The third instalment of the Shodan to RCE series, discovering and exploiting vulnerabilities in Belkin routers found exposed on the internet.
Our newest post of this interesting series of Shodan to RCE takes us to Belkin routers.
Shodan Search Query
"Server: httpd" "Cache-Control: no-cache,no-store,must-revalidate, post-check=0,pre-check=0" "100-index.htm"
As at the time of writing this post, there were not so many results for the Belkin routers )-:
By navigating to one of the shodan search results, we may get such a dashboard, which in itself may be reported as a security vulnerability? – unauthorized access?, information disclosure?
Getting Key: Method #1
By navigating to the link http://target/langchg.cgi and viewing the page source:
The wireless key can be clearly seen in cleartext without any authentication required!
Getting Key: Method #2
By navigating to the link http://target/adv_wifidef.cgi and viewing the source:
Again, the wireless network key can be clearly seen in the source code without authentication!
Credits to the exploit researcher: Wadeek.