[原创]TD路由器环境模拟与漏洞分析-智能设备-看雪安全社区

[原创]TD路由器环境模拟与漏洞分析

发表于: 2025-11-27 10:33 1511

[原创]TD路由器环境模拟与漏洞分析

易之生生

2025-11-27 10:33

1511

版本 : AX3000_Pro_V16.03.49.26

EMUX : emux

首先按照官方的步骤配置EMUX的环境:

如果build-emux-docker编译失败,设置DOCKER_BUILDKIT=0:

之后执行./run-emux-docker就进入了EMUX:

路由器的固件配置是在files/emux/firmware目录，新建一个TENDA-USAX3000目录，目录结构如下:

config 为配置文件，kernel下的为Linux内核文件，squashfs-root下的为路由器固件.

config内容如下:

然后在firmware下的devices中增加一条路由器的设备信息,路由器的固件环境配置就完成了.

之后运行 ./build-emux-volume :

然后运行 ./run-emux-docker ,进入emux shell:

运行launcher 选择运行的设备,或者新开一个窗口,运行 ./emux-docker-shell同样进入EMUX-DOCKER的SHELL,之后运行launcher选择路由器固件:

EMUX Devices

之后进入EMUX DEVICE CONSOLE:

输入root进入路由器的环境选择页面:

EMUX TD LOGIN

第一个是进入EMUX的AArch64环境，第二个是按照config的配置文件运行initcommands="/etc_ro/init_tab"后进入路由器的环境，第三个是直接进入路由器的固件shell,选择第三个进入路由器的固件shell:

查看 inittab 的信息:

路由器环境初始化运行的是rcS脚本,可以直接运行rcS脚本，也可以选择性的运行以下的命令:

之后运行开启httpd服务的命令:

HTTPD的报错提示分为两个部分，一个是connect和func:cfms_mib_proc_handle的错误，另一个是goahead的错误，优先分析goahead的错误。

根据setLocalHost error的提示，应该是httpd的main调用libgo.so的websOpen时报错，在websOpen的子函数sub_FFFFF7983690发现有获取br0网桥的地址：

TD BR0

使用ip link 新增一个虚拟网桥br0,并分配和eth0相同的IP地址:

再次运行/bin/httpd --debugger --verbose 成功开启HTTPD服务:

根据EMUX的端口映射信息，访问20080端口成功打开登陆页面:

WY LOGIN

但是输入任何密码都无法进入，重新打开一个emux-docker 输入 userspace 选择第三个进入路由器的HOST:

进入/var/webroot 查看 default.cfg 的配置文件:

因为没有设置密码sys.userpass的值为空，但是sys.quickset.cfg为1应该进入路由器的设置页面，却没有进入。

在libgo.so中的authSecurityHandler函数中有对g_fast_setting == 1时跳转到quickset.html的判断:

FAST SETTING

查看g_fast_setting的写函数,是调用了libcommon.so的GetValue()函数获取sys.quickset.cfg的值:

FAST SETTING

在libcommon.so的GetValue函数中，有对unix套接字/var/cfm_socket的连接操作:

FAST SETTING

cfms_encode_msg 和 cfms_proc_send_msg 为发送MSG信息;

ugw_proc_recv_msg 和 cfms_decode_msg 为接收MSG信息。

搜索/var/cfm_socket字符串，在/bin/cfmd的程序中有注册unix socket /var/cfm_socket的操作:

UNIX CFM_SOCKET

直接运行/bin/cfmd 提示获取mtd的大小失败:

对应的代码如下:

UNIX CFM_SOCKET

跟进get_mtd_size_w("CFG")函数,在libcommon.so的get_mtd_size中有对mtd的操作:

UNIX CFM_SOCKET

对mtd_open函数进行分析，其读取/proc/mtd的内容，根据name的值找到对应的mtd:

UNIX CFM_SOCKET

查看/proc/mtd信息，如果可以增加一条name为CFG的mtd1信息，然后在/dev/下创建一个mtd1的image，那么这个cfmd程序或许就会运行成功。另外一种方式是直接编程实现/var/cfm_socket的unix socket。

CFM_SOCKET基本功能就是读写default.cfg配置文件信息，分析libcommon.so的GetValue和SetValue，其cfms_encode_msg和cfms_decode_msg的函数如下:

CFM_SOCKET

消息格式为 [长度+JSON(type,name,value)]

在cfmd程序调用cfms_encode_msg时，对type进行了+1:

CFM_SOCKET

程序接收和发送查询信息的消息格式如下:

首先将default.cfg转为ini格式的文件，生成default.ini的cfg_parser.py代码如下:

模拟cfm_socket的uds_server.py代码如下:

正常情况是直接在EMUX的路由器环境中模拟/var/cfm_socket通信，但是路由器的环境不支持PYTHON，需要在远程运行一个TCP服务，然后使用socat命令将远程的TCP服务端口映射到路由器的/var/cfm_socket路径。

将uds_server.py和default.ini文件复制到workspace目录中，并在主机的SHELL运行以下命令:

这样就开启了一个TCP服务，并监听172.22.197.151:8888端口。

重新打开一个emux-docker 输入 userspace 选择第一个进入EMUX HOSTFS shell,运行以下的命令:

