TP-Link SR20 Zero-day attack @ 若渴計劃 2019.04.14

1. TP-LINK SR20,
ARBITRARY CODE EXECUTION,
ZERO-DAY ATTACK.
REDHUNG @ 若渴 2019.04.14
!1

2. !2
TP-LINK SR20

3. TP-LINK SR20
TP-LINK SR20
▸ All-In-One SR20 Smart Home
Router and Hub
▸ Was found an Zero-day attack by
Matthew Garrett
▸ TP-Link routers frequently run a
process called "TDDP" (TP-Link
Device Debug Protocol)
!3

4. !4
TP-LINK DEVICE
DEBUG PROTOCOL

5. TP-LINK DEVICE DEBUG PROTOCOL
TDDP
▸ TDDP is a simple protocol to be used for debugging.
▸ TDDP uses UDP and 1040 port to send the packet.
▸ TDDP has two versions.
▸ Version 2 is authenticated and requires password.
▸ While Version 1 can run as root without any verification.
▸ This is why we find the interesting things here.
!5

6. !6
ZERO-DAY ATTACK

7. ZERO-DAY ATTACK
TDDP IN TP-LINK SR20
▸ TP-Link SR20 runs the version 1 of TDDP, however, it
doesn’t need any verification.
▸ TP-Link SR20 sends the packet to the 1040 port.
▸ TP-Link SR20 will download the file from TFTP when the
packet’s second byte is 0x31.
▸ This may causes the Arbitrary Code Execution.
!7

8. !8
FIRMWARE
REVERSE
ENGINEERING

9. MY FIRST REVERSE-ENGINEERING
DOWNLOAD THE FIRMWARE
!9

10. MY FIRST REVERSE-ENGINEERING
BINWALK
!10

11. MY FIRST REVERSE-ENGINEERING
BINWALK
▸ We found a very interesting file called “tddp”.
!11

12. MY FIRST REVERSE-ENGINEERING
NM -D ./TDDP
!12

13. MY FIRST REVERSE-ENGINEERING
GHIDRA
將tddp複製到Ghidra中進⾏行行分析後，發現了了⼀一個名為recvfrom()的函數，它會從網路路socket中複製信息。它
會查看packet中的第⼀一個字節，並⽤用來來決定使⽤用的是哪種協議，并根據協議的版本確定要將packet傳遞給哪
個dispatcher。在v1版本中，dispatcher會查看packet的第⼆二個字節，並根據其中的值調⽤用不同的函數，
0x31就是CMD_FTEST_CONFIG。
!13

14. MY FIRST REVERSE-ENGINEERING
GHIDRA
▸ What I got …
!14

15. I’M A FOOLISH.
!15

16. MY FIRST REVERSE-ENGINEERING
FTEST_CONFIG()
!16

17. MY FIRST REVERSE-ENGINEERING
FTEST_CONFIG()
▸ What I got …
!17

18. !18
I WILL BE MORE DILIGENT …

19. REFERENCES
REFERENCES
▸ https://twitter.com/mjg59/status/1111106885736787975?
fbclid=IwAR1MfZQhfEbSOS7A1RwIpeXAlFkVeQvXM3UwuHyhru-
fPuZnHCiatcmfKzY
▸ https://mjg59.dreamwidth.org/51672.html
▸ https://www.tp-link.com/us/support/download/sr20/#Firmware
▸ http://blog.knownsec.com/2019/04/%E9%87%8D%E7%8E%B0-tp-link-sr20-
%E6%9C%AC%E5%9C%B0%E7%BD%91%E7%BB%9C%E8%BF%9C%E7%
A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F
%E6%B4%9E/
▸ http://www.myhack58.com/Article/html/3/62/2019/93431.html
!19

20. !20
THANKS FOR YOUR LISTENING!