Rapid7 Vulnerability & Exploit Database

Arris / Motorola Surfboard SBG6580 Web Interface Takeover

Back to Search

Arris / Motorola Surfboard SBG6580 Web Interface Takeover

Disclosed
04/08/2015
Created
05/30/2018

Description

The web interface for the Arris / Motorola Surfboard SBG6580 has several vulnerabilities that, when combined, allow an arbitrary website to take control of the modem, even if the user is not currently logged in. The attacker must successfully know, or guess, the target's internal gateway IP address. This is usually a default value of 192.168.0.1. First, a hardcoded backdoor account was discovered in the source code of one device with the credentials "technician/yZgO8Bvj". Due to lack of CSRF in the device's login form, these credentials - along with the default "admin/motorola" - can be sent to the device by an arbitrary website, thus inadvertently logging the user into the router. Once successfully logged in, a persistent XSS vulnerability is exploited in the firewall configuration page. This allows injection of Javascript that can perform any available action in the router interface. The following firmware versions have been tested as vulnerable: SBG6580-6.5.2.0-GA-06-077-NOSH, and SBG6580-8.6.1.0-GA-04-098-NOSH

Author(s)

  • joev <joev@metasploit.com>

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss
msf auxiliary(arris_motorola_surfboard_backdoor_xss) > show actions
    ...actions...
msf auxiliary(arris_motorola_surfboard_backdoor_xss) > set ACTION < action-name >
msf auxiliary(arris_motorola_surfboard_backdoor_xss) > show options
    ...show and set options...
msf auxiliary(arris_motorola_surfboard_backdoor_xss) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;