533f33f3f4
17 changes to exploits/shellcodes IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path AirControl 1.4.2 - PreAuth Remote Code Execution Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated) Clinic Management System 1.0 - Unauthenticated Remote Code Execution Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated) Oriol Espinal CMS 1.0 - 'id' SQL Injection Clinic Management System 1.0 - Authenticated Arbitrary File Upload Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin) VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution Navigate CMS 2.8.7 - Authenticated Directory Traversal D-Link DIR-615 T1 20.10 - CAPTCHA Bypass Online Marriage Registration System 1.0 - Remote Code Execution Cayin Content Management Server 11.0 - Remote Command Injection (root) SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User) Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Cayin Signage Media Player 3.0 - Remote Command Injection (root) Cayin Digital Signage System xPost 2.5 - Remote Command Injection
28 lines
No EOL
1.5 KiB
Text
28 lines
No EOL
1.5 KiB
Text
# Exploit Title: D-Link DIR-615 T1 20.10 - CAPTCHA Bypass
|
|
# Date: 2019-10-12
|
|
# Exploit Author: huzaifa hussain
|
|
# Vendor Homepage: https://in.dlink.com/
|
|
# Version: DIR-615 T1 ver:20.10
|
|
# Tested on: D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1
|
|
# CVE: CVE-2019-17525
|
|
|
|
D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1
|
|
|
|
A vulnerability found on login-in page of D-LINK ROUTER "DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1" which allows attackers to easily bypass CAPTCHA on login page by BRUTEFORCING.
|
|
|
|
------------------------------------
|
|
D-Link released new firmware designed to protect against logging in to the router using BRUTEFORCING. There is a flaw in the captcha authentication system that allows an attacker to reuse the same captcha without reloading new.
|
|
|
|
ATTACK SCENARIO AND REPRODUCTION STEPS
|
|
|
|
1: Find the ROUTER LoginPage.
|
|
2: Fill the required login credentials.
|
|
3: Fill the CAPTCH properly and Intercept the request in Burpsuit.
|
|
4: Send the Request to Intruder and select the target variables i.e. username & password which will we bruteforce under Positions Tab
|
|
5: Set the payloads on target variables i.e. username & password under Payloads Tab.
|
|
5: Set errors in (the validatecode is invalid & username or password error, try again) GREP-MATCH under Options Tab.
|
|
6: Now hit the start attack and you will find the correct credentials.
|
|
|
|
-------------------------------------
|
|
|
|
Huzaifa Hussain |