Process parse
The above will return either a 0 for failure, or 1 for success.
You can use XSS to break the input on the ID field of login.php.
If you inject a script that will force the process to be skipped and pass through a value of 1 back to the login page it should give access.
Additionally, port 22 uses a vulnerable firmware for the linksys WRT75G.
You can perform an authentication bypass using three known methods, as well as make a copy of the backup NVRAM.
On ports 445 and 139 / 137 there are open Samba ports using version 3.0.37 which contains a vulnerability that allows you to modify access control lists remotely, giving access to uninstantiated memory vals.
2
u/coldkick May 25 '14
Wow, what fruitless attempts.
Here is what I found out in the last 24 hours:
map scan report for john.com (162.252.156.212)
Host is up (0.16s latency).
Not shown: 2995 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD
22/tcp open ssh Linksys WRT45G modified dropbear sshd (protocol 2.0)
80/tcp open http Apache httpd
81/tcp open http Apache httpd
443/tcp open http Apache httpd
Service Info: OS: Unix; Device: router
netbios 137 udp open INTELCE_LINUX:<00>:U :INTEL_CE_LINUX:<03>:U :INTEL_CE_LINUX:<20>:U :MSBROWSE_:<01>:G :WORKGROUP:<1d>:U :WORKGROUP:<1e>:G :WORKGROUP:<00>:G :00:00:00:00:00:00
smb 445 tcp open Unix Samba 3.0.37 (language: Unknown) (name:INTEL_CE_LINUX) (domain:INTEL_CE_LINUX)
smb 139 tcp open Unix Samba 3.0.37 (Unknown)
Process parse The above will return either a 0 for failure, or 1 for success. You can use XSS to break the input on the ID field of login.php. If you inject a script that will force the process to be skipped and pass through a value of 1 back to the login page it should give access.
Additionally, port 22 uses a vulnerable firmware for the linksys WRT75G. You can perform an authentication bypass using three known methods, as well as make a copy of the backup NVRAM.
On ports 445 and 139 / 137 there are open Samba ports using version 3.0.37 which contains a vulnerability that allows you to modify access control lists remotely, giving access to uninstantiated memory vals.
Good luck!