In the wake of tp-link hacking

Hacking with the substitution of dns is a fairly common method of attack. First of all because of its simplicity. The essence of the attack is to change the dns address in the settings of the victim's network equipment to the address of the attacker's dns server in order to return false ip. And already further, who is in that much - from the banal phishing pages of social networks to steal passwords to the alleged provider of the stub with the requirements of payment.

The most interesting thing in all of this is, I think, the ways in which bots, one way or another, fall on routers. And today I will talk about one of these methods.

What we have:

1. The new Archer c20v4 router, just out of the box, with the latest official firmware.
2. External ip address on the wan interface and open web access.
3. A sufficiently complex password to not worry about his selection and a limited circle of people who know it.
4. After a day: the substitution of dns and all requests are wrapped around the stub.

What do you need:
Find out how to access the device.
')
First of all, all known old bugs that were found in Google were tested on the test patient. Of course nothing worked.

A script was found on the githab ( tyk ) that allows you to remotely, from the root, execute commands on models C20i and C2. A bit is not what we need, but set the right direction.

All functions had the same “shells” for requests - these are POST requests for url / cgi? 2 (and 7), " [setup_name # 0,0,0,0,0,0,0,0,0,0,0,0 , 0] "and a special referer .

We download the source codes of our firmware from the official tp-link site and unpack it. Since a line of routers is the same, then the software should be at least a bit similar, right?


Bingo. The file name as if hints that further will be very interesting. We find a line in the code in which we saw the cherished "cgi? 2". The following is the entire function:


This function, when executed, calls another - getUsrName ().

Login function:


But just to do nothing with the login. We are interested in the password. We know that the login is stored in the variable adminName, inside the USER_CFG object. Searching the source gave the following results: (I will leave only the desired result)


Open reduced_data_model.xml and find the following code fragment in it:


Here we have the variable “AdminName” known to us and next to it is AdminPwd. It looks like the truth.

Now it remains for us to form a valid POST request, to which the router will answer us with the necessary data. Let’s look at the githabb script again and see how it’s done there:


By analogy, we form your request:


Iiiii ship. In Wireshark'e package looks like this:


See the answer:


The attentive reader will notice that the POST request was sent to "/ cgi? 1", and not as in the script to "/ cgi? 2". That's right. We just need to know the password. After receiving the data for authorization, you can deal with the already shaped disgrace.

Log in:


And already authorized we rip off any data that we only consider important by looking at the reduced_data_model.xml file:





At the moment, the source codes of the C20v4 router have been removed from the Tp-Link site and the V5 codes are posted instead. But unfortunately, there is no official firmware yet.

Good news: This vulnerability is exploited only if web access is open to all.
The bad news: someone's bots are already knocking on external addresses with the correct requests.

In addition to the ArcherC20V4 model , this vulnerability also affects the ArcherC2V5 model .