D'link Dir 825 Firmware Update
D-link Dir-825 B1 Firmware Update

DIR-655 (Xtreme N Wireless Router) - DIR-825 Rev A and B (Xtreme N Dual Band Gigabit Router) - DIR-825 Rev C (Xtreme N Dual Band Gigabit Router) - DIR-826L (N600 Dual Band Gigabit Router) - DIR-827 (HD Media Router 2000) - DIR-835 (Wireless N750 Dual-Band Router) - DIR-855L (Wireless N900 Dual Band Gigabit Router) - DIR-857 (HD Media Router 3000). To perform a factory reset on a D-Link, turn on the device, press and hold the Reset button (usually on the back of the device) with a paper clip or small pen for 10 seconds, then release it. Wait a few minutes for the router to finish booting.

The past 6 months have been incredibly busy, and I haven’t been keeping up with D-Link’s latest shenanigans. In need of some entertainment, I went to their web page today and was greeted by this atrocity:

I think the most “insane” thing about this router is that it’s running the samebuggy firmware that D-Link has been cramming in their routers for years…and the hits just keep on coming.

OK, let’s do the usual: grab the latest firmware release, binwalk it and see what we’ve got:

Looks like a pretty standard Linux firmware image, and if you’ve looked at any D-Link firmware over the past few years, you’ll probably recognize the root directory structure:

All of the HTTP/UPnP/HNAP stuff is located under the htdocs directory. The most interesting file here is htdocs/cgibin, an ARM ELF binary which is executed by the web server for, well, just about everything: all CGI, UPnP, and HNAP related URLs are symlinked to this one binary:

How to reset D Link Dir 825 Router. D-Link DIR-825 Atheros AR9344 D-Link DIR-835 Atheros AR9344. Required firmware for TP-Link Archer C7 AC1750 Qualcomm Atheros QCA9558. Zainnyy Reply.

It’s been stripped of course, but there are plenty of strings to help us out. The first thing that main does is compare argv[0] against all known symlink names (captcha.cgi, conntrack.cgi, etc) to decide which action it is supposed to take:

“Staircase” code graph, typical of if-else statements

Each of these comparisons are strcmp‘s against the expected symlink names:

This makes it easy to correlate each function handler to its respective symlink name and re-name the functions appropriately:

Renamed symlink function handlers

Now that we’ve got some of the high-level functions identified, let’s start bug hunting. Other D-Link devices running essentially the same firmware have previously been exploited through both their HTTP and UPnP interfaces. However, the HNAP interface, which is handled by the hnap_main function in cgibin, seems to have been mostly overlooked.

HNAP (Home Network Administration Protocol) is a SOAP-based protocol, similar to UPnP, that is commonly used by D-Link’s “EZ” setup utilities to initially configure the router. Unlike UPnP however, all HNAP actions, with the exception of GetDeviceInfo (which is basically useless), require HTTP Basic authentication:

The SOAPAction header is of particular importance in an HNAP request, because it specifies which HNAP action should be taken (AddPortMapping in the above example).

Since cgibin is executed as a CGI by the web server, hnap_main accesses HNAP request data, such as the SOAPAction header, via environment variables:

Towards the end of hnap_main, there is a shell command being built dynamically with sprintf; this command is then executed via system:

sprintf(command, “sh %s%s.sh > /dev/console”, “/var/run/”, SOAPAction);

Clearly, hnap_main is using data from the SOAPAction header as part of the system command! This is a promising command injection bug, if the contents of the SOAPAction header aren’t being sanitized, and if we can get into this code block without authentication.

Going back to the beginning of hnap_main, one of the first checks it does is to see if the SOAPAction header is equal to the string http://purenetworks.com/HNAP1/GetDeviceSettings; if so, then it skips the authentication check. This is expected, as we’ve already established that the GetDeviceSettings action does not require authentication:

if(strstr(SOAPAction, “http://purenetworks.com/HNAP1/GetDeviceSettings”) != NULL)

However, note that strstr is used for this check, which only indicates that the SOAPAction header contains the http://purenetworks.com/HNAP1/GetDeviceSettings string, not that the header equals that string.

So, if the SOAPAction header contains the string http://purenetworks.com/HNAP1/GetDeviceSettings, the code then proceeds to parse the action name (e.g., GetDeviceSettings) out of the header and remove any trailing double-quotes:

The WATO EX-30 and EX-20 Series of anaesthesia machines are suitable for general anaesthesia in a wide range of operating theatre patients from children to adults.With stable function, advanced safety design, reliable performance and user-friendly interface, the WATO gives clinical users basic monitoring measurements on a colorful LCD screen with up to 3 waveforms, with graphs of pressure and flow at the same time. Mindray wato ex-20 user manual.

It is the action name (e.g., GetDeviceSettings), parsed out of the header by the above code, that is sprintf‘d into the command string executed by system.

Here’s the code in C, to help highlight the flaw in the above logic:

The two important take-aways from this are:

There is no authentication check if the SOAPAction header contains the string http://purenetworks.com/HNAP1/GetDeviceSettings
The string passed to sprintf (and ultimately system) is everything after the last forward slash in the SOAPAction header

Thus, we can easily format a SOAPAction header that both satisfies the “no auth” check, and allows us to pass an arbitrary string to system:

The http://purenetworks.com/HNAP1/GetDeviceSettings portion of the header satisfies the “no auth” check, while the `reboot` string ends up getting passed to system:

Here I will show you how to watch Game of Thrones (Season 6) via HBO Now.Step 1. And the world's most successful pay TV service.You can find the total number of 60 episodes of the Game of Thrones, from season 1 to season 6. Free download game of throne season 6. And because of the 'Watch FREE for 1 month' service offered by HBO, you are able to watch the TV shows without being charged for one month in two ways: Watch on HBO Now or Watch on HBO GO.

Replacing reboot with telnetd spawns a telnet server that provides an unauthenticated root shell:

If remote administration is enabled, HNAP requests are honored from the WAN, making remote exploitation possible. Of course, the router’s firewall will block any incoming telnet connections from the WAN; a simple solution is to kill off the HTTP server and spawn your telnet server on whatever port the HTTP server was bound to:

Note that the wget requests will hang, since cgibin is essentially waiting for telnetd to return. A little Python PoC makes the exploit less awkward:

I’ve tested both the v1.00 and v1.03 firmware (v1.03 being the latest at the time of this writing), and both are vulnerable. But, as is true with most embedded vulnerabilities, this code has snuck its way into other devices as well.

D Link Dir 825 Firmware Hack