what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

linksys-WET11_pass-reset.txt

linksys-WET11_pass-reset.txt
Posted Apr 17, 2005
Authored by Kristian Hermansen | Site ht-technology.com

The Cisco Linksys WET11 is vulnerable to having the password reset simply by going to a known URL on the administrative interface recently after the systems administrator has logged in. It is not necessary to know the current password.

tags | exploit
systems | cisco
SHA-256 | 41a5685548d9372b766fdd212e2e121b1473c1fcba0c32e03733c9355f3cea6d

linksys-WET11_pass-reset.txt

Change Mirror Download
================== 
=====Analysis=====
==================
Cisco's Linksys WET11 ethernet bridge product is vulnerable to password
resetting based on GET fields in a URL directed at the device. The
change password utility provided on the device uses GET to send an
obfuscated password as the argument to the changepw.html page. The
field that holds the password is named data. Here's what the URL looks
like when the user tries to change the password to "admin":

http://x.x.x.x/changepw.html?data=XVQsZV3.................

The encoding of passwords is quite predictable, and I now show some
examples of the passwords "a" through "h":

http://x.x.x.x/changepw.html?data=XP......................
http://x.x.x.x/changepw.html?data=Xf......................
http://x.x.x.x/changepw.html?data=Xv......................
http://x.x.x.x/changepw.html?data=Y.......................
http://x.x.x.x/changepw.html?data=YP......................
http://x.x.x.x/changepw.html?data=Yf......................
http://x.x.x.x/changepw.html?data=Yv......................
http://x.x.x.x/changepw.html?data=Z.......................

This doesn't really matter, since if you are already on the network and
can sniff packets, you can just base64 decode the basic auth strings
flying by. However, I suggest you change the password blindly on this
device using the following:

http://x.x.x.x/changepw.html?data=........................

This will create a blank password and allow you to login without knowing
the old one. There is no verification when you change the password. In
the newest version 1.5.4 of the firmware for the WET11 v1 device,
however, someone must have logged in recently (timeout is _LONG_ though)
to allow for this attack (ie. it will request the old password). In
this scenario, just have them log in to check their settings, and a few
minutes later, blank the password.

==================
===Implications===
==================
This attack allows anyone to reconfigure the IP address of the device
and change any settings that the device allows. In the latest v1
revision 1.5.4 of the firmware the old password must have been supplied
recently to execute the attack.

==================
=====Affected=====
==================
Tested on Linksys WET11 v1 (1.5.4)
Note: older versions may be affected++
Note: WET11 v2 not tested, but may be vulnerable as well

==================
=====Solution=====
==================
Upgrade to the latest firmware to deter blind password resetting. Be
aware that there is still no old password authentication when changing
the password even in 1.5.4.
http://www.linksys.com/download/firmware.asp
--
Kristian Hermansen <khermansen@ht-technology.com>

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close