WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password - by Craig Heffner #3023

m-1-k-3 · 2014-02-21T21:04:38Z

This is the great new exploit for the WRT120N. The vulnerability was discovered by Craig Heffner. Also the original exploit is his work thumbs up

Original exploit: http://www.exploit-db.com/exploits/31758/

Best,
Mike

jvazquez-r7 · 2014-02-24T17:41:51Z

modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb

+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'            => 'Linksys WRT120N Buffer Overflow in tmUnblock - Password Reset',


Just Linksys WRT120N tmUnblock Buffer Overflow looks like a better title

jvazquez-r7 · 2014-02-24T18:22:53Z

I'm trying on a Linksys WRT120N, Firmware Version: v1.0.07 WRT120N with both Local Management and Remote Management available through HTTP, no success :S (neither with the original PoC).

jvazquez-r7 · 2014-02-24T18:39:46Z

Not working for me :\

A request like that:

POST /cgi-bin/tmUnblock.cgi HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Authorization: Basic blahblah
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6
Content-Type: application/x-www-form-urlencoded
Content-Length: 64

period=0&TM_Block_MAC=00:01:02:03:04:05&TM_Block_URL=http://test

Answer with:

HTTP/1.0 302 Found
Server: Apache
Pragma: no-cache
Cache-Control: max-age=0, must-revalidate
Connection: close
Location: http://test
Content-type: text/html

<HEAD><TITLE>302 Document moved</TITLE></HEAD>
<BODY><H1>302 Document moved</H1>
This document has moved <A HREF="http://test</A>.<P>
</BODY>

In requests with long TM_Block_URL values I just get not answer (same thing with the craig's poc and the module).

Since I don't have the ability to debug atm, let me give a chance to @jvennix-r7 to test it, since he was interested and maybe I'm forgetting something ~~obviously~~ obvious :)

m-1-k-3 · 2014-02-24T18:41:09Z

My WRT120N v1.0.0.7 works good. Should I send you the pcap?

jvennix-r7 · 2014-02-24T18:41:42Z

@juan that's strange, I was testing that POST route yesterday and got "connection closed", not a 404. I will dive in soon

jvazquez-r7 · 2014-02-24T18:46:03Z

@jvennix-r7 not a 404 here neither, no rush, when you have the time :)

@m-1-k-3 pcap would be helpful if you could share :) thanks!

jvennix-r7 · 2014-02-25T05:53:52Z

Okay, I got this working. I had to reset the router firmware to the available 1.0.07. @jvazquez-r7: it's possible that some modification/setting I changed was messing things up. Against the newly updated firmware it seems to work well, even when run multiple times in a row.

@m-i-k-3 could you change the result:

print_status("Unknown exploiting status - try to login with user admin and without a password")

To just test logging in with admin:'', and print a success message then

m-1-k-3 · 2014-02-25T06:58:10Z

@jvennix-r7 very cool! I will include all updates to the module tomorrow.

jvazquez-r7 · 2014-02-25T14:10:42Z

+1 thanks both @jvennix-r7 and @m-1-k-3 , you are great guys :D

wchen-r7 · 2014-02-25T20:48:08Z

modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb

+  def run
+    uri = '/cgi-bin/tmUnblock.cgi'
+
+    print_status("#{rhost}:#{rport} - Resetting password for the admin user ...")


Can do #{peer} here. Either Mike can do it, or whoever's merging this PR can just change it.

m-1-k-3 · 2014-02-26T12:46:11Z

msf auxiliary(linksys_tmunblock_admin_reset_bof) > run

[] 192.168.1.1:80 - Trying to login with admin and empty password
[] 192.168.1.1:80 - No successful login possible with admin and empty password
[] 192.168.1.1:80 - Resetting password for the admin user ...
[] 192.168.1.1:80 - Trying to login with admin and empty password
[+] 192.168.1.1:80 - Successful login admin and empty password
[+] 192.168.1.1:80 - Expected answer and the login was successful. Try to login with the user admin and a blank password
[*] Auxiliary module execution completed

jvazquez-r7 · 2014-02-26T15:03:13Z

Awesome, processing! thanks @m-1-k-3!

Michael Messner added 3 commits February 21, 2014 21:53

linksys wrt120 admin reset exploit

c77fc03

make msftidy happy

1384150

small fixes

ec8e1e3

jvazquez-r7 self-assigned this Feb 24, 2014

jvazquez-r7 reviewed Feb 24, 2014
View reviewed changes

wchen-r7 reviewed Feb 25, 2014
View reviewed changes

feedback included, cleanup, login check

b79197b

jvazquez-r7 added a commit that referenced this pull request Feb 26, 2014

Land #3023, @m-1-k-3's module for Linksys WRT120N bof reset password

bfdefdb

jvazquez-r7 merged commit b79197b into rapid7:master Feb 26, 2014

m-1-k-3 deleted the linksys_admin branch February 26, 2014 18:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password - by Craig Heffner #3023

WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password - by Craig Heffner #3023

m-1-k-3 commented Feb 21, 2014

jvazquez-r7 Feb 24, 2014

jvazquez-r7 commented Feb 24, 2014

jvazquez-r7 commented Feb 24, 2014

m-1-k-3 commented Feb 24, 2014

jvennix-r7 commented Feb 24, 2014

jvazquez-r7 commented Feb 24, 2014

jvennix-r7 commented Feb 25, 2014

m-1-k-3 commented Feb 25, 2014

jvazquez-r7 commented Feb 25, 2014

wchen-r7 Feb 25, 2014

m-1-k-3 commented Feb 26, 2014

jvazquez-r7 commented Feb 26, 2014

WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password - by Craig Heffner #3023

WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password - by Craig Heffner #3023

Conversation

m-1-k-3 commented Feb 21, 2014

jvazquez-r7 Feb 24, 2014

Choose a reason for hiding this comment

jvazquez-r7 commented Feb 24, 2014

jvazquez-r7 commented Feb 24, 2014

m-1-k-3 commented Feb 24, 2014

jvennix-r7 commented Feb 24, 2014

jvazquez-r7 commented Feb 24, 2014

jvennix-r7 commented Feb 25, 2014

m-1-k-3 commented Feb 25, 2014

jvazquez-r7 commented Feb 25, 2014

wchen-r7 Feb 25, 2014

Choose a reason for hiding this comment

m-1-k-3 commented Feb 26, 2014

jvazquez-r7 commented Feb 26, 2014