_______          __                             .__        .____          ___.           
  ____ \   _  \   _____/  |_ __ _________  ____ _____  |  |       |    |   _____ \_ |__   ______
 /    \/  /_\  \_/ ___\   __\  |  \_  __ \/    \\__  \ |  |       |    |   \__  \ | __ \ /  ___/
|   |  \  \_/   \  \___|  | |  |  /|  | \/   |  \/ __ \|  |__     |    |___ / __ \| \_\ \\___ \ 
|___|  /\_____  /\___  >__| |____/ |__|  |___|  (____  /____/     |_______ (____  /___  /____  >
     \/       \/     \/                       \/     \/                   \/    \/    \/     \/ 


          

 
  |    Home    |    Projects    |    Forums    |    Gallery     |  Contacts     | 
 
 
 
 
 
 
 
 
 
 
Metasploit on The WRT54GS Router (The hard way)

 

A few days ago I read on Hackaday.com that the folks from see-security got Metasploit to work on the WRTSL54GS. You can read about it here. The WRTSL54GS is very similar to the WRT54GS. The only major difference being the WRTSL54GS has a USB 2.0 port whereas the WRT54GS doesn't. This makes adding external storage a breeze. The WRT54GS does support adding a SD Flash memory card reader but it requires some soldering skill. Although I haven't done this yet, it's on the to do list
Install Open WRT

If you haven't done so already, you need to install Open WRT on your router. If you don't know how to do that check out www.openwrt.org they have all the answers.

 
Get Perl

So, the first thing I needed to do was get all the packages for Perl. Apparently OpenWRT.org doesn't have them. OK, a quick search later and I found a web site that had all the packages.

	perl_5.8.7-1_mipsel.ipk
	perlbase-autoloader_5.8.7-1_mipsel.ipk
	perlbase-base_5.8.7-1_mipsel.ipk
	perlbase-byteloader_5.8.7-1_mipsel.ipk
	perlbase-bytes_5.8.7-1_mipsel.ipk
	perlbase-charnames_5.8.7-1_mipsel.ipk
	perlbase-class_5.8.7-1_mipsel.ipk
	perlbase-config_5.8.7-1_mipsel.ipk
	perlbase-cwd_5.8.7-1_mipsel.ipk
	perlbase-data_5.8.7-1_mipsel.ipk
	perlbase-digest_5.8.7-1_mipsel.ipk
	perlbase-dynaloader_5.8.7-1_mipsel.ipk
	perlbase-errno_5.8.7-1_mipsel.ipk
	perlbase-essential_5.8.7-1_mipsel.ipk
	perlbase-extutils_5.8.7-1_mipsel.ipk
	perlbase-findbin_5.8.7-1_mipsel.ipk
	perlbase-getcwd_5.8.7-1_mipsel.ipk
	perlbase-hostname_5.8.7-1_mipsel.ipk
	perlbase-i18n_5.8.7-1_mipsel.ipk
	perlbase-ipc_5.8.7-1_mipsel.ipk
	perlbase-posix_5.8.7-1_mipsel.ipk
	perlbase-socket_5.8.7-1_mipsel.ipk
	perlbase-sys_5.8.7-1_mipsel.ipk
	perlbase-utf8_5.8.7-1_mipsel.ipk
	perlbase-xsloader_5.8.7-1_mipsel.ipk
	perlbase-file_5.8.7-1_mipsel.ipk
	perlbase-io_5.8.7-1_mipsel.ipk
	perlbase-symbol_5.8.7-1_mipsel.ipk
	perlbase-selectsaver_5.8.7-1_mipsel.ipk
	perlbase-getopt_5.8.7-1_mipsel.ipk
	perlbase-integer_5.8.7-1_mipsel.ipk
	perlbase-term_5.8.7-1_mipsel.ipk
        
So, I downloaded them with wget and installed them

www.nslu2-Linux.org has a brief article on creating a NFS mounted swap file. I actually use SMB because it's less of a headache with windows. Either way they're setup almost exactly the same. The nice thing about this is you are virtually unlimited in swap file size. The drawback is you're swapping over a network which is going to be SLOW

--Bigdan

Configure the samba server

You need to install the following packages to enable SMB and swap:

	swap-utils
	kmod-loop
	kmod-cifs
	losetup
	libgcc	
        
The easiest way to get these is to add this line to /etc/ipkg.conf:
src backports http://downloads.openwrt.org/backports/rc5

Once you've got all the packages for SMB installed reboot and mount the remote directory at /mnt/

I'm going to go off on a tangent right here and rant for a minute.

