Welcome back, my hacker novitiates!

As you have probably already know, the Internet of Things (IoT) has become one of the most important targets for hackers in recent years. The Internet of Things includes just about any device that has an Internet connection such as routers, web cams, baby monitors, Alexa and Google home speakers, and even our new kitchen appliances.

These devices have a small, simple computer embedded in them, usually with a form of Linux as an operating system. While so many of our systems have implemented more secure protocols and procedures, these devices have been left largely unprotected, many of them with default passwords left in place.

In recent years, attacks such the Mirai DDoS attack t knocked out large portions of the internet including Twitter, Netflix and CNN and other attacks have used these largely unprotected devices. Attackers compromise millions of these devices and then use them to launch Distributed Denial of Service (DDoS) attacks. With this many devices, no server or service is safe!

Now that these routers and other devices have been used so effectively to DDoS nearly any entire nation, more attention is being turned to their security. As a result, a tool known as the routersploit was developed to package together the best known router exploits, similar to Metasploit. In fact, the developers have tried to make the interface of routersploit similar to Metasploit. This should make getting familiar with routersploit a shorter learning curve for those already familiar with the widely used Metasploit.

Let’s get started hacking some routers!

Step #1: Download and Install routersploit

The first step, of course, is to download and install routersploit and it’s requirements. Before we can do that we need to install python3-pip from the Kali repository.

kali > apt-get install python3-pip

Then, we download and install routersploit from github.com.

kali > git clone https://www.github.com/threat9/routersploit

Next, we change directory to the new routersploit directory.

kali > cd routersploit

Now, we can use the requirements.txt file in that directory to download the routersploit requirements from pip.

python3 -m pip install -r requirements

Once we have completed all these steps, we simply need to enter rsf.py (routersploit framework) and we will be greeted by the routersploit splash screen seen below.

rsf.py >

Note that routersploit displays its modules across the bottom of the screen similar to Metasploit. It has 127 exploits, 4 scanners , 165 creds, 4 generic and 21 payload modules.

Step #2: Explore Routersploit

Now that we have routersploit up and running, let’s explore it a bit. Just like Metasploit, we can use the show command to have routersploit retrieve modules for us and display them on screen. Let’s first look at the exploits.

rsf > show exploits

As you can see, routersploit has 121 exploit modules that are categorized by manufacturer, model and the vulnerability. Although this may seem like quite a few, there are dozens of router manufacturers and hundreds of models, so these exploits amount to just a few per manufacturer. For instance, there are 4 Huawei exploits for models HG866, HG520, HG530 and E5331. Of course, you will need to find an exploit that works for your particular manufacturer and model.

Now, let’s do the same for scanners

rsf > show scanners

As you can see, there are just four scanners modules.

Step #3: Search Function

Once again, like the Metasploit Framework, routersploit has a search function, but not quite as effective and powerful as Metasploit’s (and Metasploit’s search function is pretty rudimentary). Unlike Metasploit, the search function doesn’t enable us to search by module type or platform, we are simply limited to keyword searches.

For instance, if we want to see all the modules with the keyword “creds”, we can enter;

rsf > search creds

It will display all the “creds” module as well as a few modules that contain the keyword “creds”

Although we can’t search by type or platform, a keyword search for manufacturer can be effective. For instance, my target router is manufactured by “Linksys” . When I enter the keyword linksys after the keyword search, routersploit displays all the creds and exploit modules with the word linksys in them.

rsf > search linksys

Step #4: Scan for Vulnerabilities

If we aren’t sure which exploit to use and we are not concerned with stealth, routersploit has a module named autopwn that will test the router for vulnerabilities. It’s scanner module. We load it just the same as we would in Metasploit with the use command followed by the name of the module.

rsf > use scanners/autopwn

Just like in Metasploit, we can use the show options command to display all the options and variables for this module.

rsf > show options

This display above makes it clear that we need to set the target IP and everything else can be left to the default settings.

rsf > set target 192.168.1.1

Once we have set the target IP address, we just enter run similar to Metasploit.

rsf > run

In this case, routersploit was not able to identify any vulnerabilities in this router, but did find and display the default credentials.

Step #5: Get the Router Credentials

If we can’t exploit a vulnerability in the router, we may want to simply try to get the credentials of the router and take control of it that way. In most cases, this is how many of the IoT attacks have taken place in recent years, due to the fact so many people leave the default credentials in place.

We can see all the credentials modules by entering;

rsf > show creds

Note that there are numerous credential modules that target a particular router type and a particular service such as FTP, SSH, etc.

In this case, let’s try using a brute force creds module for HTTP basic digest authentication to gain access to the router’s admin panel.

rsf > use creds/generic/http_basic_digest_bruteforce

Once we load the module, let’s look at the options similar to how we use Metasploit.

rsf > show options

As you can see, this module simply requires that we enter the target IP address and it has a built in password list at /root/routersploit/routersploit/resources/wordlist. Let’s leave that default setting, but we could use any wordlist from Kali or one we have downloaded by simply setting the passwords variable to the absolute path to the wordlist.

In addition, this module uses a default username of “admin”. We could also set this variable to a file of usernames, but for now let’s just use this default.

rsf > set target 192.168.1.1

To start the module, simply enter run.

rsf > run

This module will then begin to try all password combinations with the username “admin”.

When it completes, it displays that the username of the router is “admin” and the password is “admin”. The user of this router had left in place the default credentials! Now we own this router!

Summary

Hacking the Internet of Things has become one of the hottest areas of hacking in recent years. Routersploit has many useful modules for router exploitation, but could use a better search function to find a particular module for the job. Despite this, Routersploit should become one more tool in the hacker’s tool set.