CVE-2020-8654

This Metasploit module exploits multiple vulnerabilities in EyesOfNetwork (CVE-2020-8654, CVE-2020-8655, CVE-2020-8656, CVE-2020-8657) to achieve remote command execution as root. It leverages command injection in the AutoDiscovery feature, privilege escalation via Nmap, and authentication bypass techniques (SQLi and hardcoded API key).

This exploit demonstrates a multi-stage attack against EyesOfNetwork 5.3, chaining SQL injection (CVE-2020-8656) for authentication bypass, arbitrary user creation, and remote code execution (CVE-2020-8654) via command injection in the discovery module, followed by local privilege escalation (CVE-2020-8655) using a malicious NSE script executed by nmap with sudo privileges.

This Metasploit module exploits multiple vulnerabilities in EyesOfNetwork (CVE-2020-8654, CVE-2020-8655, CVE-2020-8656, CVE-2020-8657, CVE-2020-9465) to achieve remote command execution as root via command injection in the AutoDiscovery feature and privilege escalation through Nmap.