Jump to content
emires

• Faille dans les routeurs TP-LINK TD-W8951ND

Recommended Posts

• Faille dans les routeurs TP-LINK TD-W8951ND |

> sur ShodanHQ, rechercher "TD-W8951ND"

> se rendre à la page xxx.xxx.xxx.xxx/rpFWUpload.html

> faire une sauvegarde de la ROM

> montrer la ROM à http://50.57.229.26/zynos.php (module "ZynOS (Huawei) Configuration Decompressor" - routerpwn)

> on obtient :

xxxxxxxx

TP-LINK

public

public

public

Node5

xxxxxxxx@callu

dhcppc

> on retourne sur xxx.xxx.xxx.xxx/ puis

•login : admin

•password : xxxxxxxx

 

3734 470 Reddit6 456 9469

 

More than 256,000 Algerian TP-LINK Routers are vulnerable to Hackers

More than 15.2% of the Algerian population use Internet service which is provided by around 30 Internet Service Providers and one of the largest shares is served by Algerie Telecom.

 

Algerie Telecom provides TP-LINK TD-W8951ND Router to most of their home customers who Opt-In for Internet services and each of which has ZYXEL embedded firmware installed in it.

 

ABDELLI Nassereddine, penetration tester and Algerian Computer Science Student has reported highly critical unauthorized access and password disclosure vulnerabilities in the Routers provided by Algerie Telecom.

 

He told 'The Hacker News' that the vulnerabilities can be exploited by any remote hacker just by exploiting a very simple loophole in the firmware.

 

First, he found that an unauthorized access is available to 'Firmware/Romfile Upgrade' Section on the Router's panel that can be accessed without any login password i.e. http://IP//rpFWUpload.htmlThis page actually allows a user to upgrade the Firmware of the router and also allows to download the Romfile Backup file (rom-0) i.e. http://IP address/rom-0 (as shown)

 

This Romfile contains the administrative password of the Router and can be retrieved in plain text by reverse engineering it using a free online service: http://50.57.229.26/zynos.php. One just need to upload the Romfile and can get plain text output easily. Router's password will be displaced in the very first line of the output, as shown below:

More than 256,000 Algerian TP-LINK Routers are vulnerable to Hackers

He claimed that he has tested the IP address range that belongs to Algeria i.e. 41.107. x. x and found thousands of them are vulnerable to hackers.

 

A Quick search on SHODAN Search Engine using keyword 'RomPager country:dz' showing more than 2,59,744 devices available on the Internet and 95% of them are now at risk.

 

ABDELLI also submitted an automated exploit POC script on GITHUB, that can scan the complete subnet for vulnerable routers and will display respective passwords on the screen, as shown:

More than 256,000 Algerian TP-LINK Routers are vulnerable to Hackers

I have tested the flaw over 100's of routers, and found this as a very critical bug. Simply by changing the DNS servers from the victim's router, one can redirect the users' traffic to any malicious server. Such attacks allow hackers to inject the malicious DNS server to perform advance phishing attacks against Facebook, Gmail, Bank Accounts and also whole system can also be compromised.

 

There is no patch yet available from the vendor, so to prevent yourself from such vulnerability you can forward port 80 to any other website or unused IP address of your network.

 

Subscribe to Quick News Updates

 

 

 

La solution ? la balle est dans votre camp...

Edited by emires

Share this post


Link to post
Share on other sites

Salut,

Outre les tp link d'autres modems sont touchés par cette faille

En cherchant sur le net j'ai trouvé cette solution en attendant un correctif:

 

Il suffit d'entrer dans l'interface du modem Trouver et ouvrir NAT

Il faudra juste rediriger le protocole HTTP (port 80) sur une ip locale que vous n'utilisez pas comme sur cet exemple avec un TP-Link

 

457449vulnrabilitsmodems.jpg

 

Et C'est tout !!!!!!!!

Edited by laliche

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.




×
×
  • Create New...