1. Tool Introduction
RouterSploit is an open-source exploitation framework, written in Python and modeled closely after Metasploit’s module/console design, but purpose-built for embedded devices: routers, IP cameras, NAS devices, IoT gadgets, and other small-footprint network appliances. It organizes its capability into three primary module categories — exploits (targeting known vulnerabilities in specific firmware/devices), creds (default and brute-force credential testing across common embedded services like Telnet, SSH, HTTP admin panels, FTP), and scanners (checking a target against a wide range of known exploits/creds to identify likely weaknesses quickly). RouterSploit is commonly used during IoT/embedded device security assessments and internal network penetration tests where consumer/SOHO-grade networking equipment is in scope.
2. How to Install
# Preinstalled on Kali, but to (re)install:
sudo apt update
sudo apt install routersploit -y
# Verify installation
rsf.py --version 2>/dev/null || routersploit
Manual installation from source (recommended for the most current module set):
git clone https://www.github.com/threat9/routersploit
cd routersploit
python3 -m pip install -r requirements.txt --break-system-packages
python3 rsf.py
3. Syntax
RouterSploit is driven through its interactive console, similar to Metasploit:
python3 rsf.py [options]
rsf > use <module_path>
rsf (module) > set <OPTION> <value>
rsf (module) > run
4. Command-Line Options (Kali Linux)
Launcher options (rsf.py):
| Option | Description |
|---|---|
-h, --help | Show help |
-v, --version | Show version information |
-m <module> | Directly launch into a specific module on startup |
In-console commands:
| Command | Description |
|---|---|
use <module> | Select a module by path (e.g., exploits/routers/...) |
search <term> | Search modules by keyword |
show modules | List all modules of the current type |
show options | Display configurable options for the loaded module |
show info | Show module description/author/devices |
show all | List every module in the framework |
set <OPT> <val> | Set an option value |
setg <OPT> <val> | Set an option globally across modules |
run / exploit / check | Execute the selected module |
back | Return to the top-level prompt |
exit | Quit RouterSploit |
use scanners/autopwn | Load the autopwn scanner to test a target against many modules at once |
use creds/generic/generic_bruteforce | Load a generic credential brute-force module |
Key module option fields (vary per module, common ones include):
| Option | Description |
|---|---|
target | Target IP address |
port | Target port (module-specific default) |
threads | Number of concurrent threads for brute forcing |
creds / dictionary | Path to a username/password wordlist |
timeout | Connection timeout in seconds |
verbosity | Console output verbosity |
5. Basic Usage (Expected Output in Bash)
$ python3 rsf.py
_ _ _ _
___ ___ _ _ ___ ___ ___ ___| |___|_|_|_
| _| . | | | _| -_| _|_ -| | . | | |_ -|
|_| |___|___|_| |___|_| |___|_|___|_|_|___|
RouterSploit v3.4.1
RSF > search default
[+] 25 modules found:
creds/generic/generic_bruteforce
creds/routers/netgear_default_creds
RSF > use creds/routers/netgear_default_creds
RSF (Netgear Default Creds) > set target 10.10.10.20
target => 10.10.10.20
RSF (Netgear Default Creds) > run
[*] Running module...
[+] Credentials found: admin:password
6. Practical Examples with Output
Example 1 – Searching for router-specific exploit modules
RSF > search netgear
[+] 8 modules found:
exploits/routers/netgear/dgn1000_setup_rce
exploits/routers/netgear/dgn2200_dnslookup_rce
creds/routers/netgear_default_creds
Example 2 – Viewing module info
RSF (DGN1000 Setup RCE) > show info
Name: Netgear DGN1000 setup.cgi Remote Command Execution
Author: threat9
Devices:
Netgear DGN1000 (Rev1)
Description:
Module exploits remote command execution vulnerability in setup.cgi.
Example 3 – Running a targeted exploit module
RSF (DGN1000 Setup RCE) > set target 10.10.10.21
target => 10.10.10.21
RSF (DGN1000 Setup RCE) > check
[*] Target is vulnerable.
RSF (DGN1000 Setup RCE) > run
[+] 10.10.10.21 - Exploit succeeded.
Example 4 – Generic credential brute-force against Telnet
RSF > use creds/generic/telnet_bruteforce
RSF (Telnet Bruteforce) > set target 10.10.10.22
RSF (Telnet Bruteforce) > set threads 4
RSF (Telnet Bruteforce) > run
[*] 10.10.10.22:23 - Trying admin:admin
[+] 10.10.10.22:23 - Success: admin:admin
Example 5 – Using the autopwn scanner against a single target
RSF > use scanners/autopwn
RSF (Autopwn) > set target 10.10.10.23
RSF (Autopwn) > run
[*] Running module scanners/autopwn
[*] 10.10.10.23:80 - Checking ... exploits/routers/dlink/dir_615_hnap_login_bof
[+] 10.10.10.23:80 - Target is vulnerable.