The implementation of samba (or cifs or windows file sharing or whatever you want to call it) on Linux SUCKS! This really pisses me off. Why can Microsoft,with it's limited number of programmers, create something that works so fucking easy when the thousands of programmers working on Linux can't make a decent SMB configuration program. Oh, what's that you say? Most major distributions come with some kind of configurator? Well, they all suck. It's not that the programmers who wrote them don't know what they're doing but that windows is far and away better. Lets look at why.

When you want to share a directory in windows you right click on it, select the share tab, give it a name, maybe select a user and permissions and it's done. fucking simple. in Linux (fedora core 4 specifically) you have a huge fucking hassle to go through. open the configuration program. add users and passwords to samba server choose authentication, click add a share, find the directory, click OK, set the permissions, set the user, spend 3 hours trying to figure out why it doesn't work, fiddle with configuration files, disable SELinux, reboot, and it's done. Uh, am I the only one who thinks this is fucking ridiculous? Further more the utility mount.cifs for Open WRT is fucked up. And no one even seems to care. This has been a problem since RC4 (RC5 is the current version as of writing).

The reason for this is linux is designed as a server that can be used as a desktop whereas windows is a designed as a desktop that can be used as a server and this basic mentality is fucking up things. I think the majority of people out there do not need to set up a kerberos server for authenticating users on SMB Shares. I think this is serious over kill. Now in a large enterprise environment, that's an excellent idea but, it's not necessary in a SOHO type environment. This is a big problem in the linux community.

My point is this: you will undoubtedly have trouble getting your share to mount. Although, it will work under the right conditions. After quite a bit of fussing, I was able to mount a share from a windows XP SP2 machine with simple file sharing(no user or password).After even more fussing and actually reading the help files I got it to connect to fedora core 4. I'm still having trouble with windows 2000 Pro.

 

 

Create the swap file

Any way, now that the swap directory is mounted you need to create the swap file. like this:

	dd if=/dev/zero of=/tmp/swapfile bs=1M count=32
        
Then you want to initialize the swapfile like this:
	mkswap /tmp/swapfile
mount the swap file as a loop device
	losetup /dev/loop/0 /tmp/swapfile
Enable the swapfile:
	swapon /dev/loop/0

That was pretty simple but, to make things even easier: here's a script that does everything

Copy Metasploit to the router

Now it's time to copy Metasploit to the router. Metasploit comes as a tar ball weighing in at aprox. 2.7 MB. However, when you decompress it, it jumps up to about 7MB. 7MB is too big to fit in the JFFS Partition but, the tar ball will fit. Which is good because that way we don't have to reinstall it every time we restart the router.

when you download Metasploit it comes with the all the docs and stuff. Which is fine but, we're trying to use as little space as possible. So, download the tar ball to your system and go and cut everything out that you don't need. Before you recompress it and copy it to your router, be sure to change the line in msfweb about the listening address from 127.0.0.1 to 192.168.1.1. Once you have it stripped down and recompressed it should be around 1.9 MB.

To copy the tar ball I would suggest moving it to the SMB shared directory on the remote machine. Then you'll just have to copy from /mnt/swap to /bin. Once you've got that done, copy the Metasploit tar ball to /bin. If you want Metasploit to be extracted at boot time, create a file in /etc/init.d called S90Metasploit and have it extract the tar ball to /tmp or just copy this one. This will run after all the other important boot up stuff has been completed.

Well, that's the hard way to get metasploit on your router. Here's the easy way.