Unauthenticated OS Command Injection in D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-10914. The main file, CVE-2024-10914_EXPLOIT.py, is a Python script that exploits a command injection vulnerability in a web application's /cgi-bin/account_mgr.cgi endpoint. The exploit works by sending a specially crafted GET request with the 'cmd' parameter set to 'cgi_user_add' and the 'name' parameter containing a payload that injects arbitrary shell commands. The script prints the response from the server, which may include the output of the executed command. The README provides basic usage instructions, indicating that the script requires the 'requests' library and can be run from the command line with the target URL and desired command. No hardcoded IPs or domains are present; the target is specified by the user at runtime. The exploit is a functional PoC and does not include advanced features or payload customization beyond the command injection.

This repository contains a Python exploit script (CVE-2024-10914.py) targeting a command injection vulnerability in a web application's CGI endpoint (/cgi-bin/account_mgr.cgi). The exploit first checks if the target is vulnerable by injecting a benign command and verifying the response. If vulnerable, it provides an interactive shell-like interface allowing the attacker to execute arbitrary commands, navigate directories, upload/download files, and spawn reverse shells (Bash, Python, Netcat, PowerShell) to a specified IP and port. The script uses the 'name' parameter in the CGI endpoint for command injection. The README provides usage instructions, supported commands, and legal disclaimers. No framework is used; the exploit is standalone. The main entry point is CVE-2024-10914.py, written in Python. The attack vector is network-based, requiring HTTP access to the vulnerable endpoint. The endpoints /cgi-bin/account_mgr.cgi and /upload are fingerprintable and central to the exploit's operation.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-10914, a remote code execution vulnerability affecting several D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L) with specific firmware versions. The main exploit script, 'exploit.py', is written in Python and allows users to check for vulnerability, exploit the flaw, and obtain an interactive shell for arbitrary command execution on the target device. The exploit works by injecting system commands into the 'name' parameter of the '/cgi-bin/account_mgr.cgi' endpoint via HTTP GET requests. The script supports both single-target and multi-target modes (using a file of IP addresses), and uses multi-threading for efficient scanning. The repository also includes a 'targets.txt' file with example IP addresses, a 'requirements.txt' for dependencies, and documentation in the README. The exploit is network-based and requires the target device's web interface to be accessible. The payload is customizable, allowing the attacker to execute any command supported by the device's underlying OS.

This repository provides a proof-of-concept (POC) exploit for CVE-2024-10914, a command injection vulnerability in the 'name' parameter of the /cgi-bin/account_mgr.cgi?cmd=cgi_user_add endpoint on several D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L) running specific firmware versions. The repository contains two main exploit scripts: one in Bash (cve-2024-10914.sh) for Linux/MacOS and one in PowerShell (cve-2024-10914.ps1) for Windows. Both scripts operate similarly: they first verify if the target is vulnerable by injecting a unique string via the vulnerable parameter and checking the response, then provide an interactive shell for the attacker to execute arbitrary commands on the target device. The exploit is network-based and requires the attacker to have access to the device's web interface. The README provides detailed usage instructions, affected device versions, and context about the vulnerability. No hardcoded IPs or domains are present; the attacker supplies the target URL. The exploit is operational, providing a working interactive shell if the target is vulnerable.

This repository contains a Python exploit for CVE-2024-10914, a critical remote code execution vulnerability affecting D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L) with firmware up to 20241028. The exploit targets the /cgi-bin/account_mgr.cgi endpoint, specifically the 'name' parameter in the cgi_user_add command, which is vulnerable to OS command injection. The main script (CVE-2024-10914.py) allows the user to test a single target or scan multiple targets from a file. If a target is found vulnerable, the script provides an interactive shell for arbitrary command execution on the device. The exploit is operational and provides real RCE capabilities, leveraging a network-based attack vector. The README.md provides background on the vulnerability and affected products. No hardcoded IPs or domains are present, but the endpoint path is fingerprintable. The code is well-structured, with clear separation between scanning, exploitation, and interactive shell functionality.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-10914, a remote code execution vulnerability affecting several D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L). The exploit is implemented in Python (CVE-2024-10914.py) and leverages a command injection flaw in the /cgi-bin/account_mgr.cgi script, specifically in the handling of the 'name' parameter for the cgi_user_add command. The script allows the user to test a single target or scan multiple targets for vulnerability, and if a target is found to be vulnerable, it provides an interactive shell-like interface for executing arbitrary OS commands on the device. The exploit works by sending crafted HTTP GET requests to the vulnerable endpoint, injecting commands via the 'name' parameter. The repository also includes a README.md with detailed vulnerability and usage information, and a requirements.txt listing necessary Python dependencies. The main attack vector is network-based, targeting the web interface of the affected D-Link NAS devices.

This repository provides a Python proof-of-concept exploit for CVE-2024-10914, a remote code execution vulnerability affecting several D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L) with specific firmware versions. The main exploit script (exploit.py) allows users to check if a device is vulnerable and, if so, exploit it by injecting arbitrary system commands via the 'name' parameter of the /cgi-bin/account_mgr.cgi endpoint. The script supports both single-target and multi-target scanning (using targets.txt), and provides an interactive shell for post-exploitation command execution. The exploit is executed over HTTP, targeting the device's web interface (default port 80, configurable). The repository includes a README with usage instructions, a requirements.txt for dependencies, and a sample targets.txt file with potential target IPs. The exploit is a functional PoC and does not belong to a larger exploitation framework.

This repository provides a proof-of-concept (POC) exploit for CVE-2024-10914, a command injection vulnerability in the 'name' parameter of the 'cgi_user_add' command in the /cgi-bin/account_mgr.cgi script on several D-Link NAS devices (DNS-320, DNS-320LW, DNS-325, DNS-340L) with specific firmware versions. The repository contains two main exploit scripts: one in Bash (cve-2024-10914.sh) for Linux/MacOS and one in PowerShell (cve-2024-10914.ps1) for Windows. Both scripts allow the user to verify if a target is vulnerable and, if so, provide an interactive shell-like interface to execute arbitrary OS commands on the target device via the vulnerable HTTP endpoint. The exploit works by injecting commands into the 'name' parameter, which is not properly sanitized by the target's CGI script. The README provides detailed usage instructions, affected device versions, and context about the vulnerability. No hardcoded IPs or domains are present; the user supplies the target URL at runtime. The exploit is operational, providing real command execution but not weaponized for mass exploitation.

This repository contains a Python exploit script (exploit.py) targeting CVE-2024-10914, a command injection vulnerability in D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L network storage devices running specific firmware versions. The exploit works by sending HTTP GET requests to the /cgi-bin/account_mgr.cgi endpoint, injecting arbitrary shell commands into the 'name' parameter. The script first verifies if the target is vulnerable by echoing a random string and checking the response. If vulnerable, it provides an interactive shell-like interface for the attacker to execute further commands on the device. The repository is structured simply, with the main exploit logic in exploit.py, a README describing the target and vulnerability, and standard project files (.gitignore, LICENSE). The exploit requires network access to the device's web interface and does not require authentication. No hardcoded IPs or domains are present; the target URL is supplied by the user.