It has been a while since I published something about a really broken router. To be honest, it has been a while since I even looked at a router, but let me fix that with this blog post.
Basically, the shellcode calls do_cmd(‘/etc/init.d/teld.sh start‘) to enable telnet on the router. Once telnet is enabled, use the default root password found and cracked by chorankates to login:
Furthermore, the exploit crashes ioos, which means that 9 times out of 10, the exploit will fail, and I have to reboot the router in order to retry (highly impractical). However, when it does work, it feels pretty good:
And looking at GDB:
Looking at the different strings referenced in cgi_form, we can infer that it parses POST multipart/form-data requests (which we already knew). The form data may contain a name and filename parameters (which we didn’t know yet and which looks interesting). Once it finds a name and filename parameters, it calls open followed by another unknown function.
Since we can dynamically analyze ioos, we do not have to understand every little bit of code in those functions. Instead, as soon as we understand that we can pass a filename parameter, we could send the following request:
Next, consider what happens if we send a POST request whose filename parameter points to a parent directory. Obviously, we should target a writeable directory since we are targeting an embedded device. Looking at the fstab entries, we should be able to write to /etc:
For our scenario, I have updated the default admin password to ‘password’. The following curl request attempts to logon the web interface using an empty password, resulting in an error (login failed):
