CVE-2024-3273 PoC — D-Link DNS-320 命令注入漏洞

Description

D-Link NAS Command Execution Exploit

介绍

# D-Link NAS Command Execution Exploit

This Python script exploits a vulnerability (CVE-2024-3273) in D-Link NAS devices, allowing arbitrary command execution. It leverages the vulnerability to execute commands remotely on the affected devices.

## Features
- Executes arbitrary commands on D-Link NAS devices.
- Supports both single host and multiple hosts from a file.
- Concurrent execution of commands for improved efficiency.
- Option to specify the number of threads for concurrent execution.
- Option to specify a custom command to execute (default: `id`).
- Prints colored output for easy identification of vulnerable hosts and responses.

## Requirements
- Python 3.10
- Requests library (2.26.0)
- Colorama library (0.4.6)

## Usage

<div align="center">
  <img src="https://github.com/ThatNotEasy/CVE-2024-3273/assets/25004320/ef1952fe-2038-4df7-b83f-abd7569b226f" alt="Screenshot_4">
</div>

 python CVE-2024-3273.py [-h] [-u URL] [-f FILENAME] [-o OUTPUT] [-t THREAD] [-c COMMAND]
- `-u, --url`: Specify the URL/IP of the target host.
- `-f, --filename`: Provide the path to a file containing a list of hosts.
- `-o, --output`: Specify the path to save vulnerable hosts.
- `-t, --thread`: Number of threads for concurrent execution (default: 5).
- `-c, --command`: Specify the command to run (default: `id`).

## References
- **adhikara13**

## Disclaimer
This script is for educational purposes only. Use it at your own risk.

文件快照

备注