这样远程的172.22.197.151:8888端口就被映射到了路由器固件的/var/cfm_socket路径上。

在路由器环境中查看cfm_socket已经存在:

现在运行/bin/httpd程序，不再提示任何错误:

访问c07K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5%4x3W2)9J5k6e0t1J5i4K6u0W2x3e0V1%4i4K6u0W2x3e0f1I4i4K6y4m8x3U0l9H3z5o6m8Q4x3V1k6I4N6h3W2U0K9%4y4W2N6q4)9J5k6h3S2@1L8h3I4Q4c8e0g2Q4z5f1y4Q4b7U0m8Q4c8e0g2Q4z5f1c8Q4z5o6m8Q4c8e0S2Q4b7V1k6Q4z5f1u0Q4c8e0g2Q4z5o6g2Q4b7e0g2Q4c8e0S2Q4b7U0N6Q4b7f1k6Q4c8e0N6Q4z5e0c8Q4b7U0q4Q4c8e0g2Q4z5e0W2Q4b7e0S2Q4c8e0N6Q4z5f1q4Q4z5o6c8Q4c8e0S2Q4b7f1g2Q4b7V1g2Q4c8e0N6Q4b7V1c8Q4b7f1g2Q4c8e0W2Q4b7e0q4Q4b7U0g2Q4c8e0W2Q4z5f1c8Q4b7e0u0Q4x3V1y4Q4c8e0S2Q4b7f1g2Q4b7V1g2Q4c8e0N6Q4b7V1c8Q4b7f1g2Q4c8e0N6Q4b7f1g2Q4b7e0q4Q4c8e0N6Q4z5e0m8Q4z5o6k6Q4c8e0g2Q4b7f1k6Q4z5o6k6Q4c8e0N6Q4b7e0m8Q4z5o6q4Q4c8e0g2Q4z5e0m8Q4z5p5g2Q4c8e0N6Q4z5e0W2Q4b7V1u0Q4c8e0W2Q4z5e0W2Q4z5o6k6Q4c8e0k6Q4z5o6S2Q4z5e0m8Q4c8e0g2Q4z5p5q4Q4z5f1k6Q4x3@1p5`.

TD HTML

在libgo.so的UploadCfg函数中存在命令注入漏洞，如果上传名称为'&busybox telnetd -l sh -p 9999&killall -9 httpd&'1.cfg的文件，可将上传文件的名称作为shell的命令执行，在9999端口开启telnetd服务。

漏洞代码如下:

Remote Command Injection

运行结果如下:

Remote Command Injection

POC代码如下:

docker run hello-world
 
sudo groupadd docker
sudo gpasswd -a $USER docker
sudo usermod -aG docker $USER
 
git clone --depth 1 --single-branch  https://github.com/therealsaumil/emux.git
 
cd emux
./build-emux-volume
./build-emux-docker

docker run hello-world

sudo groupadd docker

sudo gpasswd -a $USER docker

sudo usermod -aG docker $USER

git clone --depth 1 --single-branch https://github.com/therealsaumil/emux.git

cd emux

./build-emux-volume

./build-emux-docker

- DOCKER_BUILDKIT=1 docker build -t $OWNERNAME/$IMAGENAME:$TAGNAME \
                                 -f Dockerfile-emux .
+ DOCKER_BUILDKIT=0 docker build -t $OWNERNAME/$IMAGENAME:$TAGNAME \
                                 -f Dockerfile-emux .

- DOCKER_BUILDKIT=1 docker build -t $OWNERNAME/$IMAGENAME:$TAGNAME \

-f Dockerfile-emux .

+ DOCKER_BUILDKIT=0 docker build -t $OWNERNAME/$IMAGENAME:$TAGNAME \

-f Dockerfile-emux .

/run-emux-docker
[+] Starting tun0
[+] Starting NFS
   program version netid     address                service    owner
    100000    4    tcp6      ::.0.111               -          superuser
    100000    3    tcp6      ::.0.111               -          superuser
    100000    4    udp6      ::.0.111               -          superuser
    100000    3    udp6      ::.0.111               -          superuser
    100000    4    tcp       0.0.0.0.0.111          -          superuser
    100000    3    tcp       0.0.0.0.0.111          -          superuser
    100000    2    tcp       0.0.0.0.0.111          -          superuser
    100000    4    udp       0.0.0.0.0.111          -          superuser
    100000    3    udp       0.0.0.0.0.111          -          superuser
    100000    2    udp       0.0.0.0.0.111          -          superuser
    100000    4    local     /var/run/rpcbind.sock  -          superuser
    100000    3    local     /var/run/rpcbind.sock  -          superuser
rpc.nfsd: knfsd is currently down
rpc.nfsd: Writing version string to kernel: -2 +3
rpc.nfsd: Created AF_INET TCP socket.
rpc.nfsd: Created AF_INET6 TCP socket.
rpc.nfsd: knfsd is currently up
exporting 192.168.100.0/24:/emux
/emux           192.168.100.0/24
[+] Setting up forwarded ports 20080:80,20443:443,28080:8080,24433:4433,9999:9999
[+] mapping port 20080 -> 192.168.100.2:80
[+] mapping port 20443 -> 192.168.100.2:443
[+] mapping port 28080 -> 192.168.100.2:8080
[+] mapping port 24433 -> 192.168.100.2:4433
[+] mapping port 9999 -> 192.168.100.2:9999
  ___ __  __ _   __  __
 / __|  \/  | | |\ \/ /   by Saumil Shah | The Exploit Laboratory
 | __| |\/| | |_| )  (    @therealsaumil | emux.exploitlab.net
 \___|_|  |__\___/_/\_\

