Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  include Msf::Exploit::Remote::HttpClient
9
  prepend Msf::Exploit::Remote::AutoCheck
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'          => 'Belkin Wemo-Enabled Crock-Pot Remote Control',
14
      'Description'   => %q{
15
        This module acts as a simple remote control for Belkin Wemo-enabled
16
        Crock-Pots by implementing a subset of the functionality provided by the
17
        Wemo App.
18

19
        No vulnerabilities are exploited by this Metasploit module in any way.
20
      },
21
      'Author'        => 'wvu',
22
      'References'    => [
23
        ['URL', 'https://www.crock-pot.com/wemo-landing-page.html'],
24
        ['URL', 'https://www.belkin.com/us/support-article?articleNum=101177'],
25
        ['URL', 'http://www.wemo.com/']
26
      ],
27
      'License'       => MSF_LICENSE,
28
      'Actions'       => [
29
        ['Cook', 'Description' => 'Cook stuff'],
30
        ['Stop', 'Description' => 'Stop cooking']
31
      ],
32
      'DefaultAction' => 'Cook',
33
      'Notes'         => {
34
        'Stability'   => [CRASH_SAFE],
35
        'SideEffects' => [PHYSICAL_EFFECTS]
36
      }
37
    ))
38

39
    register_options([
40
      Opt::RPORT(49152),
41
      OptEnum.new('TEMP', [true, 'Temperature', 'Off', modes.keys]),
42
      OptInt.new('TIME',  [true, 'Cook time in minutes', 0])
43
    ])
44

45
    register_advanced_options([
46
      OptBool.new('DefangedMode', [true, 'Run in defanged mode', true])
47
    ])
48
  end
49

50
  def check
51
    res = send_request_cgi(
52
      'method' => 'GET',
53
      'uri'    => '/setup.xml'
54
    )
55

56
    if res && res.code == 200 && res.body.include?('urn:Belkin:device:')
57
      if res.body.include?('urn:Belkin:device:crockpot:1')
58
        vprint_good('Wemo-enabled Crock-Pot detected')
59
        return Exploit::CheckCode::Appears
60
      end
61

62
      vprint_status('Wemo device detected, but it is not a Crock-Pot')
63
      return Exploit::CheckCode::Detected
64
    end
65

66
    Exploit::CheckCode::Safe
67
  end
68

69
  def run
70
    if datastore['DefangedMode']
71
      print_error('Running in defanged mode')
72
      return
73
    end
74

75
    case action.name
76
    when 'Cook'
77
      print_status("Cooking on #{datastore['TEMP']} for #{datastore['TIME']}m")
78
      res = send_request_cook(datastore['TEMP'], datastore['TIME'])
79
    when 'Stop'
80
      print_status('Setting temperature to Off and cook time to 0m')
81
      res = send_request_cook('Off', 0)
82
    end
83

84
    unless res && res.code == 200 && (time = res.get_xml_document.at('//time'))
85
      print_error("Failed to #{action.name.downcase}, aborting!")
86
      return
87
    end
88

89
    print_good("Cook time set to #{time.text}m")
90
  end
91

92
  def send_request_cook(temp, time)
93
    send_request_cgi(
94
      'method'       => 'POST',
95
      'uri'          => '/upnp/control/basicevent1',
96
      'ctype'        => 'text/xml',
97
      'headers'      => {
98
        'SOAPACTION' => '"urn:Belkin:service:basicevent:1#SetCrockpotState"'
99
      },
100
      'data'         => generate_soap_xml(temp, time)
101
    )
102
  end
103

104
  def generate_soap_xml(temp, time)
105
    <<~EOF
106
      <?xml version="1.0" encoding="utf-8"?>
107
      <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
108
        <s:Body>
109
          <u:SetCrockpotState xmlns:u="urn:Belkin:service:basicevent:1">
110
            <mode>#{modes[temp]}</mode>
111
            <time>#{time}</time>
112
          </u:SetCrockpotState>
113
        </s:Body>
114
      </s:Envelope>
115
    EOF
116
  end
117

118
  def modes
119
    {
120
      'Off'  => 0,
121
      'Warm' => 50,
122
      'Low'  => 51,
123
      'High' => 52
124
    }
125
  end
126

127
end
128

129