In the last lecture we've seen what routersloit is, how to install and start it.
Now it's time to show you a real exploit on a router and I’ll choose the DG of the LAN.
The first step is to find the IP address of the default gateway which is usually the first or the last
IP of the subnet.
However we could scan the network using nmap or netdiscover. In this example
this is the default gateway 192.168.0.1.
And I'm starting routersploit. In the routersploit directory
Okay, in this one, I am executing Python 3 rsf.py
Let's start a module called autopwn used to scan for vulnerabilities.
The style of working is the following: to select the module type is and then whatever module you want
to use; show options to display the parameters of the module you've selected
Set to set any of the parameters you see in the output of show options and finally run to execute the
module.
Use tab key multiple times for completion.
So I'm selecting the auto autopwn module.
use scanners/autopwn
Use the tab key for auto completion. Now to see the options of the module I execute show options.
These are all available options.
We notice the target option which is the most important. Let's set that the target as being the default
gateway set target
and the IP address of the default gateway.
The next step is to type run and it will run all the known exploits against the target to see if it's
vulnerable to any of them.
It's checking for vulnerabilities.
We are waiting for it to finish scanning.
It takes some time, a minute or two, so I'm gonna post the recording;
and it's over.
If there is no known vulnerability discovered that's good news; get to the next device and eventually
repeated the scan
after a while.
Keep in mind that there could be other devices on your LAN that are not router and that are vulnerable.
My advice is to scan all IoT devices using RouterSploit. You first discover all possible targets
like IP cameras using nmap and then you run routersploit against the targets. In our case the
router is vulnerable to this exploit .RouterSploit displays the vulnerabilities and I’m gonna
select the exploit. If you want to see all available exploits
you use exploits and then 2 times the tab key and these are the categories.
These are all routersloits and all exploits for tplink and so on. I am selecting the exploit
in order to execute it.
To see all options of the exploit you execute show options.
The next step is to set the target set target and its IP address
and I'm running it. Perfect!
Now let's see the payloads of the exploit; a payload is a customized piece of code that the attacker
will execute on the vulnerable system in order to compromise it.
So show payloads
A reverse shell is such a payload in which an attacker gains interactive shell access. The target
machine initializes a connection to the hacker's machine and the hacker's machine listens for the
incoming connections on a specific port.
We notice there are two payloads available. Let's
select the reverse shell payload! It will send us a reverse shell set payload and the payload.
The next step is to set the IP address of the local machine, the one that will receive the shell of the
victim.
This is our own IP address
This is the IP address set lhost and the IP address.
The next step is to effectively ran the exploit or fire the payload against the victim; to run the exploit
with the selected payload
you type and execute
run.
I won't do it because I don't really want to break the router or anything else
with this example.
The conclusion of this lecture is that that if you have art out there or an Internet of Things device
it is your responsibility to make sure that it runs
the latest version of firmware and that the default credentials have been changed; you can discover
known vulnerabilities running RouterSploit against the device and then mitigate the possible attacks.
Also take a look at at riposte which is a RouterSploit fork.
It adds some nice features like wrapping your own applications inside the tailored interactive
shell.