no one is safe ...

secure IT

Multiple Vulnerabilities in Linksys E1500/E2500

Device Name: Linksys E1500 / E2500
Vendor: Linksys

============ Device Description: ============

The Linksys E1500 is a Wireless-N Router with SpeedBoost. It lets you access the Internet via a wireless connection or through one of its four switched ports. You can also use the Linksys E1500 to share resources, such as computers, printers and files.

The installation and use of the Linksys E1500 is easy with Cisco Connect, the software that is installed when you run the Setup CD. Likewise, advanced configuration of the Linksys E1500 is available through its web-based setup page.

Source: http://homekb.cisco.com/Cisco2/ukp.aspx?pid=80&app=vw&vw=1&login=1&json=...

============ Vulnerable Firmware Releases - e1500: ============

Firmware-Version: v1.0.00 - build 9 Feb. 17, 2011
Firmware-Version: v1.0.04 - build 2 Mär. 8, 2012
Firmware-Version: v1.0.05 - build 1 Aug. 23, 2012

The Home Network Horror days starting right now …

Welcome to the following 2 crazy weeks with lots of vulnerabilities in more than 20 different home network devices. We have quite a high number of hopefully interesting vulnerabilities in devices from different vendors like Linksys, D'Link or Netgear for you.

Today we start with a short intro video which demonstrates unauthenticated execution of OS commands on two home routers of D-Link. The D-Link DIR-300 rev B and D-Link DIR-600 are still unpatched and an attacker is able to directly compromise these devices via the web interface. You will find the advisory here.

Multiple Vulnerabilities in D'Link DIR-600 and DIR-300 (rev B)

Device Name: DIR-600 / DIR 300 - HW rev B1
Vendor: D-Link

============ Vulnerable Firmware Releases - DIR-300: ============

Firmware Version : 2.12 - 18.01.2012
Firmware Version : 2.13 - 07.11.2012

============ Vulnerable Firmware Releases - DIR-600: ============

Firmware-Version : 2.12b02 - 17/01/2012
Firmware-Version : 2.13b01 - 07/11/2012
Firmware-Version : 2.14b01 - 22/01/2013

============ Device Description: ============

Multiple Vulnerabilities in Netgear SPH200D [Update: 03.02.2013]

Device Name: SPH200D
Vendor: Netgear

============ Vulnerable Firmware Releases: ============

Firmware Version : 1.0.4.80
Kernel Version : 4.1-18
Web Server Version : 1.5

============ Device Description: ============

http://support.netgear.com/product/SPH200D

============ Shodan Torks ============

Shodan Search: SPH200D
=> Results 337 devices

============ Vulnerability Overview: ============

  • directory traversal:

Using the discovered OS Command Injection vulnerability in Linksys WRT54GL within a pentest

After releasing the OS command execution vulnerability in the WRT54GL router from Linksys last week there were some requests about how could we use this vulnerability for getting a remote shell.

First off all we have to analyze the firmware a bit. For this it is best to download the original firmware from the vendor and use the firmware-modification-kit or binwalk created by Craig Heffner and Jeremy Collake. Awesome toolkit from awesome guys.

So let’s extract and analyse the firmware a bit:

root@bt:~/images/firmware_mod_kit/firmware-mod-kit-read-only# ./extract-ng.sh /root/images/FW_WRT54GL_4.30.15.002_US_20101208_code.bin linksyswrt54gl
Firmware Mod Kit (build-ng) 0.78 beta, (c)2011-2012 Craig Heffner, Jeremy Collake
http://www.bitsum.com
Scanning firmware...
DECIMAL   HEX       DESCRIPTION
-------------------------------------------------------------------------
32        0x20      TRX firmware header, little endian, header size: 28 bytes,  image size: 3362816 bytes, CRC32: 0xB5C3AB6E flags/version: 0x10000
700656    0xAB0F0   Squashfs filesystem, little endian, version 2.0, size: 2655384 bytes, 502 inodes, blocksize: 65536 bytes, created: Wed Dec  8 05:06:27 2010

root@bt:~/images/firmware_mod_kit/firmware-mod-kit-read-only/linksys-wrt54gl/rootfs# find . -iname wget
./usr/bin/wget