Full Disclosure: Authenticated Command Execution…

On 2016-05-19 TrustedSec discovered an authenticated command injection vulnerability in pfSense's WebGUI (auth.inc via system_groupmanager.php, "members" parameter) allowing an authenticated user with access to the Groups page to execute commands as root. The issue was responsibly disclosed to pfSense on 2016-06-08 and promptly fixed; a simple proof-of-concept (`'`whoami>/usr/local/www/whoami.txt`'`) and later public write-ups and an Exploit-DB entry document exploitation details and a CTF use-case.