CVE-2019-17525 PoC — D-Link DIR-615 安全漏洞

Source

https://github.com/huzaifahussain98/CVE-2019-17525

Associated Vulnerability

Title:D-Link DIR-615 安全漏洞 (CVE-2019-17525)
Description:D-Link DIR-615是中国台湾友讯（D-Link）公司的一款无线路由器。 D-Link DIR-615 T1 20.10版本中的登录页面存在安全漏洞。远程攻击者可利用该漏洞绕过CAPTCHA保护机制并进行暴力攻击。

Description

D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1

Readme

# CVE-2019-17525

**D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" &amp; "HARDWARE VERSION:T1**

A vulnerability found on login-in page of D-LINK ROUTER "DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1" which allows attackers to easily bypass CAPTCHA on login page by BRUTEFORCING.

**TARGET**

"Log-in page" of D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1"(IP Address of router login).

**ATTACK SCENARIO AND REPRODUCTION STEPS**

1. Find the PUBLIC IP of the TARGET NETWORK.
2. On browsing the Target IP in the browser, we will get a ROUTER LoginPage.
3. Fill the required login credentials.
4. Fill the CAPTCH properly and Intercept the request in Burpsuit.
5. Send the Request to Intruder and select the target variables i.e. username & password which will we bruteforce under Positions Tab
6. Set the payloads on target variables i.e. username & password under Payloads Tab.
7. Set errors in (the validatecode is invalid & username or password error, try again) GREP-MATCH under Options Tab.
8. Now hit the start attack and you will find the correct credentials.

**REGARDS**

Huzaifa Hussain

https://twitter.com/disguised_noob

https://www.linkedin.com/in/huzaifa-hussain-046791179

File Snapshot


 [4.0K]  /data/pocs/f1c0aeff59adffe405062327f04344d02c02d643
└── [1.2K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!