Skip to content

Commit 589de04

Browse files
committed
Clarification in product linkage and small syntax fixup in repro steps
1 parent 3b0f0aa commit 589de04

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

documentation/modules/exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Vulnerable Application
22

3-
This module exploits a command injection vulnerability in the [Linksys WVBR0-25](https://www.att.com/help/manuals/directv/dvrs.html) wireless video bridge. A description of the exploited vulnerability is available in the Vulnerability Details section of [this advisory](http://www.zerodayinitiative.com/advisories/ZDI-17-973/).
3+
This module exploits a command injection vulnerability in the Linksys WVBR0-25 wireless video bridge. More information about the device itself can be found on AT&T's [manuals page](https://www.att.com/help/manuals/directv/dvrs.html) under the "DIRECTV Wireless Video Bridge Gen2 Product Manual" heading, as well as on this [unofficial product page](https://www.solidsignal.com/pview.asp?p=wvb). A description of the exploited vulnerability is available in the Vulnerability Details section of [this advisory](http://www.zerodayinitiative.com/advisories/ZDI-17-973/).
44
The latest confirmed vulnerable firmware version is 1.0.39. It may be possible to downgrade newer versions to a vulnerable version, but since firmware images are not available for download, this cannot be verified.
55

66
There is no complete list of vulnerable firmware versions, however the check method can reliably detect whether a device is vulnerable. The check method browses to the root of the device's webserver with a User-Agent set to `"; printf "[random string]`. If the response contains an md5 hash of the random string, the device is vulnerable to command injection.
@@ -15,7 +15,7 @@
1515
2. Start msfconsole.
1616
3. Do: ```use exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth```
1717
4. Do: ```set payload cmd/unix/bind_netcat```
18-
5. Do: ```set RHOST <ip>```
18+
5. Do: ```set RHOST [ip]```
1919
6. Do: ```exploit```
2020
7. You should get a shell.
2121

0 commit comments

Comments
 (0)