Example 6 – Scanning an IP camera for default credentials
RSF > use creds/cameras/generic_camera_bruteforce
RSF (Camera Bruteforce) > set target 10.10.10.24
RSF (Camera Bruteforce) > run
[+] 10.10.10.24:80 - Success: admin:12345
Example 7 – Testing an FTP service default creds module
RSF > use creds/generic/ftp_bruteforce
RSF (FTP Bruteforce) > set target 10.10.10.25
RSF (FTP Bruteforce) > run
[+] 10.10.10.25:21 - Success: admin:admin
Example 8 – Setting a custom wordlist for brute forcing
RSF (Telnet Bruteforce) > set dictionary /usr/share/routersploit/routersploit/wordlists/passwords.txt
dictionary => /usr/share/routersploit/routersploit/wordlists/passwords.txt
RSF (Telnet Bruteforce) > run
Example 9 – Checking module compatibility without exploiting
RSF (DGN2200 DNS RCE) > set target 10.10.10.26
RSF (DGN2200 DNS RCE) > check
[-] Target is not vulnerable.
Example 10 – Listing all loaded exploit modules
RSF > show all | grep exploits | wc -l
354
7. Common Use Cases
- Assessing SOHO/consumer router security posture during internal or IoT-focused penetration tests.
- Testing IP cameras, DVRs, and other embedded devices for default or weak credentials.
- Rapidly triaging a range of embedded devices with the
scanners/autopwnmodule before manual deep-dives. - Demonstrating the risk of unpatched/EOL embedded firmware to clients who have not updated legacy network hardware.
- Educational/lab use in IoT security training environments (e.g., Damn Vulnerable IoT Device labs).
8. Automation with Bash
#!/bin/bash
# routersploit_autopwn_sweep.sh - Run RouterSploit's autopwn scanner across a subnet
TARGETS_FILE="iot_targets.txt" # one IP per line
RSF_DIR="/opt/routersploit"
while IFS= read -r ip; do
echo "[*] Scanning $ip with autopwn..."
cd "$RSF_DIR" && python3 -c "
from routersploit.interpreter import RoutersploitInterpreter
" 2>/dev/null
# Practical approach: drive rsf.py via a resource-style input redirection
printf "use scanners/autopwn\nset target %s\nrun\nexit\n" "$ip" | python3 rsf.py
done < "$TARGETS_FILE"
#!/bin/bash
# rsf_creds_sweep.sh - Sweep a list of targets with a generic credential module
MODULE="creds/generic/telnet_bruteforce"
TARGETS_FILE="iot_targets.txt"
while IFS= read -r ip; do
echo "=== $ip ==="
printf "use %s\nset target %s\nrun\nexit\n" "$MODULE" "$ip" | python3 rsf.py
done < "$TARGETS_FILE"
9. Tips and Best Practices
- Always run
checkbeforerunwhen a module supports it, to avoid unnecessary exploitation attempts on non-vulnerable devices (embedded systems can be fragile and may crash/reboot under load). - Keep RouterSploit updated (
git pullon a source install) — embedded device vulnerability research moves quickly and module sets are updated frequently. - Use lower thread counts (
set threads 1-2) against embedded devices; many have very limited processing power/memory and can be knocked offline by aggressive brute forcing. - Cross-reference RouterSploit findings with SearchSploit/CVE databases for a fuller picture of a specific firmware version’s vulnerability history.
- Document device make/model/firmware version precisely in your findings, since embedded exploits are typically extremely version/hardware-revision specific.
- Be mindful that many embedded/IoT devices are business-critical (e.g., production cameras, industrial routers) — schedule testing windows and have a rollback/recovery plan agreed with the client.
10. Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
Module check always returns “not vulnerable” | Wrong port, firmware patched, or fingerprint mismatch | Verify exact firmware/model, try adjusting port/target options |
| Brute-force module hangs | Device locked out account after failed attempts, or unstable connection | Lower threads, increase timeout, wait before retrying |
pip install -r requirements.txt fails | Missing system dependencies or externally-managed-environment restriction | Use --break-system-packages or a Python virtual environment |
| Device becomes unresponsive after test | Embedded devices often have limited resources | Reduce module aggressiveness; coordinate reboot with client; document impact |
search returns no results | Local module cache outdated | Update RouterSploit via git pull (source install) |
11. References
- GitHub repository: https://github.com/threat9/routersploit
- Kali Linux tool page: https://www.kali.org/tools/routersploit/
- RouterSploit wiki: https://github.com/threat9/routersploit/wiki