/run-emux-docker

[+] Starting tun0

[+] Starting NFS

program version netid address service owner

100000 4 tcp6 ::.0.111 - superuser

100000 3 tcp6 ::.0.111 - superuser

100000 4 udp6 ::.0.111 - superuser

100000 3 udp6 ::.0.111 - superuser

100000 4 tcp 0.0.0.0.0.111 - superuser

100000 3 tcp 0.0.0.0.0.111 - superuser

100000 2 tcp 0.0.0.0.0.111 - superuser

100000 4 udp 0.0.0.0.0.111 - superuser

100000 3 udp 0.0.0.0.0.111 - superuser

100000 2 udp 0.0.0.0.0.111 - superuser

100000 4 local /var/run/rpcbind.sock - superuser

100000 3 local /var/run/rpcbind.sock - superuser

rpc.nfsd: knfsd is currently down

rpc.nfsd: Writing version string to kernel: -2 +3

rpc.nfsd: Created AF_INET TCP socket.

rpc.nfsd: Created AF_INET6 TCP socket.

rpc.nfsd: knfsd is currently up

exporting 192.168.100.0/24:/emux

/emux 192.168.100.0/24

[+] Setting up forwarded ports 20080:80,20443:443,28080:8080,24433:4433,9999:9999

[+] mapping port 20080 -> 192.168.100.2:80

[+] mapping port 20443 -> 192.168.100.2:443

[+] mapping port 28080 -> 192.168.100.2:8080

[+] mapping port 24433 -> 192.168.100.2:4433

[+] mapping port 9999 -> 192.168.100.2:9999

___ __ __ _ __ __

/ __| \/ | | |\ \/ / by Saumil Shah | The Exploit Laboratory

| __| |\/| | |_| ) ( @therealsaumil | emux.exploitlab.net

\___|_| |__\___/_/\_\

.
├── config
├── kernel
│   └── gzImage-5.10.25-arm64
└── squashfs-root

.

├── config

├── kernel

│ └── gzImage-5.10.25-arm64

└── squashfs-root

# Sample device configuration file
#
# The device ID should have a prefix of 'firmware/' or 'firmware-extra/'
# depending upon which parent directory you wish to place the firmware into
#
id=firmware/TENDA-USAX3000
#nvram=nvram.ini
rootfs=squashfs-root
randomize_va_space=0
#ld_preload=preload
initcommands="/etc_ro/init_tab"

# Sample device configuration file

#

# The device ID should have a prefix of 'firmware/' or 'firmware-extra/'

# depending upon which parent directory you wish to place the firmware into

#

id=firmware/TENDA-USAX3000

#nvram=nvram.ini

rootfs=squashfs-root

randomize_va_space=0

#ld_preload=preload

initcommands="/etc_ro/init_tab"

firmware/TENDA-USAX3000,qemu-system-aarch64,virt,cortex-a72,,256M,gzImage-5.10.25-arm64,VIRTARM64,TENDA-USAX3000 (AArch64 Simulation)

./build-emux-volume
Removing harambe
harambe
Removing null image
Untagged: null:latest
Deleted: sha256:e15dabec267fc72e817f5c47a58fb83dc549281c0611fceb98a0432abf597211
Creating harambe afresh
harambe
Making a new null image
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/
 
Sending build context to Docker daemon  1.276GB
Step 1/2 : FROM scratch
 --->
Step 2/2 : CMD [""]
 ---> Running in 37b7b3197dbb
 ---> Removed intermediate container 37b7b3197dbb
 ---> 63cb1fedd6cd
Successfully built 63cb1fedd6cd
Successfully tagged null:latest
05a92b329f2556a35add5fdb1336250ab6d60e311adab5bf435565a30b63986b
Copying from files/emux to /emux
files/emux/LICENSE.TXT -> /emux
Successfully copied 18.4kB to empty:/emux
files/emux/firmware -> /emux
Successfully copied 983MB to empty:/emux
files/emux/hostfs -> /emux
Successfully copied 56.6MB to empty:/emux
files/emux/qemuopts -> /emux
Successfully copied 2.56kB to empty:/emux
files/emux/run -> /emux
Successfully copied 49.2kB to empty:/emux
files/emux/template -> /emux
Successfully copied 54.2MB to empty:/emux
Done..cleaning up containers
empty

./build-emux-volume

Removing harambe

harambe

Removing null image

Untagged: null:latest

Deleted: sha256:e15dabec267fc72e817f5c47a58fb83dc549281c0611fceb98a0432abf597211

Creating harambe afresh

harambe

Making a new null image

DEPRECATED: The legacy builder is deprecated and will be removed in a future release.

