redpack-kr/cve-2024-5243-pwn2own-toronto-2023Pre-authentication Remote Code Execution exploit for TP-Link Omada ER605 router via DDNS client daemon (cmxddnsd)
Proof-of-Concept (PoC) exploit chain targeting the TP-Link Omada ER605 DDNS client daemon (cmxddnsd) when the device is configured to use the Comexe DDNS service.
⚠️ Legal / Ethics: This repository is for authorized security research and controlled lab reproduction only. Do not use against systems you do not own or lack explicit permission to test.
This PoC demonstrates a chaining approach that combines:
The chain corresponds to the following published issues:
| CVE | ZDI Advisory | Type (as described by ZDI/NVD) | High-level role in a chain |
|---|---|---|---|
| CVE-2024-5244 | ZDI-24-503 | Reliance on security through obscurity (DDNS messages can be accessed/spoofed) | Enables crafting/spoofing valid-looking DDNS messages |
| CVE-2024-5243 | ZDI-24-502 | Buffer overflow in handling of DNS names | Used to influence/poison DNS-name-related state and enable an ASLR bypass leak path |
| CVE-2024-5242 | ZDI-24-501 | Stack-based buffer overflow in handling of DDNS error codes | Used as the control-flow hijack primitive for ROP-based RCE |
Note: This README aligns the CVE ↔ issue description to ZDI/NVD wording. The exact exploit choreography can vary by firmware build and local reproduction details; see
exploit.pyand analysis notes in this repo.
< ER605(UN)_V2_2.2.42.2.2ER605(UN)_V2_2.2.4 Build 20240119 (and later)ZDI describes the impact as network-adjacent when Comexe DDNS is enabled/configured. In practice, a reproduction typically requires the ability to observe and influence the router’s DDNS/DNS traffic path sufficiently to:
This repo intentionally avoids step-by-step operational guidance for achieving that positioning outside of a controlled lab.
┌─────────────────┐ ┌─────────────────────────┐
│ TP-Link ER605 │ │ Attacker │
│ (cmxddnsd) │ │ (authorized lab setup) │
└───────┬─────────┘ └───────────┬─────────────┘
│ │
│ (1) DDNS message spoofing/impersonation │ CVE-2024-5244
│<-----------------------------------------│
│ │
│ (2) Parsing-time overflow affects DNS- │ CVE-2024-5243
│ name-related state; later leak occurs│
│ in DNS query sending path (e.g., │
│ sndDnsQuery) to bypass ASLR │
│<-----------------------------------------│
│ │
│ (3) Error-code overflow for control-flow │ CVE-2024-5242
│ hijack → ROP → system(command) │
│<-----------------------------------------│
Key separation:
_chkPkt-adjacent parsing logic for error codes / DNS-name handling).exploit.py — PoC implementation used for lab reproduction (requires filling in build-specific constants/offsets).README.md — This document.This PoC requires build-specific values (e.g., offsets, gadget locations, leak interpretation) that depend on the target firmware and libc. These values are intentionally left as placeholders and must be derived via analysis of the tested build.
Example placeholders (see exploit.py):
system() offsetA recurring anti-pattern in the parsing logic is copying attacker-controlled field data using a delimiter-derived length without properly bounding it to the destination buffer size (conceptually):
char *end = strchr(ptr, '\x01'); // delimiter
int len = end - ptr; // attacker-influenced length
memcpy_or_strncpy(dest, ptr, len); // missing bounds check -> overflow
The PoC uses a MIPS delay-slot-friendly gadget shape:
move $t9, $s0
jalr $t9
move $a0, $s1 ; delay slot
By controlling $s0 and $s1 via saved-register overwrite, this enables a compact system(command) call sequence.
Practical payload construction is constrained by:
\x01), andSee exploit.py for the exact constraints used in this reproduction.
This code and documentation are provided for educational purposes and authorized security research only. Any use without explicit permission is prohibited and may be illegal.