So Lets Begin This vulnerability is known as CSRF (Cross-site request forgery) or some say it to be one-click attack so it is a type of attack that allow hackers to change/modify/update on currently connected website/url.
so how hacker use this CSRF attack To change Modem Password and Username lets do it step by step.
for doing this you just need to now what all parameter the cgi page is using.
now consider that you know the parameter that the reset successful page is taking after knowing those things you just need to create a html page that basically call that cgi/successful confirmation on the form action parameter and after doing it the password will successfully changed so i think you must have got some confused lets do it practically.
i am taking an example that is already submitted by one of my friend Prayas a Real quality security expert.
There is a CSRF vulnerability in the Buffalo WZR-HP-G300NH2(A high Speed wireless Modem) and any one easily change or manipulate the admin username and password. This is will POST request and any one can craft malicious html form with specially crafted POST request
to the router and on execution of the form the router's user name and password can be changed to anything.
Here is the exploit
Save this as anything.htm and this will change the router's user name and password.
username:root
password:hacked
Download The Whole Exploit Here
Now we just did this for Buffalo Modem but as my point of view this particular vulnerability also hit common modem devices like BSNL Modem on rest.cgi,Few D-link wireless modem.You can try your Experiment and put your comments below if you are facing any doubt.
Thank You for reading Do share comment likes :)
will you provide a video tutorial on
ReplyDeleteWIRELESS MODEM | RESET USERNAME AND PASSWORD
Is there any chance for admin or anyone to know that who has done this
ReplyDelete