Metasploit Module: D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.
Type: exploit
Path: modules/exploits/linux/upnp/dlink_upnp_msearch_exec.rb
Platform: unix
Disclosure date: 2013-02-01
References: CVE-2023-33625, CVE-2020-15893, CVE-2019-20215, URL-https://attackerkb.com/topics/uqicA23ecz/cve-2023-33625, URL-https://github.com/zcutlip/exploit-poc/tree/master/dlink/dir-815-a1/upnp-command-injection, URL-https://medium.com/@s1kr10s/d-link-dir-859-unauthenticated-rce-in-ssdpcgi-http-st-cve-2019-20215-en-2e799acb8a73, URL-https://shadow-file.blogspot.com/2013/02/dlink-dir-815-upnp-command-injection.html, URL-https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/, URL-https://github.com/naihsin/IoT/blob/main/D-Link/DIR-600/cmd%20injection/README.md
Targets: Unix Command, Linux Dropper

Description:
A command injection vulnerability exists in multiple D-Link network products, allowing an attacker
          to inject arbitrary command to the UPnP via a crafted M-SEARCH packet.
          Universal Plug and Play (UPnP), by default is enabled in most D-Link devices, on the port 1900.
          An attacker can perform a remote command execution by injecting the payload into the
          `Search Target` (ST) field of the SSDP M-SEARCH discover packet.
          After successful exploitation, an attacker will have full access with `root` user privileges.

          NOTE: Staged meterpreter payloads might core dump on the target, so use stage-less meterpreter payloads
          when using the Linux Dropper target. Some D-Link devices do not have the `wget` command so
          configure `echo` as flavor with the command set CMDSTAGER::FLAVOR echo.

          The following D-Link network products and firmware are vulnerable:
          - D-Link Router model GO-RT-AC750 revisions Ax with firmware v1.01 or older;
          - D-Link Router model DIR-300 revisions Ax with firmware v1.06 or older;
          - D-Link Router model DIR-300 revisions Bx with firmware v2.15 or older;
          - D-Link Router model DIR-600 revisions Bx with firmware v2.18 or older;
          - D-Link Router model DIR-645 revisions Ax with firmware v1.05 or older;
          - D-Link Router model DIR-815 revisions Bx with firmware v1.04 or older;
          - D-Link Router model DIR-816L revisions Bx with firmware v2.06 or older;
          - D-Link Router model DIR-817LW revisions Ax with firmware v1.04b01_hotfix or older;
          - D-Link Router model DIR-818LW revisions Bx with firmware v2.05b03_Beta08 or older;
          - D-Link Router model DIR-822 revisions Bx with firmware v2.03b01 or older;
          - D-Link Router model DIR-822 revisions Cx with firmware v3.12b04 or older;
          - D-Link Router model DIR-823 revisions Ax with firmware v1.00b06_Beta or older;
          - D-Link Router model DIR-845L revisions Ax with firmware v1.02b05 or older;
          - D-Link Router model DIR-860L revisions Ax with firmware v1.12b05 or older;
          - D-Link Router model DIR-859 revisions Ax with firmware v1.06b01Beta01 or older;
          - D-Link Router model DIR-860L revisions Ax with firmware v1.10b04 or older;
          - D-Link Router model DIR-860L revisions Bx with firmware v2.03b03 or older;
          - D-Link Router model DIR-865L revisions Ax with firmware v1.07b01 or older;
          - D-Link Router model DIR-868L revisions Ax with firmware v1.12b04 or older;
          - D-Link Router model DIR-868L revisions Bx with firmware v2.05b02 or older;
          - D-Link Router model DIR-869 revisions Ax with firmware v1.03b02Beta02 or older;
          - D-Link Router model DIR-880L revisions Ax with firmware v1.08b04 or older;
          - D-Link Router model DIR-890L/R revisions Ax with firmware v1.11b01_Beta01 or older;
          - D-Link Router model DIR-885L/R revisions Ax with firmware v1.12b05 or older;
          - D-Link Router model DIR-895L/R revisions Ax with firmware v1.12b10 or older;
          - probably more looking at the scale of impacted devices :-(

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'rport' => datastore['HTTP_PORT'],
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path)
    })
    # Check if target is a D-Link network device
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('Likely not a D-Link network device.') unless res.code == 200 && res.body =~ /d-?link/i

    # check if firmware version is vulnerable
    return CheckCode::Appears("Product info: #{@d_link['product']}|#{@d_link['firmware']}|#{@d_link['hardware']}|#{@d_link['arch']}") if vuln_version?(res)
    # D-link devices with fixed firmware versions
    return CheckCode::Safe("Product info: #{@d_link['product']}|#{@d_link['firmware']}|#{@d_link['hardware']}|#{@d_link['arch']}") unless @d_link['arch'].nil?
    # D-link devices that still could be vulnerable with product information
    return CheckCode::Detected("Product info: #{@d_link['product']}|#{@d_link['firmware']}|#{@d_link['hardware']}|#{@d_link['arch']}") unless @d_link['product'].nil?

    # D-link devices that still could be vulnerable but no product information available
    return CheckCode::Detected
  end