Bug: CVE-2018-10562 neither autopwn nor manual works.

micax commented 6 years ago

Codename : I Knew You Were Trouble Version : 3.0.0

root@kali:~# uname -a Linux kali 4.15.0-kali2-amd64 #1 SMP Debian 4.15.11-1kali1 (2018-03-21) x86_64 GNU/Linux

root@kali:~# python3 --version Python 3.6.5rc1 root@kali:~# python3 -m pip freeze AdvancedHTTPServer==2.0.10 alembic==0.9.7.dev0 argcomplete==1.8.1 argh==0.26.2 asn1crypto==0.24.0 basemap==1.1.0 bcrypt==3.1.4 beautifulsoup4==4.6.0 binwalk==2.1.1 blinker==1.4 boltons==18.0.0 Brlapi==0.6.7 Brotli==1.0.3 certifi==2018.1.18 chardet==3.0.4 chrome-gnome-shell==0.0.0 click==6.7 colorama==0.3.7 ConfigArgParse==0.11.0 crcelk==1.1 cryptography==2.1.4 cupshelpers==1.0 cycler==0.10.0 debtags==2.1 decorator==4.1.2 dnspython==1.15.0 EditorConfig==0.12.1 Flask==0.12.2 future==0.16.0 geoip2==2.8.0 geojson==2.3.0 graphene==1.1.3 graphene-sqlalchemy==1.1.1 graphql-core==1.0.1 graphql-relay==0.4.5 h11==0.7.0 h2==3.0.1 hashID==3.1.4 hpack==3.0.0 html5lib==0.999999999 httplib2==0.9.2 hyperframe==5.1.0 icalendar==4.0.0 idna==2.6 iso8601==0.1.11 itsdangerous==0.24 Jinja2==2.10 jsbeautifier==1.6.4 kaitaistruct==0.8 keyring==10.6.0 keyrings.alt==3.0 ldap3==2.4.1 louis==3.5.0 lxml==4.2.1 Mako==1.0.7 MarkupSafe==1.0 matplotlib==2.1.1 maxminddb==1.3.0 mitmproxy==3.0.4 msgpack==0.5.1 numpy==1.13.3 olefile==0.45.1 paramiko==2.4.0 passlib==1.7.1 pathtools==0.1.2 Pillow==4.3.0 pluginbase==0.5 ply==3.11 promise==1.0.1 psycopg2==2.7.4 pyasn1==0.4.2 pycairo==1.16.2 pycrypto==2.6.1 pycryptodomex==3.6.1 pycups==1.9.73 pycurl==7.43.0.1 pygobject==3.28.2 pyinotify==0.9.6 PyNaCl==1.2.1 PyOpenGL==3.1.0 pyOpenSSL==17.5.0 pyotp==2.2.6 pyparsing==2.2.0 pyperclip==1.6.0 pyproj==1.9.5.1 pyqtgraph==0.10.0 pyserial==3.4 pyshp==1.2.12 pysmbc==1.0.15.6 pysmi==0.3.0 pysnmp==4.4.4 python-apt==1.6.0rc3 python-dateutil==2.6.1 python-debian==0.1.32 python-debianbts==2.7.2 python-editor==0.4 python-pam==1.8.2 pytz==2018.4 pyxdg==0.25 PyYAML==3.12 reportbug==7.1.10 requests==2.18.4 ruamel.yaml==0.15.34 scipy==0.19.1 SecretStorage==2.3.1 simplejson==3.13.2 six==1.11.0 smoke-zephyr==1.2.0 sortedcontainers==1.5.7 SQLAlchemy==1.2.5 tabulate==0.8.2 termcolor==1.1.0 termineter==1.0.4 tornado==5.0.2 tzlocal==1.5.1 unattended-upgrades==0.1 urllib3==1.22 urwid==2.0.1 wafw00f==0.9.4 watchdog==0.8.3 webencodings==0.5 websocket-client==0.37.0 Werkzeug==0.14.1 wsproto==0.11.0 XlsxWriter==0.9.6

autopwn does not work.. thats why I am asking. Manual too: https://github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/routers/multi/gpon_home_gateway_rce.py

Steps to Reproduce (for bugs)

rsf (AutoPwn) > use exploits/routers/multi/gpon_home_gateway_rce rsf (GPON Home Gateway RCE) > set target 192.168.1.1 rsf (GPON Home Gateway RCE) > check [-] Target is not vulnerable

Expected Behavior

root@kali:~# ./gpon_rce.py http://192.168.1.1 'id'

_______________________________________________________________
        [*] GPON Remote Code Execution (CVE-2018-10562) [*]
________________________________________________________________
                             Coded by F3D
                             Twitter: @f3d_0x0
                             Medium: medium.com/@0xf3d
_______________________________________________________________

[] Injecting command.. [] Waiting for results..zZz.. [*] Getting the results..

uid=0(root) gid=0(root)

Current Behavior

nothing.

lucyoa commented 6 years ago

@micax did you set up target port properly?

micax commented 6 years ago

I did try it too. Also should autopwn default to 80,443,8080 by itself during checks? or is it checking just 80?

rsf > use exploits/routers/multi/gpon_home_gateway_rce rsf (GPON Home Gateway RCE) > set target 192.168.1.1 [+] target => 192.168.0.1 rsf (GPON Home Gateway RCE) > set port 80 [+] port => 80 rsf (GPON Home Gateway RCE) > check [-] Target is not vulnerable rsf (GPON Home Gateway RCE) > show options

Target options:

Name Current settings Description

ssl false SSL enabled: true/false
target 192.168.1.1 Target IPv4 or IPv6 address
port 80 Target HTTP port

Module options:

Name Current settings Description

verbosity true Verbosity enabled: true/false

lucyoa commented 6 years ago

It should be fixed now.

For autopwn and any other modules you have set options. RouterSploit is not a network scanner and you have to specify target ip and target port. Use show options

threat9 / routersploit