# Exploit Title: Intex Router N-150 - Cross-Site Request Forgery (Add Admin) # Date: 2018-06-23 # Exploit Author: Navina Asrani # Version: N-150 # CVE : N/A # Category: Router Firmware # 1. Description # The firmware allows malicious request to be executed without verifying # source of request. This leads to arbitrary execution with malicious request # which will lead to the creation of a privileged user.. # 2. Proof of Concept # Visit the application # Go to any router setting modification page and change the values, # create a request and observe the lack of CSRF tokens. # Craft an html page with all the details for the built-in admin # user creation and host it on a server # Upon the link being clicked by a logged in admin user, # immediately, the action will get executed # Exploitation Technique: A attacker can create a rogue admin user to gain # access to the application. # Exploit code: