CVE-2020-35665

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.06 via command injection in the 'Event' parameter of 'include/makecvs.php'. It uploads a PHP shell and executes commands.

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS via shell metacharacter injection in the Event parameter of the makecvs.php endpoint. It uploads a webshell and executes commands under the context of the web application, typically running as root.

This repository contains a functional Metasploit module for CVE-2020-35665, targeting TerraMaster NAS devices with an unauthenticated RCE vulnerability. The module is part of a larger collection of private Metasploit modules, including detailed installation and usage instructions.