Install the buildx component to build images with BuildKit:

https://docs.docker.com/go/buildx/

Sending build context to Docker daemon 1.276GB

Step 1/2 : FROM scratch

--->

Step 2/2 : CMD [""]

---> Running in 37b7b3197dbb

---> Removed intermediate container 37b7b3197dbb

---> 63cb1fedd6cd

Successfully built 63cb1fedd6cd

Successfully tagged null:latest

05a92b329f2556a35add5fdb1336250ab6d60e311adab5bf435565a30b63986b

Copying from files/emux to /emux

files/emux/LICENSE.TXT -> /emux

Successfully copied 18.4kB to empty:/emux

files/emux/firmware -> /emux

Successfully copied 983MB to empty:/emux

files/emux/hostfs -> /emux

Successfully copied 56.6MB to empty:/emux

files/emux/qemuopts -> /emux

Successfully copied 2.56kB to empty:/emux

files/emux/run -> /emux

Successfully copied 49.2kB to empty:/emux

files/emux/template -> /emux

Successfully copied 54.2MB to empty:/emux

Done..cleaning up containers

empty

./run-emux-docker
[+] Starting tun0
[+] Starting NFS
   program version netid     address                service    owner
    100000    4    tcp6      ::.0.111               -          superuser
    100000    3    tcp6      ::.0.111               -          superuser
    100000    4    udp6      ::.0.111               -          superuser
    100000    3    udp6      ::.0.111               -          superuser
    100000    4    tcp       0.0.0.0.0.111          -          superuser
    100000    3    tcp       0.0.0.0.0.111          -          superuser
    100000    2    tcp       0.0.0.0.0.111          -          superuser
    100000    4    udp       0.0.0.0.0.111          -          superuser
    100000    3    udp       0.0.0.0.0.111          -          superuser
    100000    2    udp       0.0.0.0.0.111          -          superuser
    100000    4    local     /var/run/rpcbind.sock  -          superuser
    100000    3    local     /var/run/rpcbind.sock  -          superuser
rpc.nfsd: knfsd is currently down
rpc.nfsd: Writing version string to kernel: -2 +3
rpc.nfsd: Created AF_INET TCP socket.
rpc.nfsd: Created AF_INET6 TCP socket.
rpc.nfsd: knfsd is currently up
exporting 192.168.100.0/24:/emux
/emux           192.168.100.0/24
[+] Setting up forwarded ports 20080:80,20443:443,28080:8080,24433:4433,9999:9999
[+] mapping port 20080 -> 192.168.100.2:80
[+] mapping port 20443 -> 192.168.100.2:443
[+] mapping port 28080 -> 192.168.100.2:8080
[+] mapping port 24433 -> 192.168.100.2:4433
[+] mapping port 9999 -> 192.168.100.2:9999
  ___ __  __ _   __  __
 / __|  \/  | | |\ \/ /   by Saumil Shah | The Exploit Laboratory
 | __| |\/| | |_| )  (    @therealsaumil | emux.exploitlab.net
 \___|_|  |__\___/_/\_\
 
[EMUX-DOCKER ] ~$

./run-emux-docker

[+] Starting tun0

[+] Starting NFS

program version netid address service owner

100000 4 tcp6 ::.0.111 - superuser

100000 3 tcp6 ::.0.111 - superuser

100000 4 udp6 ::.0.111 - superuser

100000 3 udp6 ::.0.111 - superuser

100000 4 tcp 0.0.0.0.0.111 - superuser

100000 3 tcp 0.0.0.0.0.111 - superuser

100000 2 tcp 0.0.0.0.0.111 - superuser

100000 4 udp 0.0.0.0.0.111 - superuser

100000 3 udp 0.0.0.0.0.111 - superuser

100000 2 udp 0.0.0.0.0.111 - superuser

100000 4 local /var/run/rpcbind.sock - superuser

100000 3 local /var/run/rpcbind.sock - superuser

rpc.nfsd: knfsd is currently down

rpc.nfsd: Writing version string to kernel: -2 +3

rpc.nfsd: Created AF_INET TCP socket.

rpc.nfsd: Created AF_INET6 TCP socket.

rpc.nfsd: knfsd is currently up

exporting 192.168.100.0/24:/emux

/emux 192.168.100.0/24

[+] Setting up forwarded ports 20080:80,20443:443,28080:8080,24433:4433,9999:9999

[+] mapping port 20080 -> 192.168.100.2:80

[+] mapping port 20443 -> 192.168.100.2:443

[+] mapping port 28080 -> 192.168.100.2:8080

[+] mapping port 24433 -> 192.168.100.2:4433

[+] mapping port 9999 -> 192.168.100.2:9999

___ __ __ _ __ __

/ __| \/ | | |\ \/ / by Saumil Shah | The Exploit Laboratory

| __| |\/| | |_| ) ( @therealsaumil | emux.exploitlab.net

\___|_| |__\___/_/\_\

[EMUX-DOCKER ] ~$

____ __  __ _   __  __
/ ___|  \/  | | |\ \/ /   by Saumil Shah | The Exploit Laboratory
| ___| |\/| | |_| )  (    @therealsaumil | emux.exploitlab.net
\____|_|  |__\___/_/\_\   Linux 5.10.25 [aarch64]
 
