Re: http-tplink-dir-traversal.nse : Exploits path traversal vulnerability affecting several TP-Link wireless router models

[Paulino Calderon <paulino () calderonpale com>]

On 28/06/2012 12:48 a.m., Paulino Calderon wrote:
> -------- Original Message --------
> Subject:     http-tplink-dir-traversal.nse : Exploits path traversal 
> vulnerability affecting several TP-Link wireless router models
> Date:     Thu, 28 Jun 2012 00:25:17 -0500
> From:     Paulino Calderon <paulino () calderonpale com>
> To:     Nmap Dev <nmap-dev () insecure org>
>
>
>
> Hi list,
>
> description = [[
> Exploits a directory traversal vulnerability existing in several TP-Link
> wireless routers. Attackers may exploit this vulnerability to read any
> of the configuration and password files.
>
> This vulnerability was confirmed in models WR740N and WR740ND but there
> are several models that use the same HTTP server so I believe they could
> be vulnerable as well. I appreciate
> any help confirming the vulnerability in other models.
>
> Advisory:
> *
> http://websec.ca/advisories/view/path-traversal-vulnerability-tplink-wdr740 
>
>
> Other interesting files:
> * /tmp/topology.cnf (Wireless configuration)
> * /tmp/ath0.ap_bss (Wireless encryption key)
> ]]
>
> ---
> -- @usage nmap -p80 --script http-tplink-dir-traversal.nse <target>
> -- @usage nmap -p80 -Pn -n --script http-tplink-dir-traversal.nse 
> <target>
> -- @usage nmap -p80 --script http-tplink-dir-traversal.nse --script-args
> rfile=/etc/topology.conf -d -n -Pn
>
>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/

Hi,
I've commited the updated version of the script under the "exploit" and 
"vuln" category in rev 29132.
Cheers!

--
Paulino Calderón Pale
Website: http://calderonpale.com
Twitter: http://twitter.com/calderpwn

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/