-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add RCE exploit for CVE-2019-13372 #13994
Conversation
…nd markdown does not render it as a link
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey @red0xff, thank you for the module! I have just a few suggestions.
documentation/modules/exploit/windows/http/dlink_central_wifimanager_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/http/dlink_central_wifimanager_rce.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/http/dlink_central_wifimanager_rce.md
Outdated
Show resolved
Hide resolved
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
Tested successfully on my end:
Regarding php meterpreter and |
Release NotesNew module |
This module adds a module for CVE-2019-13372, a remote code execution vulnerability in
D-link Central WiFi Manager(CWM-100)
, it's possible to inject PHP code because a user-controlled cookie is passed toeval()
without being sanitized.Verification
List the steps needed to make sure this thing works
msfconsole
use windows/http/dlink_central_wifimanager_rce
set RHOSTS [RHOSTS]
LHOST
,LPORT
etc.show options
exploit
Reproducing
a vulnerable version is available at DLink's vulnerability announcement:
Things to troubleshoot
The meterpreter payload works fine, but for some reason, when I execute the shell command from meterpreter, I get a cmd prompt, and then it hangs.
When I try to migrate from meterpreter, I get:
No idea if that's a bug in php payloads, but other common meterpreter commands work fine, I wonder if that's something from this exploit.
Related vulnerabilities
An auxiliary/sqli module for
CVE-2019-13372
will be added soon, part of another pull-request (and using the SQL Injection engine I've been working on)