Architecture:                    aarch64
CPU op-mode(s):                  32-bit, 64-bit
Byte Order:                      Little Endian
CPU(s):                          1
On-line CPU(s) list:             0
Thread(s) per core:              1
Core(s) per socket:              1
Socket(s):                       1
Vendor ID:                       ARM
Model:                           3
Model name:                      Cortex-A72
Stepping:                        r0p3
BogoMIPS:                        125.00
Vulnerability Itlb multihit:     Not affected
Vulnerability L1tf:              Not affected
Vulnerability Mds:               Not affected
Vulnerability Meltdown:          Not affected
Vulnerability Spec store bypass: Vulnerable
Vulnerability Spectre v1:        Mitigation; __user pointer sanitization
Vulnerability Spectre v2:        Vulnerable
Vulnerability Srbds:             Not affected
Vulnerability Tsx async abort:   Not affected
Flags:                           fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
 
EMUX DEVICE CONSOLE
 
EMUX login: root

____ __ __ _ __ __

/ ___| \/ | | |\ \/ / by Saumil Shah | The Exploit Laboratory

| ___| |\/| | |_| ) ( @therealsaumil | emux.exploitlab.net

\____|_| |__\___/_/\_\ Linux 5.10.25 [aarch64]

Architecture: aarch64

CPU op-mode(s): 32-bit, 64-bit

Byte Order: Little Endian

CPU(s): 1

On-line CPU(s) list: 0

Thread(s) per core: 1

Core(s) per socket: 1

Socket(s): 1

Vendor ID: ARM

Model: 3

Model name: Cortex-A72

Stepping: r0p3

BogoMIPS: 125.00

Vulnerability Itlb multihit: Not affected

Vulnerability L1tf: Not affected

Vulnerability Mds: Not affected

Vulnerability Meltdown: Not affected

Vulnerability Spec store bypass: Vulnerable

Vulnerability Spectre v1: Mitigation; __user pointer sanitization

Vulnerability Spectre v2: Vulnerable

Vulnerability Srbds: Not affected

Vulnerability Tsx async abort: Not affected

Flags: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid

EMUX DEVICE CONSOLE

EMUX login: root

Entering TENDA-USAX3000 (AArch64 Simulation) CONSOLE (/bin/sh)
Syntax: loadnvram <ini file>
[+] chroot /emux/firmware/TENDA-USAX3000/squashfs-root /.emux/emuxshell
/ # ls -la
total 64
drwxr-xr-x   18 1000     1000          4096 Nov 22 06:04 .
drwxr-xr-x   18 1000     1000          4096 Nov 22 06:04 ..
drwxr-xr-x    2 0        0             4096 Nov 22 06:04 .emux
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 bin
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 cfg
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 cfg_bak
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 data
lrwxrwxrwx    1 1000     1000            10 Nov 18 03:51 debug -> /var/debug
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 dev
lrwxrwxrwx    1 1000     1000             8 Nov 18 03:51 etc -> /var/etc
drwxr-xr-x   10 1000     1000          4096 Nov 18 03:51 etc_ro
lrwxrwxrwx    1 1000     1000             9 Nov 18 03:51 home -> /var/home
lrwxrwxrwx    1 1000     1000            11 Nov 18 03:51 init -> bin/busybox
drwxr-xr-x    4 1000     1000          4096 Nov 18 03:51 lib
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 mnt
dr-xr-xr-x  104 0        0                0 Nov 22 05:54 proc
lrwxrwxrwx    1 1000     1000             9 Nov 18 03:51 root -> /var/root
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 sbin
dr-xr-xr-x   12 0        0                0 Nov 22 05:54 sys
drwxr-xr-x    2 1000     1000          4096 Nov 18 03:51 tmp
drwxr-xr-x    6 1000     1000          4096 Nov 18 03:51 usr
drwxr-xr-x    6 1000     1000          4096 Nov 18 03:51 var
lrwxrwxrwx    1 1000     1000            12 Nov 18 03:51 webroot -> /var/webroot
drwxr-xr-x    3 1000     1000          4096 Nov 18 03:51 webroot_ro
/ #

Entering TENDA-USAX3000 (AArch64 Simulation) CONSOLE (/bin/sh)

Syntax: loadnvram <ini file>

[+] chroot /emux/firmware/TENDA-USAX3000/squashfs-root /.emux/emuxshell

/ # ls -la

total 64

drwxr-xr-x 18 1000 1000 4096 Nov 22 06:04 .

drwxr-xr-x 18 1000 1000 4096 Nov 22 06:04 ..

