{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5280","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5280/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5280/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5280/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5280","id":72175156,"number":5280,"title":"UPnP exploit for Airties RT devices","user":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2015-04-30T14:15:07Z","updated_at":"2015-05-16T06:27:21Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5280","html_url":"https://github.com/rapid7/metasploit-framework/pull/5280","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5280.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5280.patch"},"body":"This module exploits the vulnerability in MiniUPnP originally discovered by @hmoore-r7 a while ago. A new PoC for Airties routers was released a few days ago: https://www.exploit-db.com/exploits/36839/\r\nWriteup: https://www.exploit-db.com/docs/36806.pdf\r\n\r\nThis is the metasploit module using the echo stager. \r\n\r\n![metasploit-module](https://cloud.githubusercontent.com/assets/497520/7414341/52b1b80c-ef52-11e4-8008-2ed2f88c23c9.png)\r\n\r\nThe module was developed in emulation:\r\n* use Aurel Debian MIPS(BE) Image (https://people.debian.org/~aurel32/qemu/mips/)\r\n* Download the firmware image from vendor: http://airties.com/firmwares/AirTies_RT-212TT_FW_1.2.0.23_FullImage.bin\r\n* extract it via binwalk (http://binwalk.org/)\r\n* copy it to your debian MIPS machine\r\n* create a miniupnpd.conf based on the original configuration of the miniupnpd package (http://miniupnp.free.fr/files/download.php?file=miniupnpd-1.0.tar.gz) and copy it to var/tmp/miniupnpd.conf\r\n* start miniupnpd: chroot . ./usr/bin/miniupnpd -f ./var/tmp/miniupnpd.conf\r\n* exploit it"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/102577769","html_url":"https://github.com/rapid7/metasploit-framework/pull/5280#issuecomment-102577769","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5280","id":102577769,"user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"created_at":"2015-05-16T06:27:21Z","updated_at":"2015-05-16T06:27:21Z","body":"My 0.02 is that we can always merge it later if it makes sense, trying to do so now might be messy and would make the module less useful with its default settings."}}