0

I have an ARM based Huawei router and Im trying to do injection vulnerability on page under diagnostics where's "ping" feature is. So first I tried this command -c 1 127.0.0.1 and it worked

--- DNS Statistics ---
Server Response = Non-Existent Domain
WanIP = xxx.xxx.xxx.xxx
Name = -c 1 127.0.0.1
Address = -
Aliases = -
Time = 15ms
--- Ping Statistics ---
Operation failed.

then I tried this command 127.0.0.1; echo -c 4 but I get

Test failed.
--- Ping Statistics ---
Operation failed.

and after some more google-ing I found this command ping -c 5 "$(id)" and when I click on start ping` it seams that's get stuck in some loop I suspect that maybe shell is open, here is how it looks

enter image description here

So I want to recreate sending that command with curl, I created mine curl like this

enter image description here

I think maintenancend.cgi is resposable for ping requests. In zip you will find Diagnose Ping Configuration.html and ARM web utility which is responsible for .cgi web requests

Edit: So I made request directly to my web ping page and it look's like this

enter image description here

first button should be start and second stop but they are in java so I need a way to refer to them by name. Also I found example of POST method on web end here it is

curl -X POST -F 'name=linuxize' -F 'email=linuxize@example.com' https://example.com/contact.php

but I need names of buttons/fields to supply and there is non in that "java button's". Here you can find emulated web UI

3
  • You may not be able to see the output; try a command that creates a connection or something. If you don't know how to use curl, you should read the manpage Jan 22 at 3:55
  • man page for curl is huge but it seams that I need to read it all
    – Vido
    Jan 22 at 17:52
  • Well the -F is usually for multi-part POST data, you should probably just use --data or its variants instead. Jan 22 at 23:07
1

Use the browser tools (F12 in most browsers) and check how request is sent when you perform the action in the web UserInterface. Some browsers even have a 'copy as cURL' context menu item for network requests.

2
  • I found how requests looks like https://192.168.100.1:80/html/management/complex.cgi?x=InternetGatewayDevice.IPPingDiagnostics&RUNSTATE_FLAG=Ping&RequestFile=html/management/diagnose_common.asp but I can't recreate java button pressed thing
    – Vido
    Jan 23 at 12:33
  • you did no read my post I did used browser tools to create my curl command
    – Vido
    Jan 23 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.