It's been over 90 days since I reported it and @TPLINK never responded, so: arbitrary command execution on the TP-Link SR20 smart hub and router (and possibly other TP-Link device)
-
Show this thread
-
TP-Link routers frequently run a process called "tddp" (TP-Link Device Debug Protocol) as root. It's had multiple vulnerabilities in the past and the protocol is fairly well documented. Version 1 has no auth, version 2 requires the admin password.
1 reply 10 retweets 84 likesShow this thread -
The SR20 still exposes some version 1 commands, one of which (command 0x1f, request 0x01) appears to be for some sort of configuration validation. You send it a filename, a semicolon and then an argument.
3 replies 4 retweets 59 likesShow this thread -
The router then connects back to the requesting machine over TFTP, requests the filename via TFTP, imports it into a LUA interpreter and passes the argument to the config_test() function in the file it just imported. The interpreter is running as root.
1 reply 9 retweets 82 likesShow this thread -
The os.execute() method allows you to execute whatever you want, and you're running as root, so victory. tddp is listening on all interfaces but the default firewall rules block WAN access, so this is local network only.
2 replies 4 retweets 69 likesShow this thread -
Anyway, stop shipping debug daemons on production firmware and if you're going to have a webform to submit security issues then have someone actually respond to it.
1 reply 21 retweets 165 likesShow this thread -
5 replies 27 retweets 168 likesShow this thread
-
(Successfully tested this using qemu-user-arm to run tddp on my laptop, which makes debugging stuff a *lot* easier)
3 replies 2 retweets 90 likesShow this thread
that seems like a good way to accidentally wipe your harddisk
-
-
Replying to @tehjh
Most fun I've had there is when something reset my clock to the epoch
0 replies 0 retweets 3 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.