1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  include Msf::Exploit::Remote::HttpClient
9
  prepend Msf::Exploit::Remote::AutoCheck
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Belkin Wemo-Enabled Crock-Pot Remote Control',
16
        'Description' => %q{
17
          This module acts as a simple remote control for Belkin Wemo-enabled
18
          Crock-Pots by implementing a subset of the functionality provided by the
19
          Wemo App.
20

21
          No vulnerabilities are exploited by this Metasploit module in any way.
22
        },
23
        'Author' => 'wvu',
24
        'References' => [
25
          ['URL', 'http://web.archive.org/web/20180301171809/https://www.crock-pot.com/wemo-landing-page.html'],
26
          ['URL', 'https://www.belkin.com/us/support-article?articleNum=101177'],
27
          ['URL', 'http://www.wemo.com/']
28
        ],
29
        'License' => MSF_LICENSE,
30
        'Actions' => [
31
          ['Cook', { 'Description' => 'Cook stuff' }],
32
          ['Stop', { 'Description' => 'Stop cooking' }]
33
        ],
34
        'DefaultAction' => 'Cook',
35
        'Notes' => {
36
          'Stability' => [CRASH_SAFE],
37
          'SideEffects' => [PHYSICAL_EFFECTS],
38
          'Reliability' => []
39
        }
40
      )
41
    )
42

43
    register_options([
44
      Opt::RPORT(49152),
45
      OptEnum.new('TEMP', [true, 'Temperature', 'Off', modes.keys]),
46
      OptInt.new('TIME', [true, 'Cook time in minutes', 0])
47
    ])
48

49
    register_advanced_options([
50
      OptBool.new('DefangedMode', [true, 'Run in defanged mode', true])
51
    ])
52
  end
53

54
  def check
55
    res = send_request_cgi(
56
      'method' => 'GET',
57
      'uri' => '/setup.xml'
58
    )
59

60
    if res && res.code == 200 && res.body.include?('urn:Belkin:device:')
61
      if res.body.include?('urn:Belkin:device:crockpot:1')
62
        return Exploit::CheckCode::Appears('Wemo-enabled Crock-Pot detected')
63
      end
64

65
      return Exploit::CheckCode::Detected('Wemo device detected, but it is not a Crock-Pot')
66
    end
67

68
    Exploit::CheckCode::Safe
69
  end
70

71
  def run
72
    if datastore['DefangedMode']
73
      print_error('Running in defanged mode')
74
      return
75
    end
76

77
    case action.name
78
    when 'Cook'
79
      print_status("Cooking on #{datastore['TEMP']} for #{datastore['TIME']}m")
80
      res = send_request_cook(datastore['TEMP'], datastore['TIME'])
81
    when 'Stop'
82
      print_status('Setting temperature to Off and cook time to 0m')
83
      res = send_request_cook('Off', 0)
84
    end
85

86
    unless res && res.code == 200 && (time = res.get_xml_document.at('//time'))
87
      print_error("Failed to #{action.name.downcase}, aborting!")
88
      return
89
    end
90

91
    print_good("Cook time set to #{time.text}m")
92
  end
93

94
  def send_request_cook(temp, time)
95
    send_request_cgi(
96
      'method' => 'POST',
97
      'uri' => '/upnp/control/basicevent1',
98
      'ctype' => 'text/xml',
99
      'headers' => {
100
        'SOAPACTION' => '"urn:Belkin:service:basicevent:1#SetCrockpotState"'
101
      },
102
      'data' => generate_soap_xml(temp, time)
103
    )
104
  end
105

106
  def generate_soap_xml(temp, time)
107
    <<~EOF
108
      <?xml version="1.0" encoding="utf-8"?>
109
      <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
110
        <s:Body>
111
          <u:SetCrockpotState xmlns:u="urn:Belkin:service:basicevent:1">
112
            <mode>#{modes[temp]}</mode>
113
            <time>#{time}</time>
114
          </u:SetCrockpotState>
115
        </s:Body>
116
      </s:Envelope>
117
    EOF
118
  end
119

120
  def modes
121
    {
122
      'Off' => 0,
123
      'Warm' => 50,
124
      'Low' => 51,
125
      'High' => 52
126
    }
127
  end
128

129
end
130

131