CVE-2018-11510

This exploit leverages an unauthenticated OS command injection vulnerability in Asustor ADM 3.1.2.RHG1 and below to execute arbitrary commands, resulting in a root shell. It uses a crafted URL to inject a Python reverse shell payload via the `aggrecate_js.cgi` endpoint.

The provided text is a detailed writeup describing multiple vulnerabilities in ASUSTOR ADM 3.1.0.RFQ3, including CVE-2018-11511, a blind SQL injection in the photo gallery application. It includes PoC examples using sqlmap for exploitation but does not contain executable exploit code.

This repository contains a working proof-of-concept exploit for CVE-2018-11510, an unauthenticated command injection vulnerability in Asustor ADM 3.1.2.RHG1. The exploit includes a Metasploit module and a Python script to achieve remote code execution and obtain a root shell.