bugtraq - Asus AAM6000EV ADSL Router Wide Open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2003714194538.677980@beddo>
Date: Mon, 14 Jul 2003 19:45:38 +0100
From: cw <security@...ei.co.uk>
To: <bugtraq@...urityfocus.com>
Subject: Asus AAM6000EV ADSL Router Wide Open

Asus have been notified but haven't even acknowledged yet alone mentioned a fix.

If the inbuilt webserver is activated, anyone on the local network can get the full user/pass list from the router without any identification whatsoever by going to the ip address of the router and appending /userdata
Example, say the ip address is 192.168.0.1, go to:

http://192.168.0.1/userdata

This will output the contents of the userdata file which contains completely unencrypted usernames and passwords. There are plenty of other files that can be access with this trick, I haven't looked at the content of them so I don't know what else you can do.

This security flaw arises because the webserver on the router is mapped to index.html which provides a link to /secure/Home.htm

You are not prompted for a password until you attempt to access files under /secure

Telnet to the router, enter the user mode console and then type "flashfs"

Type ls to see all configuration files accessible through this flaw.