Royal Router Walkthrough

Challenge Statement#

Solution#

First, let’s start with a nmap scan of the network.

We find that there is a D-link Router. We can try logging into the admin portal.

Looking around for CVEs for this version of D-Link Routers, we come across this blog post.
It highlights a Command Injection vulnerability in the POST parameter of the /set_sta_enrollee_pin.cgi page.

We can try to visit /set_sta_enrollee_pin.cgi (which leads to an infinity loop), intercept the request and send to the BurpSuite repeater.
Now, we can modify the request to look like this.

Make sure to set up a netcat listener before sending the request.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.