22 lines
1.3 KiB
YAML
22 lines
1.3 KiB
YAML
#
|
|
# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
|
|
# Browser Exploitation Framework (BeEF) - http://beefproject.com
|
|
# See the file 'doc/COPYING' for copying permission
|
|
#
|
|
# References:
|
|
# CVE-2013-2645
|
|
# http://securityevaluators.com/knowledge/case_studies/routers/tp-link_wr1043n.php
|
|
# http://www.jakoblell.com/blog/2013/10/30/real-world-csrf-attack-hijacks-dns-server-configuration-of-tp-link-routers-2/
|
|
# http://news.softpedia.com/news/Cybercriminals-Exploit-TP-Link-Router-CSRF-Vulnerabilities-to-Hijack-DNS-Settings-395545.shtml
|
|
#
|
|
beef:
|
|
module:
|
|
tplink_dns_csrf:
|
|
enable: true
|
|
category: ["Exploits", "Router"]
|
|
name: "TP-Link DNS Hijack CSRF"
|
|
description: "Attempts to change the DNS setting on a TP-Link router (WR1043ND, TL-MR3020, TL-WDR3600).<br/><br/>The browser must be have an authenticated session on the router.<br/><br/>The list of affected devices includes:<br/>TP-Link WR1043ND V1 up to firmware version 3.3.12 build 120405<br/>TP-Link TL-MR3020 firmware version 3.14.2 Build 120817 Rel.55520n and version 3.15.2 Build 130326 Rel.58517n<br/>TL-WDR3600 firmware version 3.13.26 Build 130129 Rel.59449n and version 3.13.31 Build 130320 Rel.55761n.<br/><br/>This module has not been tested."
|
|
authors: ["Jakob Lell", "Jacob Holcomb"]
|
|
target:
|
|
unknown: ["ALL"]
|