| 标题 | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 Mini (tomato-K26-1.28.RT-MIPSR2-124-Mini.trx, build5x-124-EN, 2014-12-24). Verified on research sample OS Command Injection (CWE-78, post-authentication) |
|---|
| 描述 | The router service binary /sbin/rc reads administrator-writable NVRAM key ppp_custom in function sub_40F88C (offset 0x40F88C). The value is written via fprintf("%s\n", value) at 0x40FD54 without sanitization into pppd options file /tmp/ppp/wanoptions. Called by start_l2tp, start_pppoe, and start_pptp — all three PPP WAN types.
pppd 2.4.5 (bundled) supports the pty option, which executes its argument via execl("/bin/sh", "sh", "-c", command) as root. An authenticated web administrator can set ppp_custom to pty "/bin/sh -c arbitrary_command" for root RCE on PPP connect.
Phase A (file injection) dynamically verified: QEMU MIPS + bwrap + LD_PRELOAD; /tmp/ppp/wanoptions last line contains pty payload; strace confirms mkdir/symlinks/write(260). Phase B (pppd pty execution) requires real device (pppd needs root; blocked in qemu-usermode). |
|---|
| 来源 | ⚠️ https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/03-sub_40F88C-pppd.md |
|---|
| 用户 | WH-YHUST (UID 98329) |
|---|
| 提交 | 2026-06-19 11時57分 (2 月前) |
|---|
| 管理 | 2026-08-06 07時47分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 386455 [Shibby Tomato 1.28.0000 /tmp/ppp/wanoptions sub_40F88C ppp_custom 权限提升] |
|---|
| 积分 | 20 |
|---|