uses the low-privileged `status` user with a default password of `readonly` to perform the attack via SCP.