0

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin).

First with nmap I looked for open ports on router and only opened one is http 80.

> nmap 192.168.0.1

 Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-31 12:54 Central Europe 
 Standard Time 
 Nmap scan report for 192.168.0.1
 Host is up (0.0082s latency).
 Not shown: 999 closed ports
 PORT   STATE SERVICE
 80/tcp open  http
 MAC Address: ::::: (Cisco Spvtg)

  Nmap done: 1 IP address (1 host up) scanned in 3.66 seconds

After I looked at how router login page handles bad login. enter image description here

 > REQUEST and RESPONSE details

General:
Request URL: http://192.168.0.1/goform/Docsis_system
Request Method: POST
Status Code: 302 Redirect
Remote Address: 192.168.0.1:80
Referrer Policy: no-referrer-when-downgrade

Response Headers:
Connection: close
Content-type: text/html
Location: http://192.168.0.1/Docsis_system.asp
Server: PS HTTP Server

Request Headers:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,sr;q=0.8
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 84
Content-Type: application/x-www-form-urlencoded
Cookie: Lang=en; SessionID=3909426640
Host: 192.168.0.1
Origin: http://192.168.0.1
Referer: http://192.168.0.1/Docsis_system.asp
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Form Data:
username_login: bad_password
password_login: bad_password
LanguageSelect: en
Language_Submit: 0
login: Log In 

My hydra command looks like this:

hydra -l admin -p admin 192.168.0.1 http-post-form "/Docsis_system.asp:username_login=^USER^&password_login=^PASS^&LanguageSelect=en&Language_Submit=0&login=Log In:Invalid username or password.:H=Cookie: Lang=en; SessionID=3909626650"

Terminal output:

Hydra v8.7-dev (c) 2018 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2019-01-31 13:03:57
[DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:0), ~1 try pe
r task
[DATA] attacking http-post-form://192.168.0.1:80/Docsis_system.asp:username_logi
n=^USER^&password_login=^PASS^&LanguageSelect=en&Language_Submit=0&login=Log In:
Invalid username or password.:H=Cookie: Lang=en; SessionID=3909626650
1 of 1 target completed, 0 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2019-01-31 13:04:01

Note that SessionID in command and at REQUEST HEADER section are not the same since in command I used new one after I refreshed page.

Anyway whatever I try output of hydra is: 1 of 1 target completed, 0 valid passwords found.

I tried various combinations where I left out fields like Lang, Language_Submit, LanguageSelect, also I tried to catch successfull password with S:admin but still no success.

Either I am making some stupid mistake or this router have some additional protection against this kind of attacks. Anyone have some suggestions?

  • Please do not post images of text. The images are difficult to read. Please copy/paste the test and use the code formatting tool. – schroeder Jan 31 at 11:36
  • @schroeder Should I modify the question or this is advice for future questions? – sha256 Jan 31 at 11:38
  • If you can replace the images in this question with the actual text, it will make it easier to answer. I understand that you have session tokens to manage, and it might not be practical, but it will help with getting answers, if you can. – schroeder Jan 31 at 11:41
  • Are you sure that you are using F= correctly? I'm not seeing any documentation for it. What happens if you remove those 2 characters? S= is for success, but I don't think that you need to use F= to denote failure. – schroeder Jan 31 at 11:46
  • @schroeder I tried without F=, also i tried S=admin since welcome page will display current username, also I tried S=Log OFF and other strings that are displayed after successfull login. – sha256 Jan 31 at 11:53
0

I figured it out. Problem was that router checks Referer field in HTTP header. It should be set at http://192.168.0.1/Docsis_system.asp.

Anyway I didn't manage to solve problem with THC Hydra since specifying: :H=Referer:http://192.168.0.1/Docsis_system.asp made THC Hydra to do nothing, I checked with Wireshark and not even one request was sent. When I removed this field Hydra worked fine again but router wouldn't approve login without Referer field.

I tried with Medusa but it turns out that Medusa doesn't support redirect as response since router always sends 302 Redirect with selected page depending on if login was successful or not.

At the end I was forced to write dirty Python script that sends crafted HTTP request and everything worked out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.