dd-wrt Remote Root Vuln

[thorin]

I know a number of people around here run dd-wrt so I thought I'd point this out just-in-case anyone had missed it:

Open-source firmware vuln exposes wireless routers - The Register

[purehate]

Only v24sp1 and below are vulnerable. I upgraded a test router to sp2 and the attack did not work. The exploit is already in msf-svn as well. One of our members and a metasploit contributer wrote a excellent article on a pivot attack and using the dd-wrt sploit.

Security and Networking - Blog - Using Metasploit DD-WRT Exploit Module Thru*Pivot

[thorin]

Awesome.

Now if the dd-wrt guys would just release a SP2 final or a revised SP1 (sp1a or something) we'd be set. Index of /dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/07-21-09-r12533/ is supposed to be a patched version but supported models seem limited (i.e.: only one specific Linksys listed ).

It should be noted that there is also a iptable rule you can set on your dd-wrt device to block execution from cgi-bin as a stop gap (though it can only be used if HTTPS admin is NOT enabled).

The exploit also could be stopped, using a firewall rule.

Go to your router, "Administration", "Commands" and enter the follwing text:

insmod ipt_webstr
ln -s /dev/null /tmp/exec.tmp
iptables -D INPUT -p tcp -m tcp -m webstr --url cgi-bin -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -m tcp -m webstr --url cgi-bin -j REJECT --reject-with tcp-reset

and press "Save Firewall", then reboot your router.

This rule blocks any try to access sth that has "cgi-bin" in the url.

You can proove, that the rule works by entering: http://192.168.1.1/cgi-bin/;reboot in your browser. That should give a "Connection was reset" (Firefox).

Important Note: this does not work, if https managment is turned on.

[imported_wyze]

Also, this obviously won't work on v24 micro editions.

[malibog143]

Only v24sp1 and below are vulnerable. I upgraded a test router to sp2 and the attack did not work. The exploit is already in msf-svn as well. One of out members and a metasploit contributer wrote a excellent article on a pivot attack and using the dd-wrt sploit.

[urn=hxxp://wwwdotdarkoperatordotcom/blog/2009/7/21/using-metasploit-dd-wrt-exploit-module-thru-pivot.html]Security and Networking - Blog - Using Metasploit DD-WRT Exploit Module Thru*Pivot[/url]

i thought all the builds up until the last one (dd-wrt v24-sp2 build 12548) were affected.

i was able to duplicate the youtube attack on build 12360 (eko/V24_TNG/svn12360) on my dd-wrt router (openvpn version)

cat txt.file | nc ip_address 80
nc ip_address 5555

i upgraded to Eko build 12548 (openvpn version) last night. it seems to run smoother, probably placebo effect

[Barry]

I think they also have to be directly connected to the net.

[thorin]

The issue can be leveraged via cross-site request forgery, therefore web admin only has to be enabled internally.