CVE-2016-6255

This HTML-based exploit leverages CVE-2013-4863 and CVE-2016-6255 to achieve remote code execution on MiCasa VeraLite devices by exploiting a vulnerable libupnp server and executing a reverse shell via Lua code injection.

This repository contains a proof-of-concept exploit for CVE-2016-6255, which leverages a combination of vulnerabilities (CVE-2013-4863 and CVE-2016-6255) to achieve remote code execution on VeraLite devices. The exploit uses WebRTC to leak the client's internal IP, then crafts a malicious request to create a file on the target device, ultimately executing a reverse shell.