DSL-504T.txt

`Device: CUSTOMER=DLinkEU MODEL=DSL-504T  
Version: only tested with VERSION=V1.00B01T16.EU.20040217  
Bugs: i) remote firmware upgrade without password  
ii) config retrieval without password  
Exploitation: remote  
Date: 26/05/2005  
Status: vendor not contacted  
Workaround: disable remote web management  
Author: Alessandro Audero  
  
The Bug  
  
DSL-504T is a D-Link router/ADSL modem with a linux system on it based  
on MIPS 4KEc V4.8. This is the uname that i found from the device i  
tested:  
  
Linux version 2.4.17_mvl21-malta-mips_fp_le  
([email protected]) (gcc version 2.95.3 20010315  
(release/MontaVista)) #71 Tue Feb 17 01:16:45 GMT 2004  
  
It supports a remote web management console, that at first sigth asks for  
a username and a password. The URL should be something like this:  
  
http:://ipaddress/  
  
and if you click on 'login' you'll get this other URL:  
  
http://ipaddress/cgi-bin/webcm  
  
that obviously tells you that you have typed in a wrong password.  
But if you look at the root cgi-bin dir, that is  
  
http//ipaddress/cgi-bin/  
  
you'll get a list of two files: one is webcm, the other is firmwarecfg  
If you click on the latter one, you will be placed in a page where you are  
allowed to upgrade the router firmware, restart the router, download  
current configuration or restore a previously saved conf.  
  
There's another point in downloading router configuration. Infact  
management username and password are saved in clear text inside the xml  
file:  
  
<security>  
<settings>  
<username>XXXXXXXXX</username>  
<password>XXXXXXXXX</password>  
...  
</setting>  
</security>  
  
With this auth info you can log inside the system using telnet and have  
a complete shell on that router.  
  
Another issue can be found looking at another username/password section  
regarding ADSL connection settings:  
  
<username>XXXXXXXXXX</username>  
<password>XXXXXXXXXX</password>  
  
This can lead to email/webaccount security problems if the user uses  
these infos also for his accounts (email for example), that can be really  
possible in case the internet provider provides also email or web space.  
  
That's all, folks.  
  
Alessandro Audero  
  
Misc:  
It is possible that this kind of bug could also be present in other  
routers, implementing busybox, and that are configurable via http or  
thttp.  
  
  
  
`