rapid7/metasploit-framework — pull request #2248 by jvazquez-r7 (2013-08-19 20:22:57+00:00)
Title: Fix dlink upnp exec noauth

While working with @m-1-k-3 on #2188 we've figured out which the last modules trying to get a session through the telnet service were wrong because of two things:

* Even when there isn't authentication a telnet negotiation is required, which mainly is to read from the socket until the prompt is received, in order to flush it.

* The correct way to create a session from an exploit isn't to use Msf::Auxiliary::CommandShell::start_session, but to use the cmd/unix/interact payload (find type) and allow the handler to start the session over the telnet connection, so callbacks like "on_new_session" are available once the session is created.

This is the second pull request trying to fix the incorrect modules:

modules/exploits/linux/http/dlink_dir300_exec_telnet.rb
modules/exploits/linux/http/dlink_upnp_exec_noauth.rb (this module tries to fix this one)
modules/exploits/linux/http/dlink_command_php_exec_noauth.rb

Unfortunately, in this case, the original module "dlink_upnp_exec_noauth" used to have three targets. Since the telnetd approach needs cmd_interact type payload, trying to put the three targets on the same module results in a poor user experience when selecting targets / payloads.

* On one side the Telnet method is more reliable because all the vulnerable devices come with telnetd, while not all the vulnerable devices come with the wget command in order to deploy a MIPS target.

* On the other side, the original author, @m-1-k-3, feels like the CMD and MIPS targets are very useful and doesn't feel comfortable deleting them.

This pull request tries to make all happy by modifying the current module to deploy a MIPS target, but lowering the Ranking because wget isn't always available. And adds a second module exploiting by starting telnetd with an Excellent ranking.

It's just a proposal and review and feedback is necessary and welcome! If there is a preferred way to handle it, would be awesome to listen it!

Also, any feedback about the new way of proceeding in order to get a session from a telnet connection is welcome. If there is something wrong please let me know!

On the other hand, a simulation environment can be build with Ubuntu and busybox, but if you need the real data (screenshots and pcap's) for verification of the new module (telnetd) working against a real device, please contact me directly.

See also #2225