drwxr-xr-x 2 0 0 4096 Nov 22 06:04 .emux

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 bin

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 cfg

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 cfg_bak

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 data

lrwxrwxrwx 1 1000 1000 10 Nov 18 03:51 debug -> /var/debug

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 dev

lrwxrwxrwx 1 1000 1000 8 Nov 18 03:51 etc -> /var/etc

drwxr-xr-x 10 1000 1000 4096 Nov 18 03:51 etc_ro

lrwxrwxrwx 1 1000 1000 9 Nov 18 03:51 home -> /var/home

lrwxrwxrwx 1 1000 1000 11 Nov 18 03:51 init -> bin/busybox

drwxr-xr-x 4 1000 1000 4096 Nov 18 03:51 lib

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 mnt

dr-xr-xr-x 104 0 0 0 Nov 22 05:54 proc

lrwxrwxrwx 1 1000 1000 9 Nov 18 03:51 root -> /var/root

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 sbin

dr-xr-xr-x 12 0 0 0 Nov 22 05:54 sys

drwxr-xr-x 2 1000 1000 4096 Nov 18 03:51 tmp

drwxr-xr-x 6 1000 1000 4096 Nov 18 03:51 usr

drwxr-xr-x 6 1000 1000 4096 Nov 18 03:51 var

lrwxrwxrwx 1 1000 1000 12 Nov 18 03:51 webroot -> /var/webroot

drwxr-xr-x 3 1000 1000 4096 Nov 18 03:51 webroot_ro

/ #

cat inittab
::sysinit:/etc_ro/init.d/rcS
ttyS0::respawn:/sbin/sulogin
#先取消登录，直接进入shell
#ttyS0::askfirst:/bin/sh

cat inittab

::sysinit:/etc_ro/init.d/rcS

ttyS0::respawn:/sbin/sulogin

#先取消登录，直接进入shell

#ttyS0::askfirst:/bin/sh

PATH=/sbin:/bin:/usr/sbin:/usr/bin/
export PATH
mount -t proc none /proc
mount -t sysfs none /sys
mount -t debugfs none /sys/kernel/debug
 
mount -t ramfs none /var/
mount -t tmpfs none /data/
 
mkdir -p /var/etc
mkdir -p /var/media
mkdir -p /var/webroot
mkdir -p /var/etc/iproute
mkdir -p /var/run
mkdir -p /etc/udhcpc
mkdir -p /var/debug
 
cp -rf /etc_ro/eth_name_conf.txt /var/
cp -rf /etc_ro/eth_to_port_config.txt /var/
cp -rf /etc_ro/led_stat_rssi_th.txt /var/
cp -rf /etc_ro/config_encrypt_pass /var/config_encrypt_pass
cp -rf /etc_ro/rsa_public_key.pem /var/
cp -rf /etc_ro/signed_key /var/
cp -rf /etc_ro/* /etc/
cp -rf /webroot_ro/* /webroot/
cp -rf /etc_ro/speedtest-config.php /var/
umount -f /tmp
mount -t tmpfs none /tmp -o size=20M
mount -a
mount -t ramfs /dev
mkdir /dev/pts
mount -t devpts devpts /dev/pts
/sbin/mdev -s
mkdir /var/run
 
cd /dev
mkDev    console    c    5    1    $disk
mkDev    ttyS0    c    204    64    $disk
mkDev    urandom    c    1      9   $disk
cd /
/bin/cnsl_safe &
/sbin/udevd &
#echo '/sbin/mdev' > /proc/sys/kernel/hotplug
#echo 'sd[a-z][0-9] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH' >> /etc/mdev.conf
#echo '-sd[a-z] 0:0 0660 $/usr/sbin/usb_down.sh $MDEV $DEVPATH'>> /etc/mdev.conf
#echo 'sd[a-z] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH'>> /etc/mdev.conf
#echo '.* 0:0 0660 */usr/sbin/IppPrint.sh $ACTION $INTERFACE'>> /etc/mdev.conf
 
mkdir -p /var/ppp

PATH=/sbin:/bin:/usr/sbin:/usr/bin/

export PATH

mount -t proc none /proc

mount -t sysfs none /sys

mount -t debugfs none /sys/kernel/debug

mount -t ramfs none /var/

mount -t tmpfs none /data/

mkdir -p /var/etc

mkdir -p /var/media

mkdir -p /var/webroot

mkdir -p /var/etc/iproute

mkdir -p /var/run

mkdir -p /etc/udhcpc

mkdir -p /var/debug

cp -rf /etc_ro/eth_name_conf.txt /var/

cp -rf /etc_ro/eth_to_port_config.txt /var/

cp -rf /etc_ro/led_stat_rssi_th.txt /var/

cp -rf /etc_ro/config_encrypt_pass /var/config_encrypt_pass

cp -rf /etc_ro/rsa_public_key.pem /var/

cp -rf /etc_ro/signed_key /var/

cp -rf /etc_ro/* /etc/

cp -rf /webroot_ro/* /webroot/

cp -rf /etc_ro/speedtest-config.php /var/

umount -f /tmp

mount -t tmpfs none /tmp -o size=20M

mount -a

mount -t ramfs /dev

mkdir /dev/pts

mount -t devpts devpts /dev/pts

/sbin/mdev -s

mkdir /var/run

cd /dev

mkDev console c 5 1 $disk

mkDev ttyS0 c 204 64 $disk

mkDev urandom c 1 9 $disk

cd /

/bin/cnsl_safe &

/sbin/udevd &

#echo '/sbin/mdev' > /proc/sys/kernel/hotplug

#echo 'sd[a-z][0-9] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH' >> /etc/mdev.conf

#echo '-sd[a-z] 0:0 0660 $/usr/sbin/usb_down.sh $MDEV $DEVPATH'>> /etc/mdev.conf

#echo 'sd[a-z] 0:0 0660 @/usr/sbin/usb_up.sh $MDEV $DEVPATH'>> /etc/mdev.conf

#echo '.* 0:0 0660 */usr/sbin/IppPrint.sh $ACTION $INTERFACE'>> /etc/mdev.conf

mkdir -p /var/ppp

/bin/httpd --debugger --verbose
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
goahead: 0: setLocalHost error
goahead: 0: Cannot initialize server. Exiting.

