UPnP check included

2014-07-02 21:28:39 +02:00 · 2014-07-02 21:28:39 +02:00 · 8f55af5f9d
parent ac2e84bfd6
commit 8f55af5f9d
1 changed files with 5 additions and 0 deletions
--- a/modules/exploits/linux/upnp/dlink_upnp_msearch_exec_echo.rb
+++ b/modules/exploits/linux/upnp/dlink_upnp_msearch_exec_echo.rb
@ -76,6 +76,11 @@ class Metasploit3 < Msf::Exploit::Remote
      udp_sock.sendto(msearch, rhost, rport, 0)
    end

+    # UPnP response:
+    # [*] 192.168.0.2:1900 SSDP Linux, UPnP/1.0, DIR-645 Ver 1.03 | http://192.168.0.2:49152/InternetGatewayDevice.xml | uuid:D02411C0-B070-6009-39C5-9094E4B34FD1::urn:schemas-upnp-org:device:InternetGatewayDevice:1
+    # we do not check for the Device ID (DIR-645) and for the firmware version because there are different
+    # dlink devices out there and we do not know all the vulnerable versions
+
    if res && res =~ /SERVER:\ Linux,\ UPnP\/1.0,\ DIR-...\ Ver/mi
      return Exploit::CheckCode::Detected
    end