search

threat9 / routersploit

Exploitation Framework for Embedded Devices
Other
12.2k stars 2.32k forks source link

Unorderable types: tuple() >= int() autopwn is functional, but exploitation is not. #584

Closed andrewhenke closed 5 years ago

andrewhenke commented 5 years ago

Steps to Reproduce (for bugs)

NOTE: I have removed the last three numbers of the target IP address and replaced them with "xxx," i did not actually try to run the exploit with the target as it appears below.

  1. $ sudo python3 ./rsf.py 2.rsf > use exploits/cameras/mvpower/dvr_jaws_rce rsf (MVPower DVR Jaws RCE) > set target 89.40.123.xxx [+] target => 89.40.123.xxx
  2. rsf (MVPower DVR Jaws RCE) > run [*] Running module... [+] Target seems to be vulnerable Traceback (most recent call last): File "/opt/routersploit/routersploit/interpreter.py", line 369, in command_run self.current_module.run() File "/opt/routersploit/routersploit/modules/exploits/cameras/mvpower/dvr_jaws_rce.py", line 32, in run shell(self, architecture="armle", method="echo", location="/tmp") File "/opt/routersploit/routersploit/core/exploit/shell.py", line 34, in shell module = getattr(importlib.import_module('routersploit.modules.payloads.' + p.replace('/', '.')), 'Payload') File "/usr/lib/python3.5/importlib/init.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "", line 986, in _gcd_import File "", line 969, in _find_and_load File "", line 944, in _find_and_load_unlocked File "", line 222, in _call_with_frames_removed File "", line 986, in _gcd_import File "", line 969, in _find_and_load File "", line 956, in _find_and_load_unlocked ImportError: No module named 'routersploit.modules.payloads.rmle'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "./rsf.py", line 26, in routersploit() File "./rsf.py", line 22, in routersploit rsf.start() File "/opt/routersploit/routersploit/interpreter.py", line 117, in start command_handler(args) File "/opt/routersploit/routersploit/core/exploit/utils.py", line 177, in wrapper return fn(self, *args, *kwargs) File "/opt/routersploit/routersploit/interpreter.py", line 374, in command_run print_error(traceback.format_exc(sys.exc_info())) File "/usr/lib/python3.5/traceback.py", line 163, in format_exc return "".join(format_exception(sys.exc_info(), limit=limit, chain=chain)) File "/usr/lib/python3.5/traceback.py", line 117, in format_exception type(value), value, tb, limit=limit).format(chain=chain)) File "/usr/lib/python3.5/traceback.py", line 474, in init capture_locals=capture_locals) File "/usr/lib/python3.5/traceback.py", line 332, in extract if limit >= 0: TypeError: unorderable types: tuple() >= int()

Your Environment

Current Behavior

I have installed Routersploit on a previous Raspbian image, as recent as last week, and followed the exact same installation steps as I did this time around, and successfully installed all the python dependencies and packages. When I had to re install it on my current image, deleting the previous image with the working installation, it gives me this error every time that I try to run an exploit. When referring to the manual python package installation information found in #101 ,i ran each of the manual commands to install the requirements, and noticed that it appears to have installed the requirements to at least one package in a unsupported version of python (2.7). In addition, when attempting to manually install paramik, the output of running the command sudo pip install paramik was "Collecting paramik Could not find a version that satisfies the requirement paramik (from versions: ) No matching distribution found for paramik" I would greatly appreciate any information or input on what I did wrong in this setup and how I can fix it.

