-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve check method in Belkin Wemo UPnP RCE #11452
Comments
Example request response cycles below: Request:
Response:
|
@wvu-r7 Will try to get this into pull request form this weekend! |
You rock! I appreciate it! |
We can do a |
Something like this: metasploit-framework/modules/exploits/unix/webapp/jquery_file_upload.rb Lines 78 to 115 in 3871e45
Or this:
|
I would LOVE to see UPnP library support in Metasploit, btw. That might be a fun "summer" project, perhaps for a GSoC student. |
Yeah me too, because right now I'm patching miranda |
Value can also be found in |
The |
Since we're working with XML, I think XPath will be the way to go:
Regex is too brutish. |
that will make my xml parsing sooooo much cleaner, thank you @wvu-r7 |
Hey @wvu-r7 sorry to bother you but I can't get the xpath functions ( <?xml version="1.0"?>
<root xmlns="urn:Belkin:device-1-0">
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<device>
<deviceType>urn:Belkin:device:insight:1</deviceType>
<friendlyName>WeMo Insight upstairs 2</friendlyName>
<manufacturer>Belkin International Inc.</manufacturer>
<manufacturerURL>http://www.belkin.com</manufacturerURL>
<modelDescription>Belkin Insight 1.0</modelDescription>
<modelName>Insight</modelName>
<modelNumber>1.0</modelNumber>
<modelURL>http://www.belkin.com/plugin/</modelURL>
<serialNumber>231652K1200478</serialNumber>
<UDN>uuid:Insight-1_0-231652K1200478</UDN>
<UPC>123456789</UPC>
<macAddress>149182B45F38</macAddress>
<firmwareVersion>WeMo_WW_2.00.11057.PVT-OWRT-InsightV2</firmwareVersion>
<iconVersion>0|49154</iconVersion>
<binaryState>0</binaryState>
<iconList>
<icon>
<mimetype>jpg</mimetype>
<width>100</width>
<height>100</height>
<depth>100</depth>
<url>icon.jpg</url>
</icon>
</iconList>
<serviceList>
<service>
<serviceType>urn:Belkin:service:WiFiSetup:1</serviceType>
<serviceId>urn:Belkin:serviceId:WiFiSetup1</serviceId>
<controlURL>/upnp/control/WiFiSetup1</controlURL>
<eventSubURL>/upnp/event/WiFiSetup1</eventSubURL>
<SCPDURL>/setupservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:timesync:1</serviceType>
<serviceId>urn:Belkin:serviceId:timesync1</serviceId>
<controlURL>/upnp/control/timesync1</controlURL>
<eventSubURL>/upnp/event/timesync1</eventSubURL>
<SCPDURL>/timesyncservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:basicevent:1</serviceType>
<serviceId>urn:Belkin:serviceId:basicevent1</serviceId>
<controlURL>/upnp/control/basicevent1</controlURL>
<eventSubURL>/upnp/event/basicevent1</eventSubURL>
<SCPDURL>/eventservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:firmwareupdate:1</serviceType>
<serviceId>urn:Belkin:serviceId:firmwareupdate1</serviceId>
<controlURL>/upnp/control/firmwareupdate1</controlURL>
<eventSubURL>/upnp/event/firmwareupdate1</eventSubURL>
<SCPDURL>/firmwareupdate.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:rules:1</serviceType>
<serviceId>urn:Belkin:serviceId:rules1</serviceId>
<controlURL>/upnp/control/rules1</controlURL>
<eventSubURL>/upnp/event/rules1</eventSubURL>
<SCPDURL>/rulesservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:metainfo:1</serviceType>
<serviceId>urn:Belkin:serviceId:metainfo1</serviceId>
<controlURL>/upnp/control/metainfo1</controlURL>
<eventSubURL>/upnp/event/metainfo1</eventSubURL>
<SCPDURL>/metainfoservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:remoteaccess:1</serviceType>
<serviceId>urn:Belkin:serviceId:remoteaccess1</serviceId>
<controlURL>/upnp/control/remoteaccess1</controlURL>
<eventSubURL>/upnp/event/remoteaccess1</eventSubURL>
<SCPDURL>/remoteaccess.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:deviceinfo:1</serviceType>
<serviceId>urn:Belkin:serviceId:deviceinfo1</serviceId>
<controlURL>/upnp/control/deviceinfo1</controlURL>
<eventSubURL>/upnp/event/deviceinfo1</eventSubURL>
<SCPDURL>/deviceinfoservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:insight:1</serviceType>
<serviceId>urn:Belkin:serviceId:insight1</serviceId>
<controlURL>/upnp/control/insight1</controlURL>
<eventSubURL>/upnp/event/insight1</eventSubURL>
<SCPDURL>/insightservice.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:smartsetup:1</serviceType>
<serviceId>urn:Belkin:serviceId:smartsetup1</serviceId>
<controlURL>/upnp/control/smartsetup1</controlURL>
<eventSubURL>/upnp/event/smartsetup1</eventSubURL>
<SCPDURL>/smartsetup.xml</SCPDURL>
</service>
<service>
<serviceType>urn:Belkin:service:manufacture:1</serviceType>
<serviceId>urn:Belkin:serviceId:manufacture1</serviceId>
<controlURL>/upnp/control/manufacture1</controlURL>
<eventSubURL>/upnp/event/manufacture1</eventSubURL>
<SCPDURL>/manufacture.xml</SCPDURL>
</service>
</serviceList>
<presentationURL>/pluginpres.html</presentationURL>
</device>
</root> What am I missing here? I was able to parse this out successfully using REXML, but the code was ugggggggly |
nevermind, looks like I dont even need to parse the XML to extract the version. |
I created https://github.com/rapid7/metasploit-framework/pull/11463/files for this! |
XPath example against the HTTP response object:
|
#11463 is merged, so please rebase your work! Feel free to remove the |
Unpatched Crock-Pot
Patched Switch
|
Putting this ticket up so I don't forget.
I wanted to improve the check method in
exploit/linux/upnp/belkin_wemo_upnp_exec
and(irrelevant) a firmware version check, but I forgot the UPnP action and don't have access to the device at the moment.auxiliary/admin/wemo/crockpot
Edit: I also didn't discover the vulnerable version number until much later in development. Now we have it.
@nstarke has kindly volunteered to help with that this weekend. No pressure. This is just for coordination. :P
For #10731 and #11409.
The text was updated successfully, but these errors were encountered: