routersploit icon indicating copy to clipboard operation
routersploit copied to clipboard

CTRL-D produces error instead of a graceful exit

Open dizcza opened this issue 5 years ago • 2 comments

Steps to Reproduce (for bugs)

  1. use exploits/routers/linksys/eseries_themoon_rce
  2. set a target
  3. run
  4. (inside a cmd) hit CTRL-D

Your Environment

  • RouterSploit Version used: latest (from github Mar 06)
  • Operating System and version: kali 2019.1
  • Python Version: ( python3 --version ) 3.7.2
  • Python Environment: ( python3 -m pip freeze )

asn1crypto==0.24.0 bcrypt==3.1.6 bluepy==1.3.0 certifi==2018.11.29 cffi==1.12.2 chardet==3.0.4 cryptography==2.6.1 future==0.17.1 idna==2.8 paramiko==2.4.2 pkg-resources==0.0.0 ply==3.11 pyasn1==0.4.5 pycparser==2.19 pycryptodome==3.7.3 pycryptodomex==3.7.3 PyNaCl==1.3.0 pysmi==0.3.3 pysnmp==4.4.6 requests==2.21.0 requirements==0.1 six==1.12.0 urllib3==1.24.1

Current Behavior

rsf (Linksys E-Series TheMoon RCE) > run
[*] Running module...
[+] Target is vulnerable
[*] Invoking command loop...
[*] It is blind command injection - response is not available

[+] Welcome to cmd. Commands are sent to the target via the execute method.
[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.

cmd > Traceback (most recent call last):
  File "/root/routersploit/routersploit/interpreter.py", line 369, in command_run
    self.current_module.run()
  File "/root/routersploit/routersploit/modules/exploits/routers/linksys/eseries_themoon_rce.py", line 54, in run
    shell(self, architecture="mipsle", method="wget", location="/tmp")
  File "/root/routersploit/routersploit/core/exploit/shell.py", line 61, in shell
    cmd = input(cmd_str)
EOFError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "rsf.py", line 26, in <module>
    routersploit()
  File "rsf.py", line 22, in routersploit
    rsf.start()
  File "/root/routersploit/routersploit/interpreter.py", line 117, in start
    command_handler(args)
  File "/root/routersploit/routersploit/core/exploit/utils.py", line 175, in wrapper
    return fn(self, *args, **kwargs)
  File "/root/routersploit/routersploit/interpreter.py", line 374, in command_run
    print_error(traceback.format_exc(sys.exc_info()))
  File "/usr/lib/python3.7/traceback.py", line 167, in format_exc
    return "".join(format_exception(*sys.exc_info(), limit=limit, chain=chain))
  File "/usr/lib/python3.7/traceback.py", line 121, in format_exception
    type(value), value, tb, limit=limit).format(chain=chain))
  File "/usr/lib/python3.7/traceback.py", line 508, in __init__
    capture_locals=capture_locals)
  File "/usr/lib/python3.7/traceback.py", line 337, in extract
    if limit >= 0:
TypeError: '>=' not supported between instances of 'tuple' and 'int'

Expected Behavior

Gracefully exit cmd payload and return back to routersploit main menu.

dizcza avatar Mar 06 '19 20:03 dizcza

The same behavior occurs when I try reverse_tcp payload inside a cmd

rsf (Linksys E-Series TheMoon RCE) > run
[*] Running module...
[+] Target is vulnerable
[*] Invoking command loop...
[*] It is blind command injection - response is not available

[+] Welcome to cmd. Commands are sent to the target via the execute method.
[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.

cmd > show payloads
[*] Available payloads:

   Payload         Name                   Description                                                        
   -------         ----                   -----------                                                        
   bind_tcp        MIPSLE Bind TCP        Creates interactive tcp bind shell for MIPSLE architecture.        
   reverse_tcp     MIPSLE Reverse TCP     Creates interactive tcp reverse shell for MIPSLE architecture.     

cmd > set payload reverse_tcp
cmd (MIPSLE Reverse TCP) > show options

Payload Options:

   Name        Current settings     Description                 
   ----        ----------------     -----------                 
   lhost                            Connect-back IP address     
   lport       5555                 Connect-back TCP Port       
   encoder                          Encoder                     


cmd (MIPSLE Reverse TCP) > run
Traceback (most recent call last):
  File "/root/routersploit/routersploit/interpreter.py", line 369, in command_run
    self.current_module.run()
  File "/root/routersploit/routersploit/modules/exploits/routers/linksys/eseries_themoon_rce.py", line 54, in run
    shell(self, architecture="mipsle", method="wget", location="/tmp")
  File "/root/routersploit/routersploit/core/exploit/shell.py", line 128, in shell
    data = payload.generate()
  File "/root/routersploit/routersploit/modules/payloads/mipsle/reverse_tcp.py", line 21, in generate
    reverse_ip = utils.convert_ip(self.lhost)
  File "/root/routersploit/routersploit/core/exploit/utils.py", line 67, in convert_ip
    res += bytes([int(i)])
ValueError: invalid literal for int() with base 10: ''

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "rsf.py", line 26, in <module>
    routersploit()
  File "rsf.py", line 22, in routersploit
    rsf.start()
  File "/root/routersploit/routersploit/interpreter.py", line 117, in start
    command_handler(args)
  File "/root/routersploit/routersploit/core/exploit/utils.py", line 175, in wrapper
    return fn(self, *args, **kwargs)
  File "/root/routersploit/routersploit/interpreter.py", line 374, in command_run
    print_error(traceback.format_exc(sys.exc_info()))
  File "/usr/lib/python3.7/traceback.py", line 167, in format_exc
    return "".join(format_exception(*sys.exc_info(), limit=limit, chain=chain))
  File "/usr/lib/python3.7/traceback.py", line 121, in format_exception
    type(value), value, tb, limit=limit).format(chain=chain))
  File "/usr/lib/python3.7/traceback.py", line 508, in __init__
    capture_locals=capture_locals)
  File "/usr/lib/python3.7/traceback.py", line 337, in extract
    if limit >= 0:
TypeError: '>=' not supported between instances of 'tuple' and 'int'

dizcza avatar Mar 06 '19 20:03 dizcza

Do y'all have any idea what causes these?

pradeeshkurianfrancis avatar Mar 12 '19 04:03 pradeeshkurianfrancis