193 lines
6.3 KiB
HTML
193 lines
6.3 KiB
HTML
<!DOCTYPE html>
|
||
<html>
|
||
|
||
<head>
|
||
<title>Evan Pratten</title>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no" />
|
||
<!--[if lte IE 8]><script src="/assets/js/ie/html5shiv.js"></script><![endif]-->
|
||
<link rel="stylesheet" href="/assets/css/main.css" />
|
||
<!-- <link rel="stylesheet" href="/assets/css/custom.css" /> -->
|
||
<!--[if lte IE 9]><link rel="stylesheet" href="/assets/css/ie9.css" /><![endif]-->
|
||
<!--[if lte IE 8]><link rel="stylesheet" href="/assets/css/ie8.css" /><![endif]-->
|
||
|
||
<!-- Syntax highlight -->
|
||
<link rel="stylesheet" href="/assets/css/vs.css" />
|
||
</head>
|
||
|
||
<body>
|
||
|
||
<!-- Wrapper -->
|
||
<div id="wrapper">
|
||
|
||
<!-- Header -->
|
||
<header id="header" style="filter:blur" >
|
||
<a href="/" class="logo"><strong>Evan Pratten</strong> <span>retrylife</span></a>
|
||
<nav>
|
||
<!-- <a href="#menu">Menu</a> -->
|
||
</nav>
|
||
</header>
|
||
|
||
<!-- Menu -->
|
||
<!-- <nav id="menu">
|
||
<ul class="links">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li><a href="http://0.0.0.0:4000//">Home</a></li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li><a href="http://0.0.0.0:4000/all_posts">All posts</a></li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
<ul class="actions vertical">
|
||
<li><a href="#" class="button special fit">Get Started</a></li>
|
||
<li><a href="#" class="button fit">Log In</a></li>
|
||
</ul>
|
||
</nav> -->
|
||
|
||
<section id="banner" class="major" style="height:40vh">
|
||
<div class="inner">
|
||
<header class="major">
|
||
<h1>I had some fun with a router</h1>
|
||
</header>
|
||
<div class="content">
|
||
<p >cleartext passwords + external management = death wish</p>
|
||
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
|
||
<!-- Main -->
|
||
<div id="main" class="alt">
|
||
|
||
<!-- One -->
|
||
<section id="one">
|
||
<div class="inner">
|
||
|
||
<p><p>I was playing around with some D-link routers today and remembered an <a href="https://www.exploit-db.com/exploits/33520">ExploitDB Entry</a> I read a while ago. Many D-link routers have a great feature that allows remote management and configuration queries. Interestingly, this cannot be disabled, and one of the pages contains a cleartext version of the admin password (yay!).</p>
|
||
|
||
<h2 id="how-to-get-yourself-an-admin-password">How to get yourself an admin password</h2>
|
||
<p>On any supported router, make an HTTP request to <code class="highlighter-rouge">http://your.router.ip.addr/tools_admin.asp/</code>. This will return a pretty large XML file containing information about your router’s hardware and configuration.</p>
|
||
|
||
<p>Notice the fact that you did not have to log in. This is due to the fact that this file seems to be used by a remote management service of some sort.</p>
|
||
|
||
<p>The important thing to note here is that, when parsed with the regex pattern: <code class="highlighter-rouge">name="user_password_tmp" value="(.*)"></code>, you get a single string. This string is the admin password of the device.</p>
|
||
|
||
<h2 id="supported-routers">Supported routers</h2>
|
||
<p>This is supported by many D-link routers. The ones I know about are:</p>
|
||
<ul>
|
||
<li>DIR-835</li>
|
||
<li>DIR-855L</li>
|
||
<li>DGL-5500</li>
|
||
</ul>
|
||
|
||
<p>Some routers have this XML file, but it is restricted… By a user without a password. These are:</p>
|
||
<ul>
|
||
<li>DHP-1565</li>
|
||
<li>DIR-652</li>
|
||
</ul>
|
||
|
||
<h2 id="pwnlink">PWNlink</h2>
|
||
<p>Like everything I play with, I made a script to do this all for me (and spent a large amount of time adding colours to the text).</p>
|
||
|
||
<p>My script is called PWNlink (PWN + D-link), It automatically finds a router on your network by looking for a specific DNS entry created by many D-link routers, then checking your gateway. Next, PWNlink reads you router’s <code class="highlighter-rouge">hnap1</code> config to find it’s model number. If supported, the script will read and parse the appropriate configs to give you the admin credentials for your router.</p>
|
||
|
||
<p>PWNlink can be installed on any *nix computer that has both <code class="highlighter-rouge">python3.7</code> and <code class="highlighter-rouge">python3-pip</code> installed. To install PWNlink, run:</p>
|
||
<div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>pip3 install pwnlink
|
||
</code></pre></div></div>
|
||
|
||
<p>Run the script without any arguments for automatic detection, or pass any IP address to use manual detection.</p>
|
||
|
||
<h2 id="disclamier-thingy">Disclamier thingy</h2>
|
||
<p>I don’t see much point to these, but I should probably put one anyways.</p>
|
||
|
||
<p><strong>Don’t be dumb with this script.</strong></p>
|
||
|
||
<p>I have only used it on my own (or 5024’s) routers, and did not create PWNlink with any malicious intent.</p>
|
||
</p>
|
||
</div>
|
||
</section>
|
||
|
||
</div>
|
||
|
||
<!-- Footer -->
|
||
<footer id="footer">
|
||
<div class="inner">
|
||
<ul class="icons">
|
||
|
||
<li><a href="https://twitter.com/ewpratten" class="icon alt fa-twitter" target="_blank"><span class="label">Twitter</span></a></li>
|
||
|
||
<li><a href="https://gitlab.com/u/ewpratten" class="icon alt fa-gitlab" target="_blank"><span class="label">GitLab</span></a></li>
|
||
|
||
<li><a href="https://github.com/ewpratten" class="icon alt fa-github" target="_blank"><span class="label">GitHub</span></a></li>
|
||
|
||
|
||
<li><a href="/feed.xml" class="icon alt fa-rss" target="_blank"><span class="label">RSS</span></a></li>
|
||
</ul>
|
||
<ul class="copyright">
|
||
<li>© Evan Pratten</li>
|
||
<li>Design based from: <a href="https://html5up.net" target="_blank">HTML5 UP</a></li>
|
||
|
||
</ul>
|
||
</div>
|
||
</footer>
|
||
|
||
</div>
|
||
|
||
<!-- Scripts -->
|
||
<script src="/assets/js/jquery.min.js"></script>
|
||
<script src="/assets/js/jquery.scrolly.min.js"></script>
|
||
<script src="/assets/js/jquery.scrollex.min.js"></script>
|
||
<script src="/assets/js/skel.min.js"></script>
|
||
<script src="/assets/js/util.js"></script>
|
||
<!--[if lte IE 8]><script src="/assets/js/ie/respond.min.js"></script><![endif]-->
|
||
<script src="/assets/js/main.js"></script>
|
||
|
||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-74118570-2"></script>
|
||
<script>
|
||
window.dataLayer = window.dataLayer || [];
|
||
|
||
function gtag() {
|
||
dataLayer.push(arguments);
|
||
}
|
||
gtag('js', new Date());
|
||
|
||
gtag('config', 'UA-74118570-2');
|
||
</script>
|
||
|
||
</body>
|
||
|
||
</html> |