These types of attack could be achieved via multiple CSRF attacks against the IP addresses discovered via the JavaScript reconnaissance tool.
Say your local IP address is 192.168.1.100
. You visit the malicious website, the JavaScript runs and finds the device 192.168.1.254
on your network. Now, depending on how complex the JavaScript is, it will either identify the router make and model, or will just try a brute force attack in order to exploit the router.
That is, it will send every exploit in its database at the device in order to try and compromise it.
Say that the BOB 2000 router has a vulnerability in that its URL /config/remoteConfigSettings
does not implement any sort of authentication checks. As this page is only accessible from your local network, it is not normally vulnerable to internet based attacks.
However, after someone on your network has visited the malicious site, this could try every attack in its database to try and exploit the router at 192.168.1.254
, including sending a POST request from the browser with the message body:
AllowInternetAccess=true&RequirePassword=false
to http://192.168.1.254/config/remoteConfigSettings
.
As this page is vulnerable, the request causes the WAN side of the router to be available for remote administration and disables the password authentication. The malicious website can report that a device was found to the attacker along with the internet IP for the attacker to log into later either manually, or more likely to add to an IP list for automated exploitation now that remote access is granted. The remote exploitation could include anything from altering DNS settings to an attacker controlled server for a future MITM attack, to malicious firmware updates to the router itself.
As well as checking for known vulnerabilities, the malicious script could also try regular router requests but authenticating with default or commonly used credentials.
Update
Regarding @Ajedi32's comment about the Same Origin Policy - the scanner does not need the router to be in the same origin in order to fingerprint it. It uses a combination of IFrames and image tags to determine whether something and what was loaded and then matches these against known default IPs. From the author's site:
The scanner accesses a IFrame to perform a generic scan of the network
for known default router IP’s, once a connection has been made it then
passes the IP address and performs a lookup of routers/devices based
on that address. The reason I have decided to do this is because I
wanted the scanner to grab as many devices as possible because it will
be impossible to finger print everything.
Once a IP address has been found it passes this to the finger printing
function which uses a image object to make a connection to the device
to see if the finger printing graphic is there.
Via DNS Rebinding
Another possibility not discussed in the linked article is a DNS Rebinding attack. Say the IFrame trick detects something is running on 192.168.1.254
once the victim has visited evil.example.com
. The attacker's detection script then runs a server-side script to rebind the DNS of evil.example.com
to 192.168.1.254
. As the DNS entry has a very short TTL, the browser requeries the name lookup and gets the router address. As the router has default credentials setup, the malicious page can send AJAX requests to read and alter any content on the router's configuration page. This "bypasses" the same origin policy as the router now has the same origin as the malicious site (http://evil.example.com:80
).
This attack would count on the browser timely rechecking DNS. Most browsers have their own DNS cache outside of the Operating System's, and may cache for longer than TTL dictates, hindering this type of attack.