Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add exploit for TrueOnline Billion 5200W-T #7820

Merged
merged 4 commits into from Jan 31, 2017
Merged

Add exploit for TrueOnline Billion 5200W-T #7820

merged 4 commits into from Jan 31, 2017

Conversation

pedrib
Copy link
Contributor

@pedrib pedrib commented Jan 12, 2017

    TrueOnline is a major ISP in Thailand, and it distributes a customised version of
    the Billion 5200W-T router. This customised version has at least two command injection
    vulnerabilities, one authenticated and one unauthenticated, on different firmware versions.
    This module will attempt to exploit the unauthenticated injection first, and if that fails,
    it will attempt to exploit the authenticated injection.
    This module was tested in an emulated environment, as the author doesn't have access to the
    Thai router any more.

More details:
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt

Pcap:

billion.pcap.zip

@wwebb-r7 wwebb-r7 self-assigned this Jan 31, 2017
@wwebb-r7 wwebb-r7 merged commit 2dca53e into rapid7:master Jan 31, 2017
@wwebb-r7
Copy link
Contributor

wwebb-r7 commented Jan 31, 2017

Release Notes

An exploit module that targets a command injection vulnerability in TrueOnline Billion 5200W-T has been added.

@pedrib pedrib deleted the billion branch February 1, 2017 00:39
@tdoan-r7 tdoan-r7 added the rn-enhancement release notes enhancement label Feb 8, 2017
@wwalker-r7 wwalker-r7 added rn-exploit and removed rn-enhancement release notes enhancement labels Feb 10, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants