路由器漏洞复现详细分析

漏洞描述
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.

华为 HG532 部分定制版本存在远程代码执行漏洞。经过身份验证的攻击者可以向端口 37215 发送恶意数据包以发起攻击。成功利用此漏洞可导致远程执行任意代码.

没有漏洞的具体位置 我们先解包然后进行分析

环境搭建
固件下载：

通过网盘分享的文件：router HG532e.rar 链接: https://pan.baidu.com/s/1e4UXib76bnNlMz4gBl6sjw 提取码: sn0w

binwalk -Me HG532eV100R001C01B020_upgrade_packet.bin

下载qemu启动虚拟机所需要的“镜像” 这里采用的是内核态模拟

wget https://people.debian.org/~aurel32/qemu/mips/debian_squeeze_mips_standard.qcow2
wget https://people.debian.org/~aurel32/qemu/mips/vmlinux-2.6.32-5-4kc-malta
创建虚拟网桥，实现虚拟机内部和Ubuntu的连接

sudo apt-get install bridge-utils
sudo brctl addbr Virbr0
sudo ifconfig Virbr0 192.168.153.1/24 up
创建tap0接口 并添加网桥

sudo tunctl -t tap0
sudo ifconfig tap0 192.168.153.11/24 up
sudo brctl addif Virbr0 tap0
写一个启动脚本start.sh

#!/bin/bash

sudo qemu-system-mips \
-M malta \
-kernel vmlinux-2.6.32-5-4kc-malta \
-hda debian_squeeze_mips_standard.qcow2 \
-append “root=/dev/sda1 console=tty0” \
-netdev tap,id=tap