Add SOAP PortMapping UPnP auxiliary module #5776

St0rn · 2015-07-26T19:40:25Z

Auxiliary module to add Port Mapping into routers which allow UPnP SOAP request.
The success status is verified by router response to a request (HTTP code 200).

Example Output


msf> use auxiliary/upnp/soap_addportmapping
msf auxiliary(soap_addportmapping) > set CTRL_URL WANIPConn1
CTRL_URL => WANIPConn1
msf auxiliary(soap_addportmapping) > set external_port 69
external_port => 69
msf auxiliary(soap_addportmapping) > set internal_port 69
internal_port => 6
msf auxiliary(soap_addportmapping) > set internal_client 192.168.1.38
internal_client => 192.168.1.38
msf auxiliary(soap_addportmapping) > set rhost 192.168.1.1
rhost => 192.168.1.1
msf auxiliary(soap_addportmapping) > set rport 49000
rport => 49000
msf auxiliary(soap_addportmapping) > run

[*] Sending SOAP Envelope
[+] PAT added successfully
[*] Auxiliary module execution completed

bcook-r7 · 2015-07-27T15:50:03Z

You should fix any errors from msftidy and push to this PR.

espreto · 2015-07-29T04:30:28Z

modules/auxiliary/upnp/soap_addportmapping.rb

+ 	  header =  "POST http://#{rhost}:#{rport}/#{ctrlurl} HTTP/1.0\r\n"
+ 	  header << "Content-Type: text/xml;charset=\"utf-8\"\r\n"
+ 	  header << "SOAPAction: #{soapaction}\n\r"
+ 	  header << "User-Agent: SOAP AddPortMapping Metasploit Module\r\n"


I'd leave the "User-Agent" less obvious. Like: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Hmmmm, on second thought, one hard coded value is not legal. Use Rex::UserAgent.random is more appropriate.

St0rn · 2015-07-29T16:06:02Z

Thx i will modify it

hdm · 2015-08-06T11:11:03Z

Looks like mostly msftidy errors:

[*] Running msftidy.rb in ./.git/hooks/post-merge mode
--- Checking new and changed module syntax with tools/msftidy.rb ---
modules/auxiliary/upnp/soap_addportmapping.rb:9 - [WARNING] Spaces at EOL
modules/auxiliary/upnp/soap_addportmapping.rb:11 - [WARNING] Spaces at EOL
modules/auxiliary/upnp/soap_addportmapping.rb:12 - [WARNING] Spaces at EOL
modules/auxiliary/upnp/soap_addportmapping.rb:35 - [WARNING] Space-Tab mixed indent: " \t content << \"<m:AddPortMapping xmlns:m=\\\"urn:schemas-upnp-org:service:WANIPConnection:1\\\">\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:36 - [WARNING] Space-Tab mixed indent: " \t content << \"<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:37 - [WARNING] Space-Tab mixed indent: " \t content << \"<NewLeaseDuration>3600</NewLeaseDuration>\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:38 - [WARNING] Space-Tab mixed indent: " \t content << \"<NewInternalClient>\#{datastore['INTERNAL_CLIENT']}</NewInternalClient>\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:50 - [WARNING] Space-Tab mixed indent: " \t header = \"POST http://\#{rhost}:\#{rport}/\#{ctrlurl} HTTP/1.0\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:51 - [WARNING] Space-Tab mixed indent: " \t header << \"Content-Type: text/xml;charset=\\\"utf-8\\\"\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:52 - [WARNING] Space-Tab mixed indent: " \t header << \"SOAPAction: \#{soapaction}\\n\\r\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:53 - [WARNING] Space-Tab mixed indent: " \t header << \"User-Agent: SOAP AddPortMapping Metasploit Module\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:54 - [WARNING] Space-Tab mixed indent: " \t header << \"Host: \#{rhost}:\#{rport}\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:55 - [WARNING] Space-Tab mixed indent: " \t header << \"Content-Length: \#{contentlen}\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:56 - [WARNING] Space-Tab mixed indent: " \t header << \"\\r\\n\"\n"
modules/auxiliary/upnp/soap_addportmapping.rb:57 - [WARNING] Space-Tab mixed indent: " \t header << content\n"

jhart-r7 · 2015-08-28T21:13:17Z

modules/auxiliary/upnp/soap_addportmapping.rb

+##
+
+require 'msf/core'
+class Metasploit3 < Msf::Auxiliary


This should really go in modules/auxiliary/admin/upnp, instead.

jhart-r7 · 2015-08-28T21:23:46Z

modules/auxiliary/upnp/soap_addportmapping.rb

+                )
+      register_options(
+      [
+        OptString.new('CTRL_URL', [ true, 'UPnP Control URL']),


You should use Msf::Exploit::Remote::HttpClient for this

UDP is fun too. Are there others?

jhart-r7 · 2015-08-28T22:54:27Z

@St0rn, thanks for the contribution! I've addressed most of the feedback in St0rn#1. If that all looks good to you, you can merge it and those changes will appear here. After that we can handle the rest in this PR.

jhart-r7 · 2015-08-28T22:59:26Z

My testing having applied St0rn#1 so far. I've got a box running miniupnpd 1.7 with the SOAP interface bound to 12345/TCP. Confirm that there are chains ready and clear:

root@miniupnpd-natpmp-1-7:~# iptables -n -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
MINIUPNPD  all  --  0.0.0.0/0            10.4.17.236         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain MINIUPNPD (1 references)
target     prot opt source               destination