/bin/httpd --debugger --verbose

connect: No such file or directory

func:cfms_mib_proc_handle, line:199 connect cfmd is error.

goahead: 0: setLocalHost error

goahead: 0: Cannot initialize server. Exiting.

ip link add name br0 type bridge
ip link set br0 up
ip addr add 192.168.100.2/24 dev br0

ip link add name br0 type bridge

ip link set br0 up

ip addr add 192.168.100.2/24 dev br0

/bin/httpd --debugger --verbose
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
[init_ucloud_v2][1182]:cgi_ucloud_init start
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
connect: No such file or directory
func:cfms_mib_proc_handle, line:199 connect cfmd is error.
goahead: 2: Configuration for Embedthis GoAhead
goahead: 2: ---------------------------------------------goahead: 2: Version:            4.0.1
goahead: 2: BuildType:          Debug
goahead: 2: CPU:                arm
goahead: 2: OS:                 linux
goahead: 2: Host:               192.168.100.2
goahead: 2: Directory:          /
goahead: 2: Documents:          /webroot/publish
goahead: 2: Configure:          me -d -q -platform linux-x86-default -configure . -gen make
goahead: 2: ---------------------------------------------goahead: 2: Started http://*:80

/bin/httpd --debugger --verbose

connect: No such file or directory

func:cfms_mib_proc_handle, line:199 connect cfmd is error.

[init_ucloud_v2][1182]:cgi_ucloud_init start

connect: No such file or directory

func:cfms_mib_proc_handle, line:199 connect cfmd is error.

connect: No such file or directory

func:cfms_mib_proc_handle, line:199 connect cfmd is error.

goahead: 2: Configuration for Embedthis GoAhead

goahead: 2: ---------------------------------------------goahead: 2: Version: 4.0.1

goahead: 2: BuildType: Debug

goahead: 2: CPU: arm

goahead: 2: OS: linux

goahead: 2: Host: 192.168.100.2

goahead: 2: Directory: /

goahead: 2: Documents: /webroot/publish

goahead: 2: Configure: me -d -q -platform linux-x86-default -configure . -gen make

goahead: 2: ---------------------------------------------goahead: 2: Started http://*:80

...
sys.quickset.cfg=1
...
sys.username=admin
sys.userpass=
...

...

sys.quickset.cfg=1

...

sys.username=admin

sys.userpass=

...

/bin/cfmd
cfms_apmib_init 720: cfms apmib init fail (try 1 times)
cfms_apmib_init 720: cfms apmib init fail (try 2 times)
cfms_apmib_init 726: cfms apmib init fail
cfms_apmib_default 538: Restore default apmib config
func:cfms_apmib_default, line:544, get mtd size is fail.

/bin/cfmd

cfms_apmib_init 720: cfms apmib init fail (try 1 times)

cfms_apmib_init 720: cfms apmib init fail (try 2 times)

cfms_apmib_init 726: cfms apmib init fail

cfms_apmib_default 538: Restore default apmib config

func:cfms_apmib_default, line:544, get mtd size is fail.

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 08000000 00004000 "NAND simulator partition 0"

cat /proc/mtd

dev: size erasesize name

mtd0: 08000000 00004000 "NAND simulator partition 0"

00000000: 2C 00 00 00 7B 22 74 79  70 65 22 3A 34 2C 22 6E  ,...{"type":4,"n
00000010: 61 6D 65 22 3A 22 73 79  73 2E 73 73 6C 65 6E 61  ame":"sys.sslena
00000020: 62 6C 65 22 2C 22 76 61  6C 75 65 22 3A 22 22 7D  ble","value":""}
 
00000000: 32 00 00 00 7B 22 74 79  70 65 22 3A 20 35 2C 20  2...{"type": 5,
00000010: 22 6E 61 6D 65 22 3A 20  22 73 79 73 2E 73 73 6C  "name": "sys.ssl
00000020: 65 6E 61 62 6C 65 22 2C  20 22 76 61 6C 75 65 22  enable", "value"
00000030: 3A 20 22 31 22 7D                                 : "1"}

00000000: 2C 00 00 00 7B 22 74 79 70 65 22 3A 34 2C 22 6E ,...{"type":4,"n

00000010: 61 6D 65 22 3A 22 73 79 73 2E 73 73 6C 65 6E 61 ame":"sys.sslena

00000020: 62 6C 65 22 2C 22 76 61 6C 75 65 22 3A 22 22 7D ble","value":""}

00000000: 32 00 00 00 7B 22 74 79 70 65 22 3A 20 35 2C 20 2...{"type": 5,

00000010: 22 6E 61 6D 65 22 3A 20 22 73 79 73 2E 73 73 6C "name": "sys.ssl

00000020: 65 6E 61 62 6C 65 22 2C 20 22 76 61 6C 75 65 22 enable", "value"

