Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
This article is a great example why you should use your own router instead of ISP provided one
The only thing in the above parameter that was valid was the device serial number. If this request worked, it meant that I could use an “encryptedValue” parameter in the API that didn’t have to have a matching account ID.
I sent the request and saw the exact same HTTP response as above! This confirmed that we didn’t need any extra parameters, we could just query any hardware device arbitrarily by just knowing the MAC address (something that we could retrieve by querying a customer by name, fetching their account UUID, then fetching all of their connected devices via their UUID). We now had essentially a full kill chain.
…
And then he proceeds to make arbitrary changes to his own modem via this exploit as a final proof. Jesus tapdancing christ.
lol holy shit
And then he proceeds to make arbitrary changes to his own modem via this exploit as a final proof. Jesus tapdancing christ.