aether-0/cve-2024-12986Scanner and exploit for CVE-2024-12986, a command injection in DrayTek Gateway Devices. Includes a Bash scanner and a Python interactive shell for executing arbitrary commands on vulnerable targets.
This repository contains a scanner and exploit for the CVE-2024-12986 vulnerability, which is a command injection vulnerability in the apmcfgupptim endpoint of DrayTek Gateway Devices. The vulnerability allows an attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise.
The vulnerability exists in the apmcfgupptim endpoint of DrayTek Gateway Devices. By crafting a malicious HTTP request, an attacker can inject arbitrary commands into the session parameter, leading to command execution on the target device.
For more details, refer to the original disclosure:
Command Injection in apmcfgupptim endpoint for DrayTek Gateway Devices
scan.sh: A Bash script to scan a list of URLs for the CVE-2024-12986 vulnerability. It checks if the target servers are reachable and attempts to send a crafted payload to the endpoint.
apmcfgupptimexploit.py: A Python script that provides an interactive shell to exploit the CVE-2024-12986 vulnerability. It allows you to send crafted HTTP requests to the target device and execute arbitrary commands.
scan.sh)The scan.sh script is used to scan a list of URLs for the CVE-2024-12986 vulnerability. It checks if the target servers are reachable and attempts to send a crafted payload to the apmcfgupptim endpoint.
nc (Netcat): The script uses nc to send the crafted payload to the target server../scan.sh <file> [--verbose] [--output <output_file>]
<file>: A file containing a list of URLs to scan (one URL per line).--verbose: (Optional) Enable verbose output to see detailed logs.--output <output_file>: (Optional) Save the output to a specified file../scan.sh urls.txt --verbose --output scan_results.txt
exploit.py)The exploit.py script provides an interactive shell to exploit the CVE-2024-12986 vulnerability. It allows you to send crafted HTTP requests to the target device and execute arbitrary commands.
socks library: The script uses the socks library to handle socket connections. Install it using pip:pip install PySocks
Open the exploit.py script and set the HOST and PORT variables to the target IP address and port.
Run the script:
python3 exploit.py
exit to quit the shell.python3 exploit.py
Once the shell starts, you can execute commands like:
shell> whoami
shell> ls -la
This repository is intended solely for educational purposes. The tools and scripts provided here are designed to help security researchers and professionals understand and mitigate the CVE-2024-12986 vulnerability.
Important:
This repository is for educational and research purposes only. The authors are not responsible for any misuse of the tools provided. Use these tools only on systems you own or have explicit permission to test.
Contributions are welcome! Please open an issue or submit a pull request if you have any improvements or bug fixes.
For any questions or issues, please open an issue on GitHub.