4 ms·
tl;dr: You can pass an arbitrary string to system on the router, thereby popping a de facto root shell using telnet. This owns the network.
by dsacco 12y ago
tl;dr: You can pass an arbitrary string to system on the router, thereby popping a de facto root shell using telnet. This owns the network.
- jschwartzi 12y agotl;dr: but only if you're inside the lan or your target has enabled remote administration.
- deleted 12y ago[deleted]
- rasz_pl 12y agojust make user click your crafted link, "she put it in her mouth and you wont believe what happened next!"
- finnn 12y agoIt looks like it could be done with a DNS rebinding attack (as you need to set a special HTTP header, so normal CSRF stuff doesn't work). This would mean the victim would simply need to visit an attacker controlled webpage
- jschwartzi 12y agoSweet, even better. Is there any mitigation for that?
- finnn 12y agoSure! Install OpenWRT or some other alternative firmware.