Skip to content

Commit de6e2ef

Browse files
author
jvazquez-r7
committed
Final cleanup for dlink_upnp_exec_noauth
1 parent c1c72de commit de6e2ef

File tree

1 file changed

+9
-11
lines changed

1 file changed

+9
-11
lines changed

modules/exploits/linux/http/dlink_upnp_exec_noauth.rb

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,15 @@ class Metasploit3 < Msf::Exploit::Remote
1818

1919
def initialize(info = {})
2020
super(update_info(info,
21-
'Name' => 'D-Link UPnP SOAP Command Execution',
21+
'Name' => 'D-Link Devices UPnP SOAP Command Execution',
2222
'Description' => %q{
23-
Different DLink Routers are vulnerable to OS Command injection in the UPnP
24-
SOAP interface.
25-
Not every device includes wget which we need for deploying our payload.
26-
On such devices you could use the telnet target for starting a telnet server or the
27-
cmd generic payload and try to start telnetd or execute other commands. Since it is
28-
a blind OS command injection vulnerability, there is no output for the executed
29-
command when using the cmd generic payload. A ping command against a controlled
30-
system could be used for testing purposes. This module has been tested successfully
31-
on DIR-300, DIR-600, DIR-645, DIR-845, DIR-865.
32-
It looks like that there are some more D-Link devices affected.
23+
Different DLink Routers are vulnerable to OS Command injection in the UPnP SOAP
24+
interface. Since it is a blind OS command injection vulnerability, there is no
25+
output for the executed command when using the CMD target. Additionally, two targets
26+
are included, to start a telnetd service and finally a session over it, or deploy a
27+
native mipsel payload. This module has been tested successfully on DIR-300, DIR-600,
28+
DIR-645, DIR-845 and DIR-865. According to the vulnerability discoverer, there could
29+
be more D-Link devices affected.
3330
},
3431
'Author' =>
3532
[
@@ -139,6 +136,7 @@ def exploit_telnet
139136

140137
if sock
141138
print_good("#{rhost}:#{rport} - Backdoor service has been spawned, handling...")
139+
add_socket(sock)
142140
else
143141
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
144142
end

0 commit comments

Comments
 (0)