WRT120N fprintf Stack Overflow

You'll have to forgive me for the awful presentation format and pacing, but here's a fun trick for bypassing the auth system on the Asus WL-700gE circa 2007:

http://www.toaster-of-doom.com/~brandon/no_crawl/router/

Spoiler alert: it makes the WRT120N look like Fort Knox. These companies have come a long way over the years.

Use OpenWRT people. Modern kernel. Good security. Can be configured with devops tools like Ansible (assuming you have the flash to load Python).

https://openwrt.org

Note this is technically a stack buffer overflow, not a stack overflow.

This is why I only buy routers that are known to be compatible with open source firmwares like Tomato, DD-WRT, or OpenWRT. I have never trusted OEM firmware, not only for security but they tend to be really buggy.

I'm far from an expert security pentester but I know my basics... and I'm always amazed at how simple these exploits are. Guys, come on, it's 2014, if you're writing C and using strcat/strcpy/sprintf/fprintf/etcetc with non-sanitized input, you're pretty much asking for it.

Even a rookie would spot such mistake and exploit it, it's always among the first obstacles to bypass at local CTFs and it's the #1 exploit that people think about when they think about a "security vulnerability".

In other news, it's 2014 and people still use non-bounds-checked string libraries in C to deal with unvalidated and unauthenticated inputs from a network.

Every time I see stuff like this (buffer of some convenient fixed length, no real attention paid to its length) I really wonder whether whoever wrote that code ever thought of how long a string could be (the entire address space of your process, basically), what the limits are, etc. If vsprintf() had the same 256-byte limit on its output buffer, there wouldn't be any overflow. If this fprintf() implementation was documented as to be used for output not exceeding 255 bytes, maybe who wrote the caller code would use "Location: %.243s\n\n" instead. Although a fully general fprintf() should not have any arbitrary limits like that, in a special-case embedded system like this it's not uncommon --- but if it has limits, they should be documented clearly.

I think it's not a matter of language or "safety" or "security" or anything else; it's a very, very, VERY simple matter of knowing the sizes and limits whenever you write code or design anything. Somehow I think all this... astounding ignorance stems from the misconception that memory is somehow an infinite resource, or the discouraging "if you need to know the limits, you're doing it wrong" type of thought. It is very important that you know the limits, so that you can work within them.

(Capitalising the words "Stack Overflow" is now a bit confusing, thanks to the site of the same name...)

For those following along at home remember that MIPS has a delay slot. That's why the add is listed after the jr even though the add is executed before the return.

I still remember HN/reddit bashing Chinese crap router with crap firmware yesteryear :)

Are there ANY hardware manufactures that know how to write software? It seems like both firmware and hardware were an afterthought to almost any piece of computer hardware I have seen.

Man having worked on a few router firmware sources I'm surprised there's not an exploit for every router out there, except maybe for the OpenWRT ones.

There was one router that had a built in backdoor, lets say you hit the router on a hidden page /sysctrl.html, which gives you essentially a poor-man's console with an input to send any command as root and it writes the output into a textarea. I mean it's as simple as launching telnet and then you're on the router as root.

This article reminds me of a talk given at 29c3:

http://youtu.be/f3zUOZcewtA

Embedded devices are woefully insecure and no one seems to care!

"I respect myself. That's why I refuse to use sprintf"

hahah. Nice.

What editor is that?