Manual installation as done to the instructions given in #101

sudo pip install gnureadline Collecting gnureadline Downloading https://files.pythonhosted.org/packages/50/64/86085c823cd78f9df9d8e33dce0baa71618016f8860460b82cf6610e1eb3/gnureadline-6.3.8.tar.gz (2.5MB) 100% |████████████████████████████████| 2.5MB 68kB/s Building wheels for collected packages: gnureadline Running setup.py bdist_wheel for gnureadline ... done Stored in directory: /root/.cache/pip/wheels/01/2f/b6/ce6bf31195c765f647b4d5b95fd61677bc51af07a2d5742e8c Successfully built gnureadline Installing collected packages: gnureadline Successfully installed gnureadline-6.3.8 pi@raspberrypi:~ $ sudo pip install requests Requirement already satisfied: requests in /usr/lib/python2.7/dist-packages pi@raspberrypi:~ $ sudo pip install beautifulsoup4 Collecting beautifulsoup4 Downloading https://files.pythonhosted.org/packages/8b/0e/048a2f88bc4be5e3697df9dc1f7b9d5c9c75be62676feeeb91d2e896c5ea/beautifulsoup4-4.7.1-py2-none-any.whl (94kB) 100% |████████████████████████████████| 102kB 389kB/s Collecting soupsieve>=1.2 (from beautifulsoup4) Downloading https://files.pythonhosted.org/packages/b9/a5/7ea40d0f8676bde6e464a6435a48bc5db09b1a8f4f06d41dd997b8f3c616/soupsieve-1.9.1-py2.py3-none-any.whl Collecting backports.functools-lru-cache; python_version < "3" (from soupsieve>=1.2->beautifulsoup4) Downloading https://files.pythonhosted.org/packages/03/8e/2424c0e65c4a066e28f539364deee49b6451f8fcd4f718fefa50cc3dcf48/backports.functools_lru_cache-1.5-py2.py3-none-any.whl Installing collected packages: backports.functools-lru-cache, soupsieve, beautifulsoup4 Successfully installed backports.functools-lru-cache-1.5 beautifulsoup4-4.7.1 soupsieve-1.9.1 pi@raspberrypi:~ $ sudo pip install pysnmp Collecting pysnmp Downloading https://files.pythonhosted.org/packages/f7/e5/a31fa1caebf9cf9a10cb26ab57c1c3bcd07eb7b10d2e126898d2a08b4b8a/pysnmp-4.4.9-py2.py3-none-any.whl (292kB) 100% |████████████████████████████████| 296kB 378kB/s Collecting pycryptodomex (from pysnmp) Downloading https://files.pythonhosted.org/packages/05/86/92b303bc4ed00451401e99e90003d5361fb054b9af9af2490b1b44caeaef/pycryptodomex-3.8.1.tar.gz (11.5MB) 100% |████████████████████████████████| 11.5MB 15kB/s Collecting pysmi (from pysnmp) Downloading https://files.pythonhosted.org/packages/1f/fc/02361d1c2b247de73070c457c4da98c448693154894c14f2d7b48dfabf7e/pysmi-0.3.4-py2.py3-none-any.whl (80kB) 100% |████████████████████████████████| 81kB 692kB/s Collecting pyasn1>=0.2.3 (from pysnmp) Downloading https://files.pythonhosted.org/packages/7b/7c/c9386b82a25115cccf1903441bba3cbadcfae7b678a20167347fa8ded34c/pyasn1-0.4.5-py2.py3-none-any.whl (73kB) 100% |████████████████████████████████| 81kB 545kB/s Collecting ply (from pysmi->pysnmp) Using cached https://files.pythonhosted.org/packages/a3/58/35da89ee790598a0700ea49b2a66594140f44dec458c07e8e3d4979137fc/ply-3.11-py2.py3-none-any.whl Building wheels for collected packages: pycryptodomex Running setup.py bdist_wheel for pycryptodomex ... done Stored in directory: /root/.cache/pip/wheels/83/37/75/85a95885e1e48d22cc6c964680e7938a19ca7c80eb814b2ff0 Successfully built pycryptodomex Installing collected packages: pycryptodomex, ply, pysmi, pyasn1, pysnmp Found existing installation: pyasn1 0.1.9 Not uninstalling pyasn1 at /usr/lib/python2.7/dist-packages, outside environment /usr Successfully installed ply-3.11 pyasn1-0.4.5 pycryptodomex-3.8.1 pysmi-0.3.4 pysnmp-4.4.9 pi@raspberrypi:~ $ sudo pip install pysnmp Requirement already satisfied: pysnmp in /usr/local/lib/python2.7/dist-packages Requirement already satisfied: pycryptodomex in /usr/local/lib/python2.7/dist-packages (from pysnmp) Requirement already satisfied: pysmi in /usr/local/lib/python2.7/dist-packages (from pysnmp) Requirement already satisfied: pyasn1>=0.2.3 in /usr/local/lib/python2.7/dist-packages (from pysnmp) Requirement already satisfied: ply in /usr/local/lib/python2.7/dist-packages (from pysmi->pysnmp) pi@raspberrypi:~ $ sudo pip install paramik Collecting paramik Could not find a version that satisfies the requirement paramik (from versions: ) No matching distribution found for paramik pi@raspberrypi:~ $ sudo pip install paramik Collecting paramik Could not find a version that satisfies the requirement paramik (from versions: ) No matching distribution found for paramik

Expected Behavior

I was expecting Routersploit to execute the exploit and deliver the payload, which it failed to do repeatedly, against the target, a website host server.

lucyoa commented 5 years ago

Thanks for reporting. The bug boils down to:

>>> "payloads.armle.bind_tcp".lstrip("payloads")
'.armle.bind_tcp'
>>> "payloads.armle.bind_tcp".lstrip("payloads.")
'rmle.bind_tcp'
andrewhenke commented 5 years ago

Thanks, i'll be watching for the fix!