Create a mapping:

msf auxiliary(soap_addportmapping) > set RHOST 10.4.17.236
RHOST => 10.4.17.236
msf auxiliary(soap_addportmapping) > set RPORT 12345
RPORT => 12345
msf auxiliary(soap_addportmapping) > set INTERNAL_CLIENT  10.4.17.236
INTERNAL_CLIENT => 10.4.17.236
msf auxiliary(soap_addportmapping) > set EXTERNAL_PORT 2222
EXTERNAL_PORT => 2222
msf auxiliary(soap_addportmapping) > set INTERNAL_PORT 22
INTERNAL_PORT => 22
msf auxiliary(soap_addportmapping) > run

[+] 10.4.17.236:12345 successfully mapped any:2222/TCP -> 10.4.17.236:22/TCP
[*] Auxiliary module execution completed

Confirm it with iptables and telnet:

root@miniupnpd-natpmp-1-7:~# iptables -n -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
MINIUPNPD  all  --  0.0.0.0/0            10.4.17.236         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain MINIUPNPD (1 references)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:2222 to:10.4.17.236:22
...
$  telnet 10.4.17.236 2222        
Trying 10.4.17.236...
Connected to 10.4.17.236.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2

Clean-up and enhance soap_addportmapping.rb

St0rn · 2015-08-29T00:14:33Z

@jhart-r7 thx

jhart-r7 · 2015-08-31T16:12:50Z

modules/auxiliary/admin/upnp/soap_addportmapping.rb

+  def initialize
+    super(
+      'Name'           => 'UPnP AddPortMapping',
+      'Description'    => 'UPnP AddPortMapping SOAP request',


Add a better name and description.

jhart-r7 · 2015-09-03T01:54:46Z

@St0rn, see St0rn#2, which is likely the last of the necessary cleanup. Give it a test and land it if it works for you.

jhart-r7 · 2015-09-09T12:35:22Z

Ping @St0rn -- you may not have seen St0rn#2 or may be busy. If you aren't able to land it in the next week or so, I may just close this and resubmit a new PR with your code + mine. Thanks!

Fabien added 4 commits July 26, 2015 20:59

Create soap_addportmapping.rb

fba81fc

Update soap_addportmapping.rb

8dbd51a

Update soap_addportmapping.rb

1210183

Update soap_addportmapping.rb

3fd18e4

espreto reviewed Jul 29, 2015
View reviewed changes

jvazquez-r7 added module feature labels Aug 4, 2015

jhart-r7 self-assigned this Aug 28, 2015

jhart-r7 reviewed Aug 28, 2015
View reviewed changes

jhart-r7 added 2 commits August 28, 2015 14:19

First pass at style cleanup

45c2422

Relocate module to more correct location

a0aaf93

jhart-r7 reviewed Aug 28, 2015
View reviewed changes

jhart-r7 added 9 commits August 28, 2015 14:47

Convert to using HttpClient

ba95a7d

More minor style cleanup

45fde92

Add support for specifying protocol

840be71

UDP is fun too. Are there others?

Use random port mapping description

d570411

Expose lease duration as an option

13dd822

Make most everything configurable and provide useful output

35555f5

Remove unused

66616ee

Use an OptAddress instead, revert back to client name

e6e0581

Clean up map description

436910b

jhart-r7 mentioned this pull request Aug 28, 2015

Clean-up and enhance soap_addportmapping.rb St0rn/metasploit-framework#1

Merged

Merge pull request #1 from jhart-r7/pr/fixup-5776

25d133c

Clean-up and enhance soap_addportmapping.rb

jhart-r7 reviewed Aug 31, 2015
View reviewed changes

jhart-r7 mentioned this pull request Aug 31, 2015

More UPnP SOAP PortMapping module cleanup St0rn/metasploit-framework#2

Closed

jhart-r7 changed the title ~~Add SOAP AddPortMapping UPnP auxiliary module~~ Add SOAP PortMapping UPnP auxiliary module Aug 31, 2015

jhart-r7 mentioned this pull request Sep 15, 2015

Add SOAP PortMapping UPnP auxiliary module #5983

Merged

jhart-r7 closed this Sep 15, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SOAP PortMapping UPnP auxiliary module #5776

Add SOAP PortMapping UPnP auxiliary module #5776

St0rn commented Jul 26, 2015

bcook-r7 commented Jul 27, 2015

espreto Jul 29, 2015

espreto Jul 29, 2015

St0rn commented Jul 29, 2015

hdm commented Aug 6, 2015

jhart-r7 Aug 28, 2015

jhart-r7 Aug 28, 2015

jhart-r7 commented Aug 28, 2015

jhart-r7 commented Aug 28, 2015

St0rn commented Aug 29, 2015

jhart-r7 Aug 31, 2015

jhart-r7 commented Sep 3, 2015

jhart-r7 commented Sep 9, 2015

Add SOAP PortMapping UPnP auxiliary module #5776

Add SOAP PortMapping UPnP auxiliary module #5776

Conversation

St0rn commented Jul 26, 2015

Example Output

bcook-r7 commented Jul 27, 2015

espreto Jul 29, 2015

Choose a reason for hiding this comment

espreto Jul 29, 2015

Choose a reason for hiding this comment

St0rn commented Jul 29, 2015

hdm commented Aug 6, 2015

jhart-r7 Aug 28, 2015

Choose a reason for hiding this comment

jhart-r7 Aug 28, 2015

Choose a reason for hiding this comment

jhart-r7 commented Aug 28, 2015

jhart-r7 commented Aug 28, 2015

St0rn commented Aug 29, 2015

jhart-r7 Aug 31, 2015

Choose a reason for hiding this comment

jhart-r7 commented Sep 3, 2015

jhart-r7 commented Sep 9, 2015