{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7626","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7626/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7626/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7626/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7626","id":192309997,"number":7626,"title":"Add PoC for TR-069 command injection exploit (Eir D1000 Wireless Router)","user":{"login":"todb-r7","id":1170909,"avatar_url":"https://avatars.githubusercontent.com/u/1170909?v=3","gravatar_id":"","url":"https://api.github.com/users/todb-r7","html_url":"https://github.com/todb-r7","followers_url":"https://api.github.com/users/todb-r7/followers","following_url":"https://api.github.com/users/todb-r7/following{/other_user}","gists_url":"https://api.github.com/users/todb-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/todb-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/todb-r7/subscriptions","organizations_url":"https://api.github.com/users/todb-r7/orgs","repos_url":"https://api.github.com/users/todb-r7/repos","events_url":"https://api.github.com/users/todb-r7/events{/privacy}","received_events_url":"https://api.github.com/users/todb-r7/received_events","type":"User","site_admin":false},"labels":[{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":105906684,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/hotness","name":"hotness","color":"8A0808","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-11-29T15:19:50Z","updated_at":"2016-11-29T18:47:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7626","html_url":"https://github.com/rapid7/metasploit-framework/pull/7626","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7626.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7626.patch"},"body":"This adds a module for review and productionalization of the cmd injection issue described by Kenzo at:\r\n\r\nhttps://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Fix up the cmd injection to be more general than specific, fix title, desc, refs, drop the global, etc.\r\n- [ ] Come up with a way to test this absent vuln hardware.\r\n- [ ] Start `msfconsole`\r\n- [ ] `use exploit/linux/http/tr069_ntpserver_cmdinject`\r\n- [ ] **Verify** the thing does do what it should.\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/263660854","html_url":"https://github.com/rapid7/metasploit-framework/pull/7626#issuecomment-263660854","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7626","id":263660854,"user":{"login":"0x27","id":9094330,"avatar_url":"https://avatars.githubusercontent.com/u/9094330?v=3","gravatar_id":"","url":"https://api.github.com/users/0x27","html_url":"https://github.com/0x27","followers_url":"https://api.github.com/users/0x27/followers","following_url":"https://api.github.com/users/0x27/following{/other_user}","gists_url":"https://api.github.com/users/0x27/gists{/gist_id}","starred_url":"https://api.github.com/users/0x27/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0x27/subscriptions","organizations_url":"https://api.github.com/users/0x27/orgs","repos_url":"https://api.github.com/users/0x27/repos","events_url":"https://api.github.com/users/0x27/events{/privacy}","received_events_url":"https://api.github.com/users/0x27/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T18:47:38Z","updated_at":"2016-11-29T18:47:38Z","body":"@jinq102030 That resets the NTP server back to the default one on the Eir/Eircom devices, prevents stuff going boom later :)\r\n\r\nAlso, the vulnerability is in TR-064 code, not TR-069 code, so the module description/etc should be updated to reflect that."}}
{"actor":{"display_login":"0x27"}}