00000030: 3A 20 22 31 22 7D : "1"}

import configparser
 
def convert_to_ini_format(input_file, output_file):
    # 使用RawConfigParser替代ConfigParser
    config = configparser.RawConfigParser()
     
    # 添加默认section
    config['DEFAULT'] = {}
     
    # 读取原始文件
    with open(input_file, 'r', encoding='utf-8') as f:
        for line in f:
            line = line.strip()
            if line and '=' in line:
                key, value = line.split('=', 1)
                config['DEFAULT'][key.strip()] = value.strip()
     
    # 写入INI格式文件
    with open(output_file, 'w', encoding='utf-8') as f:
        config.write(f)
 
# 主程序
if __name__ == "__main__":
 
    input_file = "default.cfg"
    output_file = "default.ini"
     
    try:
        # 转换配置文件格式
        convert_to_ini_format(input_file, output_file)
         
    except Exception as e:
        print(f"处理配置文件时出错: {e}")

import configparser

def convert_to_ini_format(input_file, output_file):

# 使用RawConfigParser替代ConfigParser

config = configparser.RawConfigParser()

回复或点赞可查看完整内容

传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！

最后于 2025-11-27 10:58 被易之生生编辑，原因：

#漏洞分析 #漏洞挖掘 #家用设备

收藏・11

免费・10

支持

最新回复 (12)
mb_dnoaagxq 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 11 粉丝 0 关注私信	mb_dnoaagxq 2 楼感谢分享 2025-11-28 10:27 0
Bonquer 雪币： 40 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 34 粉丝 1 关注私信	Bonquer 3 楼 6666 2025-12-1 10:33 0
mb_ejhuemto 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_ejhuemto 4 楼哇 2025-12-1 14:05 0
mb_xiidyjjr 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	mb_xiidyjjr 5 楼不错 2025-12-1 14:38 0
健力宝雪币： 259 活跃值： (564) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 59 粉丝 0 关注私信	健力宝 6 楼 666666666 2025-12-1 21:26 0
XiDP 雪币： 545 活跃值： (545) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 3 粉丝 4 关注私信	XiDP 7 楼感谢分享 2025-12-2 22:04 0
AK1988DA 雪币： 77 活跃值： (420) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	AK1988DA 8 楼 5 2025-12-6 13:55 0
liert 雪币： 214 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	liert 9 楼感谢分享 2025-12-7 22:45 0
leopadpanzer 雪币： 226 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 9 粉丝 0 关注私信	leopadpanzer 10 楼感谢分享 2025-12-10 09:25 0
wx_五十度灰雪币： 220 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 20 粉丝 0 关注私信	wx_五十度灰 11 楼感谢分享 2025-12-10 09:39 0
luoye_ATL 雪币： 1344 活跃值： (1668) 能力值： ( LV5，RANK：78 ) 在线值：发帖 2 回帖 19 粉丝 26 关注私信	luoye_ATL 12 楼感谢分享 2025-12-11 19:11 0
mb_zfadcpqm 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_zfadcpqm 13 楼感谢分享 5天前 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

易之生生

发帖

回帖

177

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (12)
mb_dnoaagxq 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 11 粉丝 0 关注私信	mb_dnoaagxq 2 楼感谢分享 2025-11-28 10:27 0
Bonquer 雪币： 40 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 34 粉丝 1 关注私信	Bonquer 3 楼 6666 2025-12-1 10:33 0
mb_ejhuemto 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_ejhuemto 4 楼哇 2025-12-1 14:05 0
mb_xiidyjjr 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	mb_xiidyjjr 5 楼不错 2025-12-1 14:38 0
健力宝雪币： 259 活跃值： (564) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 59 粉丝 0 关注私信	健力宝 6 楼 666666666 2025-12-1 21:26 0
XiDP 雪币： 545 活跃值： (545) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 3 粉丝 4 关注私信	XiDP 7 楼感谢分享 2025-12-2 22:04 0
AK1988DA 雪币： 77 活跃值： (420) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	AK1988DA 8 楼 5 2025-12-6 13:55 0
liert 雪币： 214 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	liert 9 楼感谢分享 2025-12-7 22:45 0
leopadpanzer 雪币： 226 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 9 粉丝 0 关注私信	leopadpanzer 10 楼感谢分享 2025-12-10 09:25 0
wx_五十度灰雪币： 220 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 20 粉丝 0 关注私信	wx_五十度灰 11 楼感谢分享 2025-12-10 09:39 0
luoye_ATL 雪币： 1344 活跃值： (1668) 能力值： ( LV5，RANK：78 ) 在线值：发帖 2 回帖 19 粉丝 26 关注私信	luoye_ATL 12 楼感谢分享 2025-12-11 19:11 0
mb_zfadcpqm 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_zfadcpqm 13 楼感谢分享 5天前 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复