Exploit-DB #5926
Description: Linksys WRT54G Firmware 1.00.9 - Security Bypass (2)
Type: remote
Platform: hardware
Date: 2008-06-24
Author: meathive

Exploit:
	 __  _  ____  ____    ___   ____  ____  ____   _____      ____  ____   _____   ___
	|  l/ ]l    j|    \  /   \ |    \l    j|    \ |     T    l    j|    \ |     | /   \
	|  ' /  |  T |  _  YY     Y|  o  )|  T |  _  Yl__/  |     |  T |  _  Y|   __jY     Y
	|    \  |  | |  |  ||  Q  ||   _/ |  | |  |  ||   __j     |  | |  |  ||  l_  |  O  |
	|     Y |  | |  |  ||     ||  |   |  | |  |  ||  /  | __  |  | |  |  ||   _] |     |
	|  .  | j  l |  |  |l     ||  |   j  l |  |  ||     ||  T j  l |  |  ||  T   l     !
	l__j\_j|____jl__j__j \__,_jl__j  |____jl__j__jl_____jl__j|____jl__j__jl__j    \___/

				<>< | ><> Hacking the Linksys WRT54G #2
				<>< | ><> https://kinqpinz.info/
				<>< | ><> by meathive
				<>< | ><> root at kinqpinz.info && kinqpinz.info at gmail.com

				
++| CVE-2008-1247
----------------------
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials 
when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via
a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, 
(6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, 
(12) PortRange.tri,(13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, 
(17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri.
NOTE: the Security.tri vector is already covered by CVE-2006-5202.

++| Intro
----------------------
This text is in addition to the findings I have already made public regarding the Linksys WRT54G 
wireless router and firewall gateway device. The scripts that process configuration changes do not 
require authentication and therefore can be altered _remotely_ via simple form submissions written 
in HTML and submitted using JavaScript. Please refer to the bottom of this text for my previous 
findings and the demo page with sample exploits.

++| Let's Get Dirty
----------------------
You may find my original demonstration page at https://kinqpinz.info/lib/wrt54g/. It basically shows
how forms can be constructed in HTML that take advantage of the major flaws present within the 
insecure router. In my previous documentation I showed how it is possible to alter configuration 
parameters both via Linux command line using curl and HTML form submissions. In this text I 
demonstrate how to do these very same things transparently using a combination of HTML form 
construction with JavaScript that automagically submits our desired changes.

The JavaScript is simple and is only used for submitting the form - a user-free mechanism that will 
redirect the user to their router and prompts them to log in. Once again, THE REQUEST TO 
AUTHENTICATE TO THE DEVICE IS NOT REQUIRED IN ORDER TO CHANGE ITS SETTINGS. The following is all 
that is required in order to submit our form that will be constructed using GET parameters observed 
from the device's Web interface.

document.f.submit();

This submits forms hidden within the Webpage. Our first example code enables wireless access with an
SSID of our choosing. In this instance, I will use the SSID "kinqpinz".

<form name="f" action="http://192.168.1.1/WBasic.tri" method="POST">
  <input type="hidden" name="submit_type" value="">
  <input type="hidden" name="channelno" value="11">
  <input type="hidden" name="OldWirelessMode" value="3">
  <input type="hidden" name="Mode" value="3">
  <input type="hidden" name="SSID" value="kinqpinz">
  <input type="hidden" name="channel" value="6">
  <input type="hidden" name="Freq" value="6">
  <input type="hidden" name="wl_closed" value="1">
  <input type="hidden" name="sesMode" value="1">
  <input type="hidden" name="layout" value="en">
</form>

The reason this works is simple: configuration parameters are constructed in the URL in the Web 
interface, hosted by default at the address http://192.168.1.1. One can view these parameters while 
configuring their device. The code above simply constructs a URL that is processed by the router's 
IOS script WBasic.tri. The URL resembles the following if you were to view it within your browser:

http://192.168.1.1/WBasic.tri?submit_type=&channelno=11&OldWirelessMode=3&Mode=3&SSID=kinqpinz&channel=6&Freq=6&wl_closed=1&sesMode=1&layout=en

It's simple enough to understand what's going on. Each variable passed in the URL describes exactly 
what its purpose is - at least the important ones such as "SSID" and "channel". The only tricky part 
to exploiting the router is the fact that you cannot alter settings using a URL like the one above. 
That would result in a GET request on behalf of the device, whereas we're interested in POST 
requests that actually trigger configuration changes. A GET request does nothing. Below I describe 
a real world attack scenario that makes use of knowledge about the device, embedded HTML + JavaScript, 
and a touch of PHP to grab the mark's external IP. 

++| Remote Real World Attack Scenario
----------------------
So http://www.hacker.tld hosts an evil page that wants to compromise your Linksys WRT54G router. It 
has made a few assumptions about your environment, however. One major assumption is that you've 
kept your router's default local gateway address, namely 192.168.1.1. No matter what other changes 
you've made to the router in terms of security, e.g., strong password, wireless encryption, access 
restrictions - they are useless. So this brings us to an important lesson concerning the WRT54G: do 
NOT retain the default local address of 192.168.1.1. It is pertinent that you change this address so 
that you do not fall victim to a malicious individual hosting code that will be presented in this 
text.

++| Remote Real World Attack Scenario Requirements
----------------------
On http://www.hacker.tld a page is hosted that contains the following:
  (1) hidden HTML forms that contain the values/params needed to configure t