DD-WRT HTTP v24-SP1 - Command Injection

ExploitDBExploitDB exploitExploitEDB-10030

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Metasploit exploit module for CVE-2009-2765. It sends a crafted HTTP GET request to the /cgi-bin/ endpoint of a DD-WRT router, injecting shell metacharacters to execute arbitrary commands as root.

Backdoor review

No backdoor observed in reviewed code

The provided file is a standard Metasploit exploit module for CVE-2009-2765. It contains no hidden or deceptive functionality beyond the documented command injection exploit. The payload is constructed and sent transparently within the module's exploit method.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareDD-WRT
Attack typescommand_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively sends a malicious HTTP request to trigger command injection and deliver a payload to gain remote access.

exploits/linux/remote/10030.rb:16exploits/linux/remote/10030.rb:64-79

Requirements

  • Target must be running DD-WRT v24 SP1 or earlier build.exploits/linux/remote/10030.rb:23-27
  • Target must have the vulnerable HTTP management interface accessible on port 80.exploits/linux/remote/10030.rb:60

Observed behavior

  • The module connects to the target on port 80 and sends an HTTP GET request to /cgi-bin/ with a shell command injection payload.exploits/linux/remote/10030.rb:65-72
  • The injected command uses echo and /bin/sh to decode and execute a Metasploit payload, establishing a reverse shell connection.exploits/linux/remote/10030.rb:67-68
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Command injection via shell metacharacters in HTTP GET request URIThe exploit method constructs a malicious HTTP request by injecting the payload into the URI after '/cgi-bin/;' using shell metacharacters and IFS manipulation.exploits/linux/remote/10030.rb:64-72
Payload Encoding
Hexadecimal encoding of payload bytesThe payload is encoded as a sequence of hexadecimal escape sequences (e.g., \x41) to be interpreted by the shell.exploits/linux/remote/10030.rb:67
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Ruby source code; no external dependencies, libraries, or referenced resources were inspected.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness or safety is not verified.
  • Only the exploit module source code is reviewed; the Metasploit framework libraries (e.g., msf/core) and the payload itself are not included in the evidence.
  • The review does not assess the safety of the target vulnerability or the payload that a user might supply.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1