| Titolo | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Stack-based Buffer Overflow |
|---|
| Descrizione | A pre-authentication stack-based buffer overflow (CWE-120) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform).
The vendor-patched boa web server (/bin/boa, running as root) performs HTTP Basic authentication by base64-decoding the Authorization header and splitting the result at the first ':'. The password-check function at 0x40c240 copies the user-name portion into two 64-byte stack buffers with strcpy:
strcpy(sp+200, username); // boa @ 0x40c2b4 - saved $ra at sp+292
strcpy(sp+96, username); // boa @ 0x40c2c0
The base64 path accepts roughly 129 decoded bytes, so a user-name of about 96 bytes overwrites the saved return address and all saved s-registers. The overflow happens before any credential validation, so no authentication is required. Because strcpy stops at NUL, the overwrite value cannot contain 0x00 bytes; everything else is fully controlled. Empirically (emulated firmware under qemu gdb stub), a 96-byte cyclic pattern as the user-name yields:
Program received signal SIGSEGV
0x31444130 in ?? () -> PC = byteswap32(username[92:96]), fully controlled
(deterministic; uClibc MIPS strcpy writes via lwl/lwr word ops, hence the byte swap). boa rate-limits authentication failures (5/600s), but a single request is enough. The crash kills the boa process (pre-auth DoS); a watchdog in /bin/switch restarts it.
Proof of concept:
username = b"A"*92 + b"\xef\xbe\xad\xde" # -> PC = 0xdeadbeef
GET /index.htm with header: Authorization: Basic base64(username + b":x")
Result: boa dies with SIGSEGV, PC = 0xdeadbeef
With a MIPS big-endian ROP chain into uClibc (load addresses effectively predictable on the 2.6.36 target), this is expected to lead to full remote code execution as root without any credentials; PC control is already demonstrated.
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation (boa under qemu gdb stub, gdb-multiarch observing the crash).
|
|---|
| Fonte | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.md |
|---|
| Utente | yyycl (UID 100580) |
|---|
| Sottomissione | 14/08/2026 13:58 (1 mese fa) |
|---|
| Moderazione | 27/09/2026 19:48 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 410945 [Netcore NR289-GE 1.4.5102 Authentication /bin/boa password-check Nome utente buffer overflow] |
|---|
| Punti | 20 |
|---|