50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
---
|
|
title: I had some fun with a router
|
|
description: cleartext passwords + external management = death wish
|
|
date: 2019-06-27
|
|
tags:
|
|
- project
|
|
- cybersecurity
|
|
aliases:
|
|
- /blog/2019/06/27/pwnlink
|
|
- /blog/pwnlink
|
|
---
|
|
|
|
I was playing around with some D-link routers today and remembered an [ExploitDB Entry](https://www.exploit-db.com/exploits/33520) I read a while ago. Many D-link routers have a great feature that allows remote management and configuration queries. Interestingly, this cannot be disabled, and one of the pages contains a cleartext version of the admin password (yay!).
|
|
|
|
## How to get yourself an admin password
|
|
On any supported router, make an HTTP request to `http://your.router.ip.addr/tools_admin.asp/`. This will return a pretty large XML file containing information about your router's hardware and configuration.
|
|
|
|
Notice the fact that you did not have to log in. This is due to the fact that this file seems to be used by a remote management service of some sort.
|
|
|
|
The important thing to note here is that, when parsed with the regex pattern: `name="user_password_tmp" value="(.*)">`, you get a single string. This string is the admin password of the device.
|
|
|
|
## Supported routers
|
|
This is supported by many D-link routers. The ones I know about are:
|
|
- DIR-835
|
|
- DIR-855L
|
|
- DGL-5500
|
|
|
|
Some routers have this XML file, but it is restricted... By a user without a password. These are:
|
|
- DHP-1565
|
|
- DIR-652
|
|
|
|
## PWNlink
|
|
Like everything I play with, I made a script to do this all for me (and spent a large amount of time adding colours to the text).
|
|
|
|
My script is called PWNlink (PWN + D-link), It automatically finds a router on your network by looking for a specific DNS entry created by many D-link routers, then checking your gateway. Next, PWNlink reads you router's `hnap1` config to find it's model number. If supported, the script will read and parse the appropriate configs to give you the admin credentials for your router.
|
|
|
|
PWNlink can be installed on any *nix computer that has both `python3.7` and `python3-pip` installed. To install PWNlink, run:
|
|
```
|
|
pip3 install pwnlink
|
|
```
|
|
|
|
Run the script without any arguments for automatic detection, or pass any IP address to use manual detection.
|
|
|
|
## Disclamier thingy
|
|
I don't see much point to these, but I should probably put one anyways.
|
|
|
|
**Don't be dumb with this script.**
|
|
|
|
I have only used it on my own (or 5024's) routers, and did not create PWNlink with any malicious intent.
|