CVE-2018-5767 PoC — Tenda AC15 输入验证漏洞

Source

https://github.com/db44k/CVE-2018-5767-AC9

Associated Vulnerability

Title:Tenda AC15 输入验证漏洞 (CVE-2018-5767)
Description:Tenda AC15是中国腾达（Tenda）公司的一款无线路由器产品。 Tenda AC15 15.03.1.16_multi版本中存在输入验证漏洞。远程攻击者可借助COOKIE包头中特制的‘password’参数利用该漏洞执行代码。

Description

An implementation of a proof-of-concept for CVE-2018-5767 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5767)

Readme

# CVE-2018-5767-AC9
An implementation of a proof-of-concept for CVE-2018-5767 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5767)

    The following is an actualization of CVE-2018-5767, a vulnerability which
    exploits an unguarded call to sscanf that occurs when parsing the 'Cookie'
    header for a password. The vulnerability was initially discovered in, and
    reported for, the AC15 model router, but has been rediscovered in several
    different routers in this product line. This implementation sees it exploit the
    model AC9, which is not presently covered by any CVE. A memory address for the
    base of libc known to work on this router is 0x2ad6d000.

    See the following for more information:
    https://www.cve.org/CVERecord?id=CVE-2018-5767
    https://www.fidusinfosec.com/remote-code-execution-cve-2018-5767/
    https://www.klogixsecurity.com/scorpion-labs-blog/sometimes-exploits-need-patches-too-working-through-a-change-of-address

    usage: CVE-2018-5767-AC9.py [-h] [-t TARGET] [-p PORT] [-l LIBC] [-c COMMAND]
                                [-v] [-a]

    options:
      -h, --help            show this help message and exit
      -t TARGET, --target TARGET
                            target URL or IP address to throw against
      -p PORT, --port PORT  target port to throw against (default = 80)
      -l LIBC, --libc LIBC  estimated base address of libc (default = 0x2ad6d000)
      -c COMMAND, --command COMMAND
                            command(s) to be run on target (default = exit)
      -v, --verbose         increase output verbosity (currently not implemented)
      -a, --about           print information about this vulnerability then exit

File Snapshot


 [4.0K]  /data/pocs/04a1c60e324f9f8265d1fe317143be5685af58d9
├── [3.8K]  CVE-2018-5767-AC9.py
├── [1.0K]  LICENSE
└── [1.7K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!