CVE-2019-17147: TP-Link TL-WR841N Exploitation

Overview

This repository documents the comprehensive reverse engineering and exploitation of CVE-2019-17147, a critical remote code execution (RCE) vulnerability in the TP-Link TL-WR841N router (MIPSEL architecture). The vulnerability resides in the httpd web server daemon, where improper input validation allows for a Stack Buffer Overflow via a custom cstr_strncpy function, leading to arbitrary code execution without authentication.

Infrastructure & Tooling

The analysis environment was established using the following components:

• Hardware: TP-Link TL-WR841N Router.
• Hardware Tools: CH341A Programmer (SPI Flash Dump), USB-TTL Converter (UART Console), SOIC8 Clip.
• Software Tools: flashrom (Memory dumping), binwalk (Firmware extraction), IDA Pro (Static analysis), GDB-Multiarch (Remote debugging), QEMU (MIPSEL Emulation).
• Firmware Version: TL-WR841N(US)_V14_180319.

Technical Analysis

1. Static Analysis

The vulnerability was identified in the /usr/bin/httpd binary. Static analysis via IDA Pro revealed a custom string copy function, cstr_strncpy, used during HTTP header parsing (specifically the Host header).

The function cstr_strncpy accepts a copy_len parameter derived from the source string length rather than the destination buffer size. This allows a classic stack buffer overflow when an overly long header is supplied. Furthermore, the http_parser_argStrToList function, which manipulates a linked list structure, is affected by this overflow, granting control over next and prev pointers.

2. Dynamic Analysis

Runtime debugging with gdbserver confirmed the crash and control over the execution flow. The memory map (vmmap) analysis revealed a critical lack of hardening:

• Heap: RWX (Read, Write, Execute) permissions.
• ASLR: Limited/Ineffective for this binary.
• NX: Disabled.

This configuration permits the direct execution of shellcode placed on the Heap, bypassing the need for complex ROP chains.

Exploitation Strategy

The exploit chain utilizes a Write-What-Where primitive derived from the corrupted linked list pointers to achieve RCE.

1. Heap Spraying: The shellcode is injected into the Heap. Due to the persistence of the heap across requests, this can be done in stages.
2. Staged Injection: To bypass null-byte restrictions in strcpy, the payload is sent in multiple requests:
   • Stage 1: Write the Shellcode address to a staging area.
   • Stage 2: Write the target GOT address to the staging area.
3. GOT Overwrite: The atol function entry in the Global Offset Table (GOT) is overwritten with the address of the shellcode.
4. Execution Trigger: The exploit forces a call to atol (via a Content-Length header), redirecting execution to the injected shellcode.

Exploit Verification

The final Python script successfully automates the attack, spawning a root shell on port 31337.

Mitigation

The vulnerability stems from insecure coding practices in buffer management.

• Source Code Fix: Replace cstr_strncpy usage with secure alternatives that strictly enforce destination buffer limits (e.g., strncpy with explicit bounds check based on sizeof(dest)).
• Binary Hardening: Enable NX (No-Execute) to prevent code execution on the stack and heap. Enable full ASLR and PIE (Position Independent Executable) to randomize memory layout.

Full Documentation

For a detailed step-by-step walkthrough of the entire process, including code analysis and environment setup, please refer to the full guides included in this repository:

• 🇮🇹 Guida Completa (Italiano)
• 🇬🇧 Full Guide (English)

Authors

• Angelo Zullo
• Simone Vitto
• Vincenzo Cantatore

Disclaimer

This project is for educational and research purposes only. The information provided is intended to improve the security of IoT devices. The authors are not responsible for any misuse of the information or code contained herein.

---

Based on original research and analysis.