Information Disclosure in Cisco RV320 and RV325 Web Management Interface

This repository contains a single Metasploit module (modules/exploits/linux/http/cisco_rv32x_rce.rb) targeting Cisco RV320 and RV325 routers. The exploit leverages two vulnerabilities: an information disclosure (CVE-2019-1653) to obtain configuration data (including password hashes), and a command injection (CVE-2019-1652) to achieve unauthenticated remote code execution. The attack is performed over the network via the router's web interface, typically accessible on HTTP port 8007 or HTTPS port 443. The module first downloads the configuration file, extracts credentials, logs in, and then injects a command that causes the router to download and execute a shell payload from the attacker's HTTP server. The exploit is weaponized, allowing for arbitrary command execution as a privileged user. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of initialization, exploitation, and payload delivery logic. The main fingerprintable endpoints are /cgi-bin/config.exp, /cgi-bin/userLogin.cgi, and /certificate_handle2.htm.

This repository contains a single Metasploit auxiliary module targeting a configuration disclosure vulnerability (CVE-2019-1653) in Cisco RV320 and RV325 routers. The module exploits improper access controls in the web management interface, allowing unauthenticated remote attackers to download the device's configuration file via HTTP or HTTPS by requesting the /cgi-bin/config.exp endpoint. The module parses the downloaded configuration to extract and report sensitive information such as the device hostname, model, MAC address, and user password hashes, storing them as loot in the Metasploit database. The exploit is operational and requires the target device to be accessible and unpatched. The code is written in Ruby and is structured as a standard Metasploit module, with clear entry points and reporting mechanisms.

This repository contains a proof-of-concept Bash script ('ciscospill.sh') that exploits CVE-2019-1653, a vulnerability in Cisco Small Business RV320 and RV325 routers. The vulnerability allows unauthenticated remote attackers to download sensitive configuration information, including administrative passwords, via improper access controls on the web management interface. The script takes a target IP (and optional port) as an argument, constructs a POST request to the '/cgi-bin/config.exp' endpoint over HTTPS, and filters the response for user and password information. The repository also includes a README with usage instructions and a LICENSE file. The exploit is simple, does not require authentication, and demonstrates the vulnerability by extracting password data from the target device.

This repository contains a Python exploit script (cisco.py) targeting CVE-2019-1653 in Cisco Small Business RV320 and RV325 routers. The exploit is fully automated and works in two main stages: (1) it retrieves administrator credentials by exploiting an unauthenticated information disclosure vulnerability via the /cgi-bin/config.exp endpoint, and (2) it uses the stolen credentials to log in and perform command injection through the certificate generation page (/certificate_handle.htm?type=1), which starts a telnet daemon on TCP port 1790. The attacker can then connect to this port for an interactive shell. The repository consists of a README.md describing the vulnerability and usage, and the main exploit script cisco.py. The exploit is operational and provides remote shell access if successful. No detection-only scripts or fake code are present.

This repository contains a Python exploit script (CVE-2019-1821.py) targeting Cisco Prime Infrastructure's Health Monitor HA TarArchive Directory Traversal vulnerability (CVE-2019-1821). The exploit works by crafting a malicious tar archive containing a JSP webshell, which is uploaded to the target via a vulnerable servlet endpoint. Once uploaded, the script accesses the webshell to trigger a reverse shell connection from the target to the attacker's machine, granting root access. The exploit is operational and provides a working reverse shell payload. The repository also includes a README.md with references to related Cisco vulnerabilities and exploits, but the main exploit is fully contained in the Python script. The attack vector is network-based, requiring access to the target's web interface. Key endpoints include the upload servlet and the location where the webshell is planted and accessed.

This repository provides operational exploit scripts for Cisco RV320 and RV325 routers vulnerable to CVE-2019-1652 (post-auth RCE) and CVE-2019-1653 (config/debug file disclosure). The main scripts are: - dump_config.py: Dumps the plaintext configuration file from the router's web interface, exposing sensitive information including password hashes. - dump_debug.py: Dumps an encrypted debug/diagnostic file, which can be decrypted using decrypt.sh to recover sensitive files such as /etc/shadow. - exec_cmd.py: Exploits a post-authentication command injection vulnerability to execute arbitrary shell commands as root. Requires valid credentials (default or extracted from config dump). - easy_access.py: Automates the full attack chain by extracting credentials from the config file and using them to authenticate and execute commands, including 'pass the hash' attacks. The exploits target the web management interface (typically HTTPS on port 443 or 8443) and use specific CGI endpoints. The attack vector is network-based, requiring access to the device's web interface. The payload is arbitrary shell command execution, enabling full device compromise. The repository is well-structured, with each script focusing on a specific stage of the attack, and includes a Bash script for decrypting debug files. The code is operational and can be used to achieve root access on unpatched Cisco RV320/325 routers.