Published: 24/12/2014 Updated: 31/08/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

AllegroSoft RomPager 4.34 and previous versions, as used in Huawei Home Gateway products and other vendors and products, allows remote malicious users to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
allegrosoft rompager

RomPager versions 434 and below router authentication remover exploit ...

This module scans for HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 434 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials ...

This module exploits HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 434 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials ...

This module scans for HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 434 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials ...

This module exploits HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 434 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials ...

Detects the RomPager 4.07 Misfortune Cookie vulnerability by safely exploiting it.

nmap <target> -p 7547 --script=http-vuln-misfortune-cookie

PORT   STATE SERVICE REASON
7547/tcp open  unknown syn-ack
| http-vuln-misfortune-cookie:
|   VULNERABLE:
|   RomPager 4.07 Misfortune Cookie
|     State: VULNERABLE
|     IDs:  BID:71744  CVE:CVE-2014-9222
|     Description:
| The cookie handling routines in RomPager 4.07 are vulnerable to remote code
| execution. This script has verified the vulnerability by exploiting the web
| server in a safe manner.
|     References:
|       http://www.kb.cert.org/vuls/id/561444
|       http://mis.fortunecook.ie/too-many-cooks-exploiting-tr069_tal-oppenheim_31c3.pdf
|       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9222
|       http://www.checkpoint.com/blog/fortune-cookie-hole-internet-gateway/index.html
|_      http://www.securityfocus.com/bid/71744

This module scans for HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 4.34 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials.

msf > use auxiliary/scanner/http/allegro_rompager_misfortune_cookie
msf auxiliary(allegro_rompager_misfortune_cookie) > show actions
    ...actions...
msf auxiliary(allegro_rompager_misfortune_cookie) > set ACTION < action-name >
msf auxiliary(allegro_rompager_misfortune_cookie) > show options
    ...show and set options...
msf auxiliary(allegro_rompager_misfortune_cookie) > run

This module exploits HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 4.34 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials.

msf > use auxiliary/admin/http/allegro_rompager_auth_bypass
msf auxiliary(allegro_rompager_auth_bypass) > show actions
    ...actions...
msf auxiliary(allegro_rompager_auth_bypass) > set ACTION < action-name >
msf auxiliary(allegro_rompager_auth_bypass) > show options
    ...show and set options...
msf auxiliary(allegro_rompager_auth_bypass) > run

This module scans for HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 4.34 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials.

msf > use auxiliary/scanner/http/allegro_rompager_misfortune_cookie
msf auxiliary(allegro_rompager_misfortune_cookie) > show actions
    ...actions...
msf auxiliary(allegro_rompager_misfortune_cookie) > set ACTION < action-name >
msf auxiliary(allegro_rompager_misfortune_cookie) > show options
    ...show and set options...
msf auxiliary(allegro_rompager_misfortune_cookie) > run

This module exploits HTTP servers that appear to be vulnerable to the 'Misfortune Cookie' vulnerability which affects Allegro Software Rompager versions before 4.34 and can allow attackers to authenticate to the HTTP service as an administrator without providing valid credentials.

msf > use auxiliary/admin/http/allegro_rompager_auth_bypass
msf auxiliary(allegro_rompager_auth_bypass) > show actions
    ...actions...
msf auxiliary(allegro_rompager_auth_bypass) > set ACTION < action-name >
msf auxiliary(allegro_rompager_auth_bypass) > show options
    ...show and set options...
msf auxiliary(allegro_rompager_auth_bypass) > run

SCZ文档抄录原文来自 scz617cn 作者SCZ是我学习的榜样，对于各种技术问题的深入钻研，令我十分钦佩。分享的知识点，也在实际工作中对我有很大的帮助。将scz的技术文档抄录于此，以备不时之需。 Misc 2016-07-28 11:39 JEB 206 52pojie破解方案简评 2016-07-01 16:37 DSA相关的趣味数学题(1)

hacklib - pentesting, port scanning, and logging in anywhere with Python

hacklib Toolkit for hacking enthusiasts using Python hacklib is a Python module for hacking enthusiasts interested in network security It is no longer in active development Installation To get hacklib, simply run in command line: pip install hacklib hacklib also has a user interface To use it, you can do one of the following: Downloa

Assessment of Misfortune Cookie in Argentina

Assessment of Misfortune Cookie in Argentina This is an assessment of the Misfortune Cookie vulnerability (CVE-2014-9222) found by Check Point in an HTTP server firmware that runs on many home modems, their report states: This severe vulnerability allows an attacker to remotely take over the device with administrative privileges Although the bug that causes the problem has be

Irish eyes are crying: Tens of thousands of broadband modems wide open to hijacking

The Register • Thomas Claburn in San Francisco • 22 Nov 2016

D1000 can be directed to drop its firewall, allowing access to panel over the internet

Eir, Ireland's largest ISP, has tens of thousands of customers with insecure ADSL2+ modems that appear to be vulnerable to remote takeover. Earlier this month, a security researcher writing under the name "kenzo" has posted a proof-of-concept exploit that demonstrates how an attacker might take control of an Eir D1000 modem. The ZyXEL-built Eir D1000 [PDF] comes with an open TCP port, 7547, which is used by the CPE WAN Management Protocol to manage the modems on Eir's network. According to kenzo...

CVE-2014-9222

Vulnerability Summary

Vulnerability Trend

Exploits

Nmap Scripts

Metasploit Modules

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect