{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5182","id":69217186,"number":5182,"title":"Dlink UPnP SOAP-Header Injection","user":{"login":"m-1-k-3","id":497520,"avatar_url":"https://avatars.githubusercontent.com/u/497520?v=3","gravatar_id":"","url":"https://api.github.com/users/m-1-k-3","html_url":"https://github.com/m-1-k-3","followers_url":"https://api.github.com/users/m-1-k-3/followers","following_url":"https://api.github.com/users/m-1-k-3/following{/other_user}","gists_url":"https://api.github.com/users/m-1-k-3/gists{/gist_id}","starred_url":"https://api.github.com/users/m-1-k-3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m-1-k-3/subscriptions","organizations_url":"https://api.github.com/users/m-1-k-3/orgs","repos_url":"https://api.github.com/users/m-1-k-3/repos","events_url":"https://api.github.com/users/m-1-k-3/events{/privacy}","received_events_url":"https://api.github.com/users/m-1-k-3/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-17T21:04:30Z","updated_at":"2015-05-21T04:27:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5182","html_url":"https://github.com/rapid7/metasploit-framework/pull/5182","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5182.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5182.patch"},"body":"Here we have the module from the original exploit created by Craig Heffner: http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/\r\nand here the advisory from D-Link: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051\r\n\r\nThe module was tested on a DIR-645 router\r\n\r\nScreenshot:\r\n![upnp-header-telnet-session](https://cloud.githubusercontent.com/assets/497520/7210865/aef8c954-e555-11e4-9ca3-896807b6d9b5.png)\r\n\r\nThe telnet session is not ideal but we can't use characters like the / for writing to the temp directory on the filesystem ..."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/104130727","html_url":"https://github.com/rapid7/metasploit-framework/pull/5182#issuecomment-104130727","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5182","id":104130727,"user":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T04:27:50Z","updated_at":"2015-05-21T04:27:50Z","body":"you can even do a `\"&& cd ..\" * 200`. It should not matter if you already reached `/` and still doing `